Meraki

PhilipDAth

Take a look at this excellent post by @MerakiDave showing the migration path for different APs. https://community.meraki.com/t5/Wireless/Family-Tree-Meraki-MR-to-CW-Access-Point-Generations/m-p/291833

PhilipDAth

Really bad client driver compatibility. You'll frequently get clients who can't connect or don't roam properly.

PhilipDAth

This usually happens when you don't have a public IP address directly on the MX, and it's behind a NAT device. Choose a random UDP port, forward it to the MX, and then configure the MX with the public IP address and the UDP port it is reachable on (Under site-to-site VPN). It will make it rock solid.

hoposicufo

Dies ist ein häufiges Problem, das normalerweise mit einer Konfigurationsoptimierung oder einer Neuinstallation des Clients behoben werden kann. Besuchen Sie https://smokaces.de/ für die neuesten Angebote, großzügige Bonusaktionen und unser breites Spielangebot. Beginnen wir mit der Neuinstallation des AnyConnect-Profils und des Clients, und wir werden von dort aus fortfahren.

spaladug

@pdeleuw Has a support ticket been opened on this and if so can you DM me the case number so I can track this issue.

alemabrahao

Just one observation: from what I understand, that design is something imposed by the Chinese government, so I believe you have to follow it.

dmbooth

No we don't want to use Full Tunnel mode, but documentation says you have to use Full Tunnel mode on a vMX in Azure if you also want to use Routed mode (because the vMX won't advertise subnets). Routed mode is required because the vMX is replacing a competitor vendor equivalent which is doing NATing. Local breakout is an option we hadn't considered, but that doesn't require SD-WAN plus I thought? The other workaround we were considering would be to put the vMX in a separate org and configure non-Meraki VPN.

coleslaw

I'm not using any proxy, I have the radius clients configured in the NPS by network for the management lan. I created a new NPS secret yesterday just to make sure there was no whitespace och special characters etc but no change. We have a VPN to 2 VMXs in an Azure WAN with secured hubs. But this setup has worked without issues for at least 3 years. When I got in this morning the whole thing got a lot more strange. I had updated 2 sites yesterday, this morning I updated 2 more. Now all of a sudden the issue has shifted to the NPS server that was working flawlessly yesterday. So now my new server is granting access like nobodies business but the other one is discarding.. I'll have to do some kind of packet capture deep dive but now I'm 90% certain something fishy is going on in my Meraki dashboard..

cmr

Are you looking to keep device configuration or do you want cloud configuration?

alemabrahao

I partially agree; for small sites (maximum 10 users) where there isn't a large volume of traffic (generally administrative offices), it ends up being more advantageous due to the cost. You may not have such a large SLA, but even so, the cost is worthwhile if it's not a critical environment.

nrawls

Sorry, just noticed my typo. I am trying to connect....(not not trying).

cmr

As @PhilipDAth said, you will need to give the MXs WAN IP access to the internet sites required for connection checking. The list is in the dashboard and is not a large number of sites.

ShaunCro

I'll take a look and see if I can do that, thanks alemabrahao. I'm using an external splash page, so not one that is hosted by the meraki dash, so things are a bit different to the normal splash pages, and this is my first time buidling something like this, so will see if that is a function that I can call externally.

Mike-M

Thanks! That was definitely part of the problem. Adding the route to the spoke VNet and enabling VPN was absolutely necessary. As for the other part of the problem, there was an Azure User Defined Route table linked to the VMX's LAN subnet in the hub VNet. I think that was creating a loop for traffic heading from the spoke to on prem. At this point, the UDR table (defining CIDR range for the on premises networks, next hop being the VMX LAN interface) are only linked to subnets in the spokes. Traffic is flowing now, both ways. Thanks again for your response! I appreciate it. Enjoy the weekend! -Mike

JasonNgAcuutech

That is the connection from MX to the downstream infrastructure switch. For example, if MX Port 5 is connecting to the downstream infrastructure switch, It should be a ttrunk port that allows only vlan 1,100 and 200. excluding the vlan 1000.

Dunky

Wireless>Radio profiles. Click the RF profiles tab and then "New Profile. Can chose from 5 preset ones.

alemabrahao

Don't worry, I understand you. Excuse the question, but why did you choose Meraki if you don't want to use Auto VPN? It's just that I personally don't see the point in concentrating all communication on the SonicWall when Auto VPN makes everything simpler.

oliviaaaaa

This in most cases means that the static configuration was lost or not applied. Therefore, the switch defaulted back to DHCP for its management interface.

watICT

It was a browser cache issue

rfroidev

vMX is now available in beta for KVM and ESXi with the latest firmware 26.1.2. KVM Deployment Guide: https://documentation.meraki.com/SASE_and_SD-WAN/MX/Install_and_Get_Started/Installation_Guides/vMX_Setup_Guide_for_KVM ESXi Deployment Guide: https://documentation.meraki.com/SASE_and_SD-WAN/MX/Install_and_Get_Started/Installation_Guides/vMX_Setup_Guide_for_ESXI Images: https://software.cisco.com/download/beta/1970167152

Brash

You're not seeing the switching option as it's not added to your network. As @alemabrahao mentioned, you'll need to login to the Meraki portal, add the device to inventory along with a license (if you haven't already done so) and then assign it to your network.

alemabrahao

Which operating system are you trying to configure the VPN on? If it's Windows, have you already tried checking the error code in the Windows Event Viewer as previously indicated?

DanStewart

Was there any update to this from the support case? Documentation as of Feb 2026 still states the Z license tier does not have impact the MX license compliance. Only that the Z licenses themselves can not be mixed. https://documentation.meraki.com/Platform_Management/Product_Information/Licensing/Meraki_Licensing_FAQs#Meraki_MX.2FZ_Security_and_SD-WAN_Licensing_FAQs

chrisautomates

Thank you! We will have to figure out which alerts match up with which (some dont have the exact same naming but seem like they are the same) and work on that portion of automation as well.

PhilipDAth

If you are not using SASE, and are just using the AnyConnect module, you'll want to use this info. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/AnyConnect_on_the_MX_Appliance

About alemabrahao

alemabrahao

Alessandro Abrahao

Community Record

Badges