Hi, Thanks for the clarification. I believed group policy was applied by IP, but it's actually by machine MAC address, correct? The problem is that I would need to wait for the customer to connect, then search for them in the Client VPN section and manually assign the group policy to their device. Isn't that right? ... View more

Sorry, yes you are right. I created the rules in the Site-to-Site outbound firewall     Same reoult like this :   I unchecked the split tunneling option on the network adapter. When I test the connection: I get Internet access, but I cannot reach the server when the adapter is configured with split tunneling. I cannot ping the servers or the MX hub gateway. The server VLAN in the hub is enabled, and I can see the route in the spoke’s routing table. On the other hand, when I configure the adapter as full tunnel,     I can reach the hub VLAN server and the tracert completes to the Meraki hub gateway — but then I lose Internet access (maybe because I set the DNS server to the customer’s DNS). Is this behavior normal?     ... View more

  Hello, I'm experiencing some strange behavior and I’m not sure if it’s normal. Here’s my setup: On the spoke, I created outbound rules.       I unchecked the split tunneling option on the network adapter. When I test the connection: I get Internet access, but I cannot reach the server when the adapter is configured with split tunneling. I cannot ping the servers or the MX hub gateway. The server VLAN in the hub is enabled, and I can see the route in the spoke’s routing table. On the other hand, when I configure the adapter as full tunnel,   I can reach the hub VLAN server and the tracert completes to the Meraki hub gateway — but then I lose Internet access (maybe because I set the DNS server to the customer’s DNS). Is this behavior normal?     ... View more

Thanks for the suggestion and the documentation link! After reviewing the Site-to-Site VPN Firewall Rule documentation, I understand that these rules are organization-wide and apply to all MX networks participating in site-to-site VPN. To confirm my understanding of your approach: I would configure the rules under Security & SD-WAN > Configure > Site-to-site VPN > Organization-wide settings: Allow rule: Source: VPN client subnet (e.g., 192.168.100.0/24) Destination: Specific hub servers (e.g., 10.0.1.50, 10.0.1.51, 10.0.1.52) Action: Allow Deny rule (below the allow rule): Source: VPN client subnet (192.168.100.0/24) Destination: Any Action: Deny My question: Since these are organization-wide rules, will this configuration affect VPN clients from other spokes that might use different subnets? Or as long as I specify the exact VPN client subnet from this particular spoke, other spoke traffic won't be impacted? Is this the correct implementation of your suggestion? Want to make sure I understand the scope and impact before implementing. Thanks for pointing me in the right direction! ... View more

HI  @jimmyt234     I reply to you      Native Meraki The idea is that this VPN only provides access to the specific servers ... View more

Hi everyone, I want to confirm my understanding of how split tunnel and full tunnel work in Meraki: Client VPN (Remote Users) Always Full Tunnel by default - all traffic goes through VPN The "IPv4 default route" checkbox in Hub configuration does NOT affect Client VPN To achieve Split Tunnel: Must uncheck "Use default gateway on remote network" in Windows adapter settings Result: Internet goes direct, internal resources still go through VPN automatically Site-to-Site VPN (Between MX Appliances) Controlled by "IPv4 default route" checkbox in Hub configuration Checkbox CHECKED = Full Tunnel (spoke sends all traffic to hub) Checkbox UNCHECKED = Split Tunnel (only specific networks go through VPN) Key Differences Client VPN: Cannot be controlled from Meraki dashboard, must configure on client side Site-to-Site VPN: Controlled from Meraki dashboard with hub checkbox These are independent systems - they don't affect each other Am I correct in my understanding? Specifically: Client VPN is always full tunnel unless you modify the Windows adapter settings? Site-to-Site VPN split/full tunnel is controlled only by the hub checkbox? These two systems are completely independent? Unchecking "use default gateway" in Windows adapter converts Client VPN to split tunnel? Thanks for any confirmation or corrections! ... View more

Okay, it's an option, but then each user will have to add the route to reach the server — it's a mess. Do you think it will work if I check the default IPv4 address? ... View more

I reply to you in bolt letter    Yes, but the question is, is this hub declared as a hub for this spoke? yes      Also, have you validated the Spoke's routing table to see if it's actually receiving this route? yes on the sopke yes .   One more thing — is it possible, in the spoke, to check the IPv4 default route to reach the hub?     ... View more

Ok but i would like to know yhis question if it is possible     If the hub is advertising 192.168.98.0/24 via AutoVPN, and the spoke should receive this route, why don't I see this route when connected as a Client VPN user? Shouldn't the spoke know how to reach the hub network and forward the traffic accordingly? ... View more

