Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Become a member of the Cisco Meraki Community today
Get answers from our community of experts in record time.
Join nowAbout Tarmahmood1
Tarmahmood1
Getting noticed
Member since May 19, 2022
yesterday
tarmahmood1
Community Record
44
Posts
7
Kudos
4
Solutions
Badges
Wednesday
Hello, Got a request from client that, if he has spare MX-67 applaince and wants to keep next to his desk, meaning the uplink will be switch and he will configure some vlans on it which will be different from MX-95. At uplink side we have MX-95 which has DHCP and vlans configured. I have never thought about such setup. Is it worth to test to have MX-67 and declare some VLANs which will not be part of entire network. Is it really feasible or worth to test. any idea? . as of now i dont know what his intention are...
... View more
Jan 24 2025
6:18 AM
Hi, We have an organization A with 5 networks. licensing model is co-termination. We need to make one the the network a new organization B. That network consists of 1 MX(advance security),2 MS and 4 MRs(Enterprise license edition). when we bought these devices it was claimed under one dashboard license key. My question: Is it possible to unclaim those devices from org A and claim them with this same dashboard key to create a new organization B? so we dont need to buy new licenses.
... View more
Oct 16 2024
1:49 PM
Hi, We have applied policy on switch port if the authentication fails with radius then it will move to Client to guest vlan. Problem is that we dont get any error in NPS and still few users(6-9) on switch are moved out to Guest vlan. Any idea? I have rebooted the switches but still the same. It works fine with other users. Thanks
... View more
Jul 8 2024
4:02 AM
Hi, I want to confirm does this setup works well if we use Meraki APs MR44 with WS-C2960X-48FPS-L connected to Router ISR4000 series. I think we dont have requirement to have meraki switches with Meraki APs. at the moment we have old APs connected to switches and controlled by WLC in network. we want to remove WLCs and old APs(1800/2700 series). ISR-4000 --> WS-C2960X-48FPS-L --> Meraki APs? Thanx
... View more
Jan 24 2024
12:46 AM
@KarstenI Issue was with the script where local-address was missing and mode tunnel and exempt subnet in NAT-acl
... View more
Jan 24 2024
12:28 AM
4 Kudos
Thanks guys @PhilipDAth @jhoney12 @BlakeRichardson @alemabrahao for your suggestion. It has been rectified. problem was the service provider was managing both express route circuit(Azure) and newly deployed FW, and they diverted all default route from express route circuit to the FW, due to which the vMX appliance got the public ip of FW. default route was removed and vMX got actual IP(Azure provided at VMX interface) and the Client VPN gateway has started to work. It can be done by the FW IP,but that was not intended to do config in FW for this solution(managing certificates,DNS records etc)
... View more
Jan 17 2024
8:21 AM
Hello, I got an issue regarding client VPN, users are not able to connect to Anyconnect client VPN. This solution was deployed 2 years back and working fine until few days back we got this problem. upon investigation i see the Public IP in Meraki dashboard is different the one associated to meraki VM nic in Azure. I am suspecting it has been changed, Any idea what to do?, and how the IP on dashboard is different and in Azure portal associated to VM is different? Current firmware MX 18.107.7, I did all troubleshooting related to below issue: but i am sure its about the public IP.
