Good find. Certainly better than having to re-run cables. ... View more

Where are you testing the client VPN from? Inside your network (across the S2S VPN) or outside of your network? Can you show the S2S VPN settings? ... View more

The port forwarding needs to be configured on the upstream NAT device (assumedly firewall). UDP 500 and 4500 need to be forwarded to the MX's WAN interface IP address. ... View more

I thought that might be the case given MiM for HTTPS inspection is beginning to get steered away from. That said another service means another additional cost 😞   ... View more

This is typically seen when devices go into power saving mode. The following thread has some additional detail Switch port change link speed - The Meraki Community ... View more

The client VPN troubleshooting doc is pretty good. Troubleshooting Client VPN - Cisco Meraki   As you mentioned, port forwarding UDP 500 and 4500 is key. I suggest checking the MX event log to see if it's getting the client request. The details are under the heading " The MX is Not Receiving the Client VPN Connection Attempt" It actually sounds like you've overlapped ports for the client VPN and the S2S VPN. Take a look at: Site-to-site and Client VPN Port Overlap with Manual port Forwarding rules - Cisco Meraki ... View more

No, port-channels are not configurable on MX devices. The MX does however pass through STP packets so you can connect 2 cables to the same network. One will be brought down (due to STP loop prevention) but can be used as a backup if the primary connection fails. ... View more

You're bang on that CRC's are a Layer 1 or Layer 2 issue. Most commonly it's dirty/loose/broken cables, or occasionally a bad SFP/switchport. It can also be due to MTU mismatch. If it's a 10Gb fiber link, interference is highly unlikely as fiber is relatively unaffected by RF as opposed to copper. In terms of the consistency in timing, a couple of things to note are:  - Higher CRC counts will generally correlate with higher network traffic (more packets = more likely for one to be corrupted). Is it possible that at these times the link had a higher utilization in general?  - Do you have any scheduled traffic around those times where higher MTU data is being sent (and where a mismatch might be present in the network)? In any circumstance, I would definitely suggest starting with swapping out the cable and continue troubleshooting up the stack from there. ... View more

In One-Armed Concentrator mode, VRRP heartbeats will use the WAN interface as that is the only interface connected to the network. In Routed mode, the VRRP heartbeats should traverse the internal networking using the LAN interfaces. From the look of your diagram, your MX's are most likely in routed mode. ... View more

You won't find an official document as it's 'technically' not supported, but generally speaking Cisco SFP's will work. ... View more

According to Meraki's SFP Datasheet, it is supported (bottom of the first page) meraki_datasheet_sfp.pdf (cisco.com)     ... View more

It's likely that there would be some small performance impact from enabling detailed traffic analysis but I personally haven't noticed anything. That said, my networks have a fair bit of capacity overhead so utilization isn't a noticeable problem.   With basic analysis, you can see the categories of traffic but get no further breakdown. With detailed analysis, you can see a breakdown of classified traffic into destination hostnames/IP's of each flow. An example view of the detailed traffic analysis is in the image in the below link. Switch Traffic Analytics - Cisco Meraki ... View more

Enabling MFA for a user is done in the dashboard by clicking your account name (top right) and going to profile.  To enforce MFA for the organization, go to Organization -> Settings.   As for logging, all event logging for a given network is under Network-Wide -> Event Log. You can then use filters there to narrow down what you're looking for. If you have a specific client in mind, you can also select the client from Network-Wide -> clients and click "event log" or "timeline". Edit: It just occurred to me you we looking specifically at client VPN. Meraki client VPN doesn't natively support MFA but can incorporate 3rd party solutions Two-Factor Authentication - Cisco Meraki The above info about logging is still applicable for VPN connections, you would just filter to event type. ... View more

For Meraki switches, the different models generally coincide with features and port speed.  So which model you opt for generally depends on your architecture and need for various features. MS12x are perfectly suitable for L2 switching with no frills. MS2xx introduce physical stacking and routing MS3xx and MS4xx move into higher bandwidth and multigig territory https://meraki.cisco.com/product-collateral/ms-family-datasheet/?file   Within the models, you also need to look at the different amounts of power available for PoE+ output to connected AP's.   Generally speaking, your bottlenecks will always be the WAN connection from the MX rather than bandwidth across the switch, so a switch upgrade may not do anything to improve file transfers if they're going cross-site. ... View more

Sounds like what you're looking for is Flow Preferences under "Security & SD WAN" -> "SD WAN &Traffic Shaping". You can set a preferred uplink for specific source/destination flows. MX Load Balancing and Flow Preferences - Cisco Meraki ... View more

I don't think the different MAC address is your issue. Here is an output of my MX64 which is working fine.     As you can see, in the dashboard the MAC address ends in ...:c0 When I do a packet capture on the uplink interface, the MAC address is ...:c5   ... View more

I don't believe it can be changed. It is expected behaviour that the MAC shown on the dashboard will not match the MAC of the interfaces.   Is there a reason you need them to match? ... View more

What you're seeing in the dashboard is expected behaviour. The MAC Address seen in the dashboard is a physical identifier for the device. The MAC addresses of the uplink interfaces are different from this, typically offset by 4 or 5. The following doc describes this behaviour Calculating MX WAN MAC Addresses - Cisco Meraki   As a side note, this behaviour looks to have changed on newer MX models. I have an MX75 in which the dashboard MAC address matches the MAC showing in the connected switch's ARP table. ... View more