Hi @ALE727 , @PhilipDAth , @rwiesmann & @Brash  are spot on. A 'Soultions Engineer' will work with you (in tandem with the acounts team) ensuring critical services and sites are taking into consideration with a large deployment like this. ... View more

Hi @cabricharme ,   Mar 20 07:12:53 R12 Sw2 Port 22 Switch port Port status change port: 22, old: down, new: 10fdx Mar 20 07:12:26 R12 Sw2 Port 22 Switch port Port status change port: 22, old: 100fdx, new: down If we focus just on these two event logs. We see that Whatever device is connected to Port 22 on Sw2. The Speed is fluctuating from 10 megabits per second to 100 megabit per second and then back again. This would only be due to Layer 1/Physical conditions. I.e. faulty, cabling, ports or port controller misbehaving.   Judging from my experience and the frequency that this is occurring. I would;   a.) Replace the cable first. Use a known working cable. I.e. already used from another device not having this issue. Then if it is still occurring, b.) Connect a known working device to the same port. Then if it is still occurring on Port 22. It looks to be the switch port. Raise a case with Support. If it stops, then move the affected device to another good working port. If the issue occurs, then you know it is the end device. ... View more

I wish Meraki would suppress the link down -> RSTP disabled and link up -> RSTP designated on portfast/edge ports cause these just flood the eventlog for no real benefit.  It is already enough to have the link down link up on these ports. ... View more

Thanks Ivan! ... View more

Thanks for the replies. ... View more

yeah I see how this works, but this creates a problem: the internet firewall is now processing the decrypted internal traffic as well, because the MX decrypts the incoming traffic, and then routes it back to the internet firewall, which now routes the traffic back (again) to the internal network. This places an unnecessary load on the internet firewall to process additional traffic. ... View more

Already done good sir, I even have my replacement unit that has been solid so far but the last unit took months before I saw the issue pop up. ... View more

Hi @Ab79 , Looking at the screenshot, the signal strength is excellent! So that doesn't look like the issue here. What is the user actually reporting? or was this just simply 'noticed' in the Dashboard?     ... View more

Hi @AndreHCEA , There's an App(Guide) for that!!. Jokes aside, VLANs are one of the best ways to implement security. Then Tag those SSIDs with said VLANs.  e.g.      SSID tag https://documentation.meraki.com/MX/Wireless/Creating_a_Wireless_Guest_VLAN_on_a_Z-series_Teleworker_Gateway_or_Wireless_Security_Appliance#Create_Firewall_Rules_to_Block_Inter-VLAN_Traffic ... View more

Good stuff man!!! ... View more

I agree with Ivan that ‘MS series switches can participate in spanning tree only when a spanning tree instance is running on Native VLAN of ALL switches. In addition, Native VLAN must be allowed on all Trunk ports running Rapid-PVST, so that BPDUs are seen by the Meraki switches in the topology.’ ... View more

Hi Ivan,   Nope, it's 47.2W. Please find the sample output below. Is this normal? I mean, the AP is overconsuming above than the stated wattage on the device manual?   I do not think spanning tree is shutting ports, since the port is not disabled. Only the device is going down the up again. I have checked, my switch is configured in power sharing.   I only connect 1 LAN into the MR57 AP. So I do not have aggregation towards the AP in my deployment.   ... View more

Possibly a faulty controller? Let us know how you go. ... View more

BPDUs are never sent untagged. It must have a VLAN-ID. So then yes, you must tag on the non-meraki switch Trunk ports. Which is more manual work to do and get working, and a pain to tshoot..  You don't have to use Option a. You mention the non-meraki switches can run MST. If you run the same Spanning Tree Protocol across all switches. Then it's very easy to design and tshoot.  Here is the rest of the quote: "MS series switches to participate in spanning tree a spanning tree instance must be running on VLAN 1 of all switches and VLAN 1 is allowed on all trunk ports running PVST+ so that BPDUs are seen by the Meraki switches in the topology." ... View more

Hi @allywenzel , I do see this type of situation often. Usally something changes to cause this.  That log "stp_tcn_error" 'Topology Change Notification". Meaning the Layer 2 path or Spanning Tree is changing where all traffic should go. Most of the time, someone plugged in something. Or in your case, most likley a cable or device is misbehaving. As @RaphaelL reccomended, check you RSTP Root and make sure it is it is in fact the Root. Use the following guides to assist in the investigating and mitigation.    https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS   https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MS_Switching/General_MS_Best_Practices       ... View more

For beginners, there is a Getting Started with Cisco Meraki webinar scheduled for Thursday 12/12 at 9:00am PST.   ... View more

Oh damn, of course, you are right. It is even clearly described in the link I added, but I messed that up. Thanks for the correction. ... View more

Hi @carlto , This might interest you 😉 "BGP peering over IPsec VPN tunnels can be enabled on the Meraki Security Appliance. This unlocks new dynamic routing use cases for customers in addition to enabling resiliency and redundancy over IPsec VPN peers. "   https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN         ... View more

Did you get a resolution to this? Having the same issue and interested to know if you found anything. ... View more

During the recent CrowdStrike incident, I had a customer use the Microsoft-provided PXE server and image to remotely recover machines.  Below is a mock-up (IP addresses made up) of what it looked like.  We put the Microsoft PXE boot server in their data centre, and the machines were recovered over SD-WAN.     I can also tell you that while this worked for a high percentage of their machines, we had a single digit percentage that would not PXE boot (they would start and then fail), which we put down to BIOS bugs. ... View more

PS: And this is not for "certificate based authentication" as the document you are pointing to, but "Server certificates" on the MX itself, for the initial connection : https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Server_Certificates ... View more

Hi @SysOP , Do you perhaps have RADIUS VLAN Override configured on that SSID? if so, what does ISE see when this issue occurs? https://documentation.meraki.com/MR/Access_Control/MR_Meraki_RADIUS_2.0#RADIUS_VLAN_Override ... View more

If you capture on the MX LAN side you should have each packet twice in the capture. Once with the source MAC address of the device in VLAN 60 and the MX as destination.  And the second time with the MAC address of the MX as source and the windows/printer device in VLAN 70.  If you see those packets twice, then the MX is forwarding correctly and you are experiencing issues on the switched network or on the end hosts. ... View more