I use a dedicated heartbeat/VRRP connection between MX nodes when the LAN network is not managed by us but by a 3rd party (i.e. the customer). The LAN is then an untrusted network with no visibility or management capabilities. The dedicated connection is using a separate vlan (access port). Whatever happens on the unmanaged LAN is not taken into consideration to trigger a failover but the WAN interfaces will ALWAYS trigger a failover. If the MAIN MX looses a WAN interface, there will be a failover to the SPARE MX.   Tested and working ... View more

Thanks for the reply... So the Sentry VPN solution only provides automated VPN configurations, regardless of the VPN client (embedded in OS or separate app).   So the SM is not going to provide much difference in VPN solutions, just automation. This means Meraki only supports Anyconnect VPN client as the only straightforward solution. This is even not suitable for Linux distro's at the moment. In short, I rather use a third party VPN solution than Meraki owned solutions.   Are there any statements here which you do not agree with?   Thanks to comment   Peter ... View more

Hi,   I agree the MG21 is a suitable candidate but again another Meraki device and a license. An MG21 is 1000USD list price without license. I am in favor of external LTE modems compared to internal ones. But nevertheless, it is  an expensive solution if you talk about 50+ sites for a customer (petrol stations).   Even with a high discount, it still is a too high cost for my customers with a high number of sites. technically it is a very good solution but it doesn't fly commercially at all ... View more

Hi Bruce,   First of all, I made an error on my initial statement: The switch stack are all MS410-16 switches. port 17 on the switch A has the following SFP: SFP module CISCO-AVAGO - 1000BASE-T: 1.3 Gbps   Yes all switches in the stack go down. Switch A and B in the stack have port 16 connected to the router in an aggregation (LACP) Only switch A has a port 17 connected. Switch C is more of a backup with very limited connections.   Performing a soft reboot on the switch A via the cloud portal kills the whole stack and we get somewhere a loop of traffic because there is about 340Gb/s passing through these switches. Only after hard rebooting (power down/up) all 3 switches, things got back up.   To be more clear and make things complicated, the catalyst switches are in between two Meraki MS switches. And a dot1q tunnel is created between the ports of the catalyst switches on each end where the Meraki switches connect to.   So you get this:   MS220-8P (port 8 -----> Cisco catalyst --> Cisco catalyst --> fiber port to MS410-16 (port 17)                     trunk    <----------------------- dot1q tunnel vlan 104 -------------------------> trunk                  (vlans 602, 605, 10,20)                                                                                (vlans 602,605,10,20)     So there is no real STP negotiation with the Catalysts for the vlans in the trunk.   The reason for such an ugly setup (let;s face it, it is) is the catalyst switches belong to the customer network and there are used for other purposes. Additional fiber connections cannot be provided or created due to the location of the sites.      ... View more

Hi Bruce,   My concern is the following:   I have a primary WAN link and it is an IP MPLS connection (with an internet breakout on an exit HUB) and all VPN tunnels pass over it A secondary WAN link is a direct internet connection and active-active VPN is off and no load balancing.   I suppose using SMART breakout should exclude VPN tunnel traffic (even avoiding the default route, learned from the exit HUB) and pass the excluded traffic over the secondary WAN link.     Another scenario:   You have a single public internet WAN link and all traffic (VPN tunnel) and non-VPN tunnel pass over the same connection. This case is obvious and  excluded VPN traffic will pass in underlay to the public internet over the same WAN link.   Last scenario:   single WAN link only MPLS and default route via exit hub for overlay VPN traffic. Static default route to LAN, where a CPE router or modem allows a breakout to the internet. Assumption: all internet oriented traffic should pass over the static default route, both excluded VPN traffic as local traffic which normally would take the default route, announced by the exit HUB. In this scenario, the exclusion of VPN traffic has no added value, only when the static default route is not working properly (ping next hop...). But then the excluded VPN traffic should drop, as it is not allowed to pass over the VPN tunnel. Correct?   Thanks   P. ... View more

Hi, I am wondering if the VPN tunnels between SPOKE and HUB are passing over IP MPLS VRF setup (no internet) And the HUB provides default route (exit-HUB).   So if I want some local traffic to exit directly to internet, I would assume to have at least a second WAN directly connected to the internet, correct?   Let's say I create a static default route over a LAN port... Will this static default route be used by SMART breakout?   This is no where to be found in the Meraki documentation, which according to me is rather limited for such a desired and impacting feature.   Thanks   P. ... View more

Hi,   I finally got it properly working. changes I've made: igmp querier and BCC server in same vlan and subnet, Although the latter is not really a hard requirement, but better to do anyhow. More important and very obvious but easy to overlook, disable unknown multicast stream flooding on all switches. 🙂 Tracing shows, clients need to explicitly join the streams and block these when leaving/changing the stream. it is all IGMPv3.   What I do lack is a proper overview of the clients joining particular streams. Meraki is currently the only switch vendor not showing this. I made a request to Meraki to have this incorporated in the Meraki features.   Thanks to all for your feedback ... View more

SLAAC serves LAN subnets (i.e /64 subnets). Larger deployments /subnets, or dynamic WAN IPv6 assignment, benefits from DHCPv6 and RA. Look it from the pov of an ISP / MSP   I think both should be possible   Do you agree? ... View more

Meraki, please make sure your most routable device, being an MX gets IPv6 fully compliant. LAN + WAN +DHCP, DNS, VPN tunnels, and NETSEC L3 This is a very weird fact, Meraki is very reluctant to answer and provide a proper roadmap and very slow at incorporate it in their ecosystem.   I understand, Meraki is an enterprise solution, but even then IPv6 cannot be ignored any longer.   Competitors are much further on the IPv6 roadmap:   SD-WAN configuration for IPv6 (fortinet.com) ... View more