Can someone explain why I'm seeing this weird ip addresses when I check how traffic hops from client connected with VPN to my environment? Connection is terminated on vMX in Azure. Also, I use Radius on AD for authentication and same IPs are also shown as NAS ipv4 addresses when user initiates connection:    6.1.54.50 6.182.213.103 Both from Fort Huachuca, Arizona... USAISC Headquarters... 😮 ... View more

Hi Guys, Need some advice on figuring out why I see "Detecting a high rate of STP topology changes" alerts on random switches (on their uplink ports) at random times. I migrated from mixed switch environment (Catalyst/HP/Aruba) to pure MS setup. Attaching topology. Core stack is the root bridge with priority 8192, default priority is 32768 and one switch has priority 36864. Core stack is 2x MS390-24 with 10G modules. Fibers goes to access switches, one switch doesn't have direct connection with core stack (the one with lowest priority on far right side). Setup was done some time ago and all was fine, then I started to get those random alerts. Don't recall if it was after some firmware update or a reboot. Maybe after MS390 swapped from MS firmware to CS... I'm not sure. One core stack switch is in alerting mode because of a firmware bug - it thinks 10G ports 1 and 2 are connected to copper ports 1 and 2 and reports vlan mismatch. This was confirmed by Meraki support. According to them it doesn't have impact on network and is already fixed in one of the beta firmware versions. Should I change root bridge priority to 0? Should I try to enable BPDU Guard on all access ports network wide? Maybe someone is connecting a switch somewhere... Other ideas? ... View more

Hi Guys! I have this interesting project of merging 2 dashboards/organization. The one managed by me will become the master one. I know more or less how to migrate devices/network/licenses between organizations but I have no idea how to approach to licensing model change. Currently both organizations are in co-term models. My org is quite small, it contains locations from one country and there is only one "budget". I have like one co-term license key for 8*MS, one key for 8*MX for example. It's fairly simple to extend licenses and figure out who is paying and for what. Organization that I'm going "absorb" is much bigger and more complex. They have like 60 devices across many countries, many owners, many budgets, many administrators and huuuuge amount of license keys where half of them are already expired. They have constant struggle to keep license status green. Nobody knows which license keys were bought be who. I guess some networks only operates because of co-term license model and countries that bought 6 or 8 year licenses keep the rest above the surface. I would like to clear this up during the merge and also avoid situation where entire org is down because someone forgets to extend their licenses. I was thinking about per-device licensing but this has some cons like for example entire org has to run same licenses for MX and we have mix of Enterprise and Advanced Security. I'm looking more towards subscription model and I would like to have separate subscription per each network. For example one network in Uganda should have one subscription containing 2*MX68, MS225 and 3*MR36 and another network there just one MX68. Did anyone have experience with changing co-term to subscription model? Is there a way to convert/split current co-term licenses keys? Should I first merge orgs and then change license model or other way around? For example, I have co-term license key with 8 MS switches and other license key with 8 MXes. I will need to split them into 8 separate subscription licenses, each with one MX and one MS and bind them to networks, right? Is this even possible? I asked Meraki support but their initial answer is quite disappointing - they said to me something completely different than can be found in official docs 😕 ... View more

I'm going to start setting up firewall rules on my Meraki firewalls and I would like to ask more experienced users what the best practices are and how should it be done properly 🙂 I have AutoVPN setup build with 2 hubs - HQ (mx105) & vMX in Azure (ClientVPN there), 5 branch offices aka spokes (5x mx67) + non meraki peer (other company). Should I setup firewall rules between networks of different peers on Security&SDWAN->Firewall or maybe on Security&SDWAN->Site-to-site VPN->Org. wide settings? What are prons&cons of setting them in first vs second place? Default rule at the bottom of firewall ruleset is allow any/any. I planned to put all my "custom allow" rules above and then create one deny any/any just above the default. I believe that setup will cut my clients from internet, right? How to create allow rule saying, "allow all outgoing traffic to internet"? 😉 I have company wifi which has radius auth - active directory accounts. It is separate network/vlan. I would like to somehow control also which devices can access this network. How can I achieve this? Should I create group policy, assign it to all known devices and have custom firewall set to allow internal and external traffic? If I then create regular rule saying block traffic from this network to any directions those devices with assigned group policy will use "their custom firewall only" and will be allowed? Those devices out of my group policy will be cut off from any network based on general firewall rule, right? I'm planning to implement bunch of test rules for couple of weeks, for example: allow any traffic from network A to network B with enabled logging. I parse the flows to syslog (graylog) and analyze what kind of traffic is flowing between network A&B to decide which should be allowed and base on those observations create granular allow rules, separate for tcp, udp and icmp and deny the rest. I need some help with understanding logs I'm getting that way, I know that generally pattern 0 means allowed, and pattern 1 means blocked/deny. When I see logs which hits my test rules, they look like this: pattern: allow (dst network-A/24) && (src network-B/24) What I'm not sure is the meaning of: pattern: 0 all pattern: allow all pattern: 1 all How to treat them? "Allow all" means it hits default allow rule? What just "all" means when it is allowed or blocked? ... View more