I used this PS and it works. route is persistent.   Set-VpnConnection -Name 'VPN1' -SplitTunneling $True Add-VpnConnectionRoute -ConnectionName "VPN1" -DestinationPrefix 172.1.1.0/24 ... View more

Make sure the core is in single instance spanning tree mode, that is usually the cause of problems.  The other is not having VLAN1 trunked or with the C9300 having VLANs over number 1000 ... View more

Revising this old thread. I'm having the same exact issue when a client is behind a FortiGate firewall. Has there been any update on this? ... View more

I disagree, firmware updates have very little to do with security, maybe security of a device itself, but not the clients behind it. FortiGates will update signatures and bad IP lists and other things every 30min or so with FortiGuard subscription, or you can create custom feeds. Another HUGE security advantage of FortiGate is deep-packet inspection which Meraki can't do at all, given that over 85% of all attacks are encrypted. ... View more

It's clearly a typo for the word "deprecated." ... View more

Thanks for the solution. ... View more

I'm not sure about Google Cloud specifically, but most cloud providers (AWS/Azure) do not route private subnets behind the vMX (for example the client VPN subnet in this case) out to the internet. However, VPN clients are still able to access cloud resources if you configure routing correctly. You can (1) Split tunneling; or (2) Turn the vMX to NAT mode, which is the default mode when you first spin it up. More info here: https://documentation.meraki.com/MX/Other_Topics/vMX_NAT_Mode_Use_Cases_and_FAQ ... View more

thank you for that information ... View more

There are two parts to setting up a Site to Site VPN to a cloud like the AWS cloud.   Typically, you would need a VMX in the Azure Cloud and a physical MX   The instructions to set up the VMX in the Azure Cloud are here: https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Amazon_Web_Services_(AWS) and here: https://aws.amazon.com/quickstart/architecture/cisco-meraki-vmx/   Once you have set that up, you may need to add routes in the AWS route table so packets can find their way back to the Site to Site tunnel.   Once the tunnel is in place and the servers can be pinged from the LAN the physical MX is on, then you should be able to access your server in AWS.  You could also configure a Client VPN on the physical MX so remote workers can access the servers. ... View more

Thanks Charlie. Just supporting your information adding that our switches have this behaviour also. Whilst we were resolving another issue regarding a DNS change in our network it is something that baffled us when it appeared in our logs. ... View more

@AnythingHosted    Depending on your location, I could pay for shipping.  I am looking for another lab system. ... View more

New beta 18.103 is released , had to rollback to 17.10.2 on MX64 due to poor performance, went from 100/100Mbit/s to 15/15Mbit/s. ... View more

I am seeing utilization as follows. Select the desired Network at the top. Highlight Organization and then Summary Report under the Monitor menu Change Network(s) from "Entire organization" to "A single network" Select the appliance of your choice It displays below the graph on the lefthand side ... View more

Just to close the loop on this one - it was a fairly simple fix in the end.   To create a self-signed cert (to enable Meraki Client VPN via AD auth to work):   PowerShell (admin) and run the command New-SelfSignedCertificate -DnsName "servername.fqdn.domain" -KeyAlgorithm RSA -KeyLength 2048 -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(10) Hit your Windows Key and type “Cert” and click on Manage Computer Certificates Go to Personal > Certificates and see your new Cert that you just created Right-click the new Cert and go to All Tasks > Export Yes, export the private key Personal Information Exchange, check the following: Include all certificates Export all extended properties Check Password: Make a password you’ll remember Browse to an easy to remember location like C:\Certs and Finish Expand Trusted Root Certificate Authorities, right click Certificates > All Tasks, Import… Choose your cert, enter the password, make sure importing is a success Test Note: DO NOT DELETE the certificate from Personal > Certificates - it needs this one otherwise Auth will continue to fail. ... View more

I initially looked for the ability to whitelist MACs under Networks | select SSID | Advanced Settings. There should be option to restrict access to whitelisted MACs only and then enter the MAC addresses in 6 octet notation, either with or without colon separators. This way it can easily be pasted in with keyboard commands. The optimal GUI would show currently registered MACs with delete button next to each MAC and option to Add new MAC. It would also be great to display red/green indicator if each MAC is currently on the network. I do not think having option to select from a known clients list would apply to this scenario because unknown MACs should not be allowed in until whitelisted. Regarding product lines, this feature is valuable for all products that manage Wi-Fi networks. However, I am looking for it on GR10 specifically. Regards, Jim Mauck ECM Industries, LLC ... View more

@JimboinTexas    Changing settings for the WAN should be done on the local status page only.   Once that is done, you can create a network in the application by clicking on the WiFi button at the bottom of the screen.  There you add your subnet.  Give the subnet a name and the GX an address ending in .1 with a subnet mask of 24.  Disconnect any clients and reconnect them so they get the proper address and DNS information for the network.   To setup a reserved address: Go to Settings (the gear) Click on Advanced Settings Click on Local network addressing.  Click on you network Click on the small arrow on the right hand side of the screen.  Click on the round bubble that says Reserved IP Addresses Click on the + for Reserved IP Ranges and enter a range Click on + for Device Reservations to reserve an address in the above range. -Dave ... View more

Another +1 from May 2022, after creating a bunch of policy objects as well.    2 Years in Beta for something that almost every competing firewall has had for years...? ... View more

😂👍🏻 has it been a slow long day @DHAnderson ? ... View more

Let's all just hope China does not invade Taiwan. That would be the end of the supply chain. ... View more

Check which flags are set in the RA,  I recall that there were some issues with Charter during the Beta.   Here is a potentially useful discussion of the RA Flags   https://blog.ipspace.net/2012/11/ipv6-router-advertisements-deep-dive.html   -Dave ... View more

Thanks!  I filled out the webform and then got an email asking about my auto insurance inquiry!  ... View more

@Kaman  use sign up web form given above. https://merakiresources.cisco.com/merakigo-beta?_ga=2.176768677.1243555177.1635857259-1612282553.1635763881 ... View more

  Hi I've linked a GP to default VLAN that block some subnets used in auto-vpn. all seems configured in the right way but I'm still able to access to the resources I want to block ... any suggestions ?   Thanks   ... View more