Thanks for confirming that L2TP doesn't advertise subnets automatically.  Current situation: Hub advertises 192.168.98.0/24 via AutoVPN (confirmed in dashboard) Client VPN on spoke assigns full tunnel (0.0.0.0/0 route via VPN) Users still cannot reach hub servers Question: Since these users specifically need access to hub servers, would creating the Client VPN directly on the hub solve this routing issue entirely? This seems like the simpler solution given the L2TP limitations. However, I'm confused about one thing: If the hub is advertising 192.168.98.0/24 via AutoVPN, and the spoke should receive this route, why don't I see this route when connected as a Client VPN user? Shouldn't the spoke know how to reach the hub network and forward the traffic accordingly? Is this a fundamental limitation where Client VPN traffic doesn't use the AutoVPN learned routes, even in full tunnel mode? Considering Philip DAth's script vs. moving Client VPN to hub for simplicity. Thanks for the clarification! ... View more

In the spoke's Security & SD-WAN > Configure > Site-to-Site VPN under "Local networks", I see: Client VPN: Enabled, 192.168.251.0/24 Should I add the hub network as an additional entry? Name: Hub Servers VPN mode: Enabled  there is not opcion to add a Subnet: 192.168.98.0/24 Will this tell the spoke to advertise hub networks as accessible to Client VPN users through AutoVPN?           ... View more

non-meraki   THe provaider sent me this capture from your side      ... View more

That explains exactly what's happening in my case. My Bbone-Core01 is a Cisco 9300 M switch that supports both CDP and LLDP, which is causing the topology display issues. Based on the Meraki documentation you referenced, I now have a clear action plan. However, I have a couple of questions before implementing the solution: Questions: Should I disable CDP globally on the Cisco 9300 M, or only on the specific interfaces connecting to Meraki switches? ... View more

That explains exactly what's happening in my case. My Bbone-Core01 is a Cisco 9300 M switch that supports both CDP and LLDP, which is causing the topology display issues.   Based on the Meraki documentation you referenced, I now have a clear action plan. However, I have a couple of questions before implementing the solution: Questions: Should I disable CDP globally on Bbone-Core01, or only on the specific interfaces connecting to Meraki switches? Approximately how long should I expect for the topology to correct itself after disabling CDP? This makes perfect sense now - the conflicting CDP/LLDP information from the core switch was causing Meraki to infer incorrect parent-child relationships. ... View more

hi @alemabrahao  Thank you for your response. I understand that Meraki uses Layer 2 discovery (CDP/LLDP) and MAC/ARP intelligence to build the topology, and that inconsistencies can cause wrong parent-child relationships. However, I'm not entirely clear on what specific solution you're proposing. Could you please clarify: How can I identify these LLDP/CDP inconsistencies? Is there a specific place in the Meraki dashboard where I can check for these issues? What steps should I take to resolve the temporary learning mismatches? Should I restart the switches, or is there a way to force a topology refresh? How long should I wait for the topology to self-correct? It's been [X time] since the migration, and the issue persists. The customer is concerned because while CDP neighbors show correctly (all switches connected directly to Bbone-Core01), the visual topology still shows incorrect hierarchical relationships. Any specific troubleshooting steps would be greatly appreciated. Thanks again for your help! ... View more

Mode on? Sure? Maybe it's active in 2960 mode, isn't it? ... View more

HI thanks for your reply    On the 2960 side, I removed the EtherChannel. It was configured on interfaces G0/1 and G0/2 as Port-Channel 1.     I attached the vlan customer    1 default active 21 VLAN_VOZ active Fa0/1, Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/20, Fa0/21, Fa0/22 Fa0/23, Fa0/24 66 CCTV active 88 CATO active 89 VLAN0089 active 101 VLAN_MACROLAN active 102 VLAN_INTERNET active 103 VLAN_DMZ active 104 VLAN_FW active 109 VLAN_SEGURIDAD active 110 VLAN_SERVIDORES active 111 VLAN_SERVIDORES_APP active 112 VLAN_BBDD active 113 VLAN_P2_IZQ active 114 VLAN_P2_DER active 115 VLAN_P1 active Fa0/1, Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/20, Fa0/21, Fa0/22 Fa0/23, Fa0/24 116 VLAN_P0_IZQ active 117 VLAN_P0_DER active 118 VLAN_SOTANO active 119 VLAN_ALMACEN active 120 VLAN_IMPRESORAS active 121 WLAN_Taller active 122 WLAN_Silo active 123 WLAN_Oficina active 124 WLAN_Invitados active 125 WLAN_Dispositivos active 126 VLAN_TRANS_WIRELESS active 130 GESTION active 131 VLAN_ISCSI active 132 VLAN_CENTRALITA active 133 VLAN_MANTENIMIENTO active 200 KIALA active 300 PLATAFORMA_LOGISTICA active 500 VLAN_GESTION_WIFI active 502 WLAN_WIFI_BOYACA active 504 WLAN_WIFI_ALMACEN active 505 WLAN_Presidencia active 507 Vlan_test_Infra active 999 TELEFONICA active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup   Group Port-channel Protocol Ports ------+-------------+-----------+----------------------------------------------- 1 Po1(SD) - 2960-1-d-02#show run interface gigabitEthernet 0/1 Building configuration... Current configuration : 90 bytes ! interface GigabitEthernet0/1 description 3750-Bbone-Core01 switchport mode trunk end 2960-1-d-02#show run interface gigabitEthernet 0/2 Building configuration... Current configuration : 90 bytes ! interface GigabitEthernet0/2 description 3750-Bbone-Core01 switchport mode trunk end     I created an EtherChannel and added the VLANs. (I deleted the EtherChannel so I could share the setup with you.) I had created an EtherChannel using two ports from different switches in the stack. Each port had the following configuration:           ... View more

