Hi Guys, Maybe you will have idea what is wrong with my tunnel? I have Meraki vMX in Azure. There is also Client VPN configured with subnet 10.10.10.0/24. All my Azure resources are in 10.3.0.0/16 subnet. Then I have ipsec tunnel to non-Meraki peer (some cisco ASA). For almost a year all was working fine, then suddenly I lost comm from client vpn network 10.10.10.0/24 to remote networks behind this non-Meraki peer. I did not change config, remote side neither. Tunnel is up and I have no issues at all with comm from 10.3.0.0/16 to remote networks. I'm in contact with Meraki support - they are saying "traffic from 10.10.10.0/24 is routed through tunnel correctly". Support from remote site is saying "we don't see any traffic from 10.10.10.0/24 network going towards us through the tunnel and because of that SA between this network and our network is not building up". Which makes sense as if they initiate traffic from their subnet to my 10.10.10.0/24 subnet SA is building up and we have comm for about an hour until its terminated: Connection terminated for peer [my public ip]. Reason: IPSec SA Idle Timeout Remote Proxy [remote subnet], Local Proxy 10.10.10.0 Where is the issue and who is lying? ;D ... View more

Hi Guys, I need some advice on upgrading office core network 🙂 Should I modify anything to have fully redundant solution? How it looks: 2 CPE modems, each is connected to one of my 2 WAN switches (some Aruba Instant-on devices, not stacked, just regular link between them). From each WAN switch I have 2 links, each to different MX100 (warm spare with VIP) From each MX I have 2 uplinks, each to different MS390 (phisically stacked) Qestions: Is it normal that stacked MS390 switches have same local mgmt ip? In other switches it's normal but when I last time stacked 2xMS225 each had different mgmt ip. Only difference is that MS225s are connected to core stack (with lag) and MS390s are connected directly to MX warm spare FW. What is not working: When I put down Master MX - failover works fine. The issue is when I try to put down one of the CPE modems. They suppose to exchange vrrp through my WAN switches but ISP engineer claims that it's not the case. Both CPE are claiming to be masters and do not see each other. All ports included are in same vlan (untagged) so I don't know waht might be the issue. ... View more

I'm going to start setting up firewall rules on my Meraki firewalls and I would like to ask more experienced users what the best practices are and how should it be done properly 🙂 I have AutoVPN setup build with 2 hubs - HQ (mx105) & vMX in Azure (ClientVPN there), 5 branch offices aka spokes (5x mx67) + non meraki peer (other company). Should I setup firewall rules between networks of different peers on Security&SDWAN->Firewall or maybe on Security&SDWAN->Site-to-site VPN->Org. wide settings? What are prons&cons of setting them in first vs second place? Default rule at the bottom of firewall ruleset is allow any/any. I planned to put all my "custom allow" rules above and then create one deny any/any just above the default. I believe that setup will cut my clients from internet, right? How to create allow rule saying, "allow all outgoing traffic to internet"? 😉 I have company wifi which has radius auth - active directory accounts. It is separate network/vlan. I would like to somehow control also which devices can access this network. How can I achieve this? Should I create group policy, assign it to all known devices and have custom firewall set to allow internal and external traffic? If I then create regular rule saying block traffic from this network to any directions those devices with assigned group policy will use "their custom firewall only" and will be allowed? Those devices out of my group policy will be cut off from any network based on general firewall rule, right? I'm planning to implement bunch of test rules for couple of weeks, for example: allow any traffic from network A to network B with enabled logging. I parse the flows to syslog (graylog) and analyze what kind of traffic is flowing between network A&B to decide which should be allowed and base on those observations create granular allow rules, separate for tcp, udp and icmp and deny the rest. I need some help with understanding logs I'm getting that way, I know that generally pattern 0 means allowed, and pattern 1 means blocked/deny. When I see logs which hits my test rules, they look like this: pattern: allow (dst network-A/24) && (src network-B/24) What I'm not sure is the meaning of: pattern: 0 all pattern: allow all pattern: 1 all How to treat them? "Allow all" means it hits default allow rule? What just "all" means when it is allowed or blocked? ... View more

I would love to have something like "Monitor tab" on Palo Alto devices where I can go and search for specific traffic and verify if it was allowed or blocked (if blocked - by which firewall rule etc). I Tried to setup Graylog as syslog server but making those logs being useful will require a lot of work. Anyone have some ready/out of the box solutions for it? I'm working for NGO now so it would be awesome to find free (or at least not very expensive) solution. ... View more