Hello, I’ve encountered a couple of issues that I’d like to discuss with you. The problem involves port channel aggregation on Cisco 2960 switches. I was trying to configure the port channel using "mode on," but the port channel remained in a (P) (P) state without any connection. When I changed the mode to "active," the port channel still didn’t come up. To get connectivity, I had to remove the aggregation and leave the interfaces without a port channel. Do you have any ideas or solutions to resolve this? Could it be a bug in the 2960 firmware version? I'm not sure.   I attach the logs 2960  Log Buffer (4096 bytes): erface GigabitEthernet0/1, changed state to up *Mar 12 09:23:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to up *Mar 12 09:23:54: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 126 on GigabitEthernet0/1 VLAN1. *Mar 12 09:23:54: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0126. Inconsistent peer vlan. *Mar 12 09:23:54: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0001. Inconsistent local vlan. *Mar 12 09:23:54: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 126 on GigabitEthernet0/2 VLAN1. *Mar 12 09:23:54: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/2 on VLAN0126. Inconsistent peer vlan. *Mar 12 09:23:54: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/2 on VLAN0001. Inconsistent local vlan. *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 0c23.692b.f552 in vlan 504 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host e455.a801.5471 in vlan 500 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host e455.a82a.8287 in vlan 119 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host e455.a801.53f2 in vlan 500 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 009c.02a3.7126 in vlan 110 is flapping between port Gi0/2 and port Gi0/1 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.0a4f.0001 in vlan 119 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host c025.a532.b7d1 in vlan 116 is flapping between port Gi0/2 and port Gi0/1 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 00be.7564.de8c in vlan 121 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 5838.797f.df42 in vlan 120 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 009c.02a3.7126 in vlan 110 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host e455.a801.5471 in vlan 500 is flapping between port Gi0/2 and port Gi0/1 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host e455.a801.53f2 in vlan 500 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:54: %SW_MATM-4-MACFLAP_NOTIF: Host 0c23.692b.f552 in vlan 504 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:55: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.0a4f.0001 in vlan 109 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:55: %SW_MATM-4-MACFLAP_NOTIF: Host 387c.7607.a9ec in vlan 116 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:55: %SW_MATM-4-MACFLAP_NOTIF: Host 6400.6a8f.5dcc in vlan 119 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:55: %SW_MATM-4-MACFLAP_NOTIF: Host f8dc.7a3a.9a3e in vlan 119 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:55: %SW_MATM-4-MACFLAP_NOTIF: Host 0018.0a4f.0001 in vlan 116 is flapping between port Gi0/1 and port Gi0/2 *Mar 12 09:23:56: %SW_MATM-4-MACFLAP_NOTIF: Host a846.9d27.c382 in vlan 500 is flapping between port Gi0/2 and port Gi0/1 *Mar 12 09:27:09: %SW_MATM-4-MACFLAP_NOTIF: Host a846.9d27.c36a in vlan 500 is flapping between port Gi0/1 and port Fa0/19 ... View more

Thanks @alemabrahao In your opinion, what would you choose for the first step: migrating all the fiber connections first and then the port-channel, or starting with the port-channel and, once it's fully migrated, moving on to the fiber? ... View more

Hi, thanks. @alemabrahao  and @GIdenJoe  I have some doubts regarding this migration process and would appreciate your advice. Currently, my customer has a switch (SW1) with all fiber connections, and switches 2 and 3 are connected using different port-channels and regular ports. The Meraki MS9300 has three modules with 8 fiber ports each. I’ll need to move these fiber connections from the Cisco switches to the Merakis, and I also need to connect to a copper-based port-channel. Regarding the migration, what is the best approach? Should I power on all Meraki switches and then migrate the cables one by one from the Cisco switches to the Merakis? Would it be better to start by migrating the fiber connections first, and then move on to the port-channels? Also, when migrating the port-channels, is it better to move one link at a time and adjust the configuration on the Cisco side (e.g., LACP negotiation: active/passive)? Or should I change the negotiation mode first before moving the cables?   ... View more

thanks @alemabrahao  I have a question: if I configured Link Aggregation (port-channel) on a Catalyst 9300 M , and the other switches maybe are  a Cisco 2960 (or a non-Meraki switch), and the port-channel is currently set to mode "on", do I need to change the mode to "active"? ... View more