... View more
Jan 5 2024
3:06 AM
@KarstenI debug crypto isakmp doesnt show any thing and also no event log in vMX. I have pinged vMX public IP from router and it is pingable. here is what i get on on router #sh logging Jan 4 09:18:49.200: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:18:49.200: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:18:49.200: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:18:59.234: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:18:59.234: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:18:59.234: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: Flow ID : 0x24000063, Flow Stats Ptr 0x7F57E4892588 Jan 4 09:18:59.234: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:18:59.234: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:18:59.235: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:18:59.235: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:20:59.012: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:20:59.013: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:20:59.013: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: Flow ID : 0x24000063, Flow Stats Ptr 0x7F57E4892588 Jan 4 09:20:59.013: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:20:59.013: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:20:59.013: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:20:59.013: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:21:07.979: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:21:07.979: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:21:07.979: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: Flow ID : 0x24000063, Flow Stats Ptr 0x7F57E4892588 Jan 4 09:21:07.979: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:21:07.979: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:21:07.979: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:21:07.979: ISAKMP-ERROR: (0):No peer struct to get peer description Jan 4 09:22:06.221: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:22:06.222: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320 Jan 4 09:22:06.222: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: Flow ID : 0x24000063, Flow Stats Ptr 0x7F57E4892588 Jan 4 09:22:06.222: IPSEC:(SESSION ID = 1) (sibling_update_flow_stats) IPSEC: MIB Stats Ptr 0x7F57E0A62320
... View more
Jan 5 2024
2:08 AM
Hello, we are trying to setup the tunnel between ISR and vMX but it is not even passing the phase1. anyone here who has done it. here is our config done at ISR side: crypto isakmp policy 10 encr aes256 hash sha256 authentication pre-share group 14 ************************** Preshared key crypto isakmp key secret_key address vMX_public IP *********************** Apply crypto map to the public interface ////////////////////////////////////////////////////// ip access-list extended Azure-meraki-tarffic permit ip 172.17.76.0 0.0.0.255 10.249.1.0 0.0.0.255 //////////////////////////// (ISAKMP Phase 2 Policy) crypto ipsec transform-set vMX-Azure esp-aes 256 esp-sha256-hmac ///////////////////////// Crypto Map *************************** crypto map CMAP 10 ipsec-isakmp set peer vMX_public IP set transform-set vMX-Azure match address Azure-meraki-tarffic /////////////////////////////// interface GigabitEthernet0/0/0 crypto map CMAP
... View more
Sep 26 2023
12:00 AM
Related to traffic between branch office and 3rd party application: Since 3rd party application is accessed through https://abc.companydomain, I think it would work if all traffic goes to DNS in Domain controllers and DNS then points to 3rd party application link. So point is Branch offices DNS are pointing to Domain controller(DNS). Since all non peer will be connected to Azure network. So if branch office wont communicate with each other but atleast they can communicate to 3rd party app(https://abc.companydomain.) what do you think?
... View more
Sep 25 2023
7:40 AM
Yes plan is that they should access 3rd party application behind VPN(non meraki) then how should we try to do this? any recommendation Branch A is MX and other are Cisco legacy routers(not MX)
... View more
Sep 25 2023
12:13 AM
We will replace Cisco CSR1000v with vMX, vMX will be connect to site branches and have some non Meraki VPN peer networks. I have Cisco ASAv in Azure for VPN, we are planning to remove Cisco ASAv and use Meraki client VPN. My question is 1) How client VPN will communicate to 3rd party application that is connected through non-meraki VPN tunnel.(diagram attached) do i need to add routes(static etc) 2) How many users can connect at a time? do we need any additional license for this feature?
... View more
Aug 18 2023
1:58 AM
can you please confirm, I am bit confuse about peer ID and peer endpoint at non meraki side. here is the script i have used, The tunnel is up but it doesn't pass any traffic, after your reply i have added port forwarding rule at MG side, still not tested due to downtime not approved yet. over here do i need to give 172.31.128.4? crypto map CMAP1 40 ipsec-isakmp set peer (public-IP of celleuar gateway) set security-association lifetime seconds 28800 set transform-set VPN set pfs group14 set isakmp-profile 4G-link-backup match address Interesting_Traffic reverse-route static crypto isakmp profile 4G-link-backup keyring tunnel-keyring-4G match identity address (public-IP of celleuar gateway) 255.255.255.255 local-address 10.243.0.4 mode tunnel crypto ipsec transform-set VPN esp-aes 256 esp-sha256-hmac crypto keyring tunnel-keyring-4G pre-shared-key address (public-IP of celleuar gateway) key xyz...... MG side: Is this ok?
... View more
Aug 17 2023
9:40 AM
@PatrikStar were you able to solve above, connecting MG to non meraki peer in cloud? Can you share your experience
... View more
Aug 17 2023
6:30 AM
Hello, We have a warmspare device MX85 connected to MG41. MX WAN IP is taken from MG41(IPv4 ip addressing and NAT), so on left side of pane we get the public IP info(which is the SIM IP) and on right side in uplink tab WAN2 we get the ip from MG41 which is private IP(as shown in screenshot). For primary we have ISP fiber link and we get public IP on uplink(not private) and created the ipsec tunnel to non-meraki(CSR1000). The tunnel works fine for primary, but for backup what IP should be used at peer side, I used public IP and the state of tunnel was UP-Idle(UI) at CSR side. Should i set peer (public IP) or (private IP 172.31.128.4) in my case or need to add private subnet from MG into interesting traffic config at CSR crypto map tunnel 40 ipsec-isakmp set peer (publicIP) or 172.31.128.4 set security-association lifetime seconds 28800 set transform-set VPN-tunnel set pfs group14 set isakmp-profile VPN-tunnel-R02 match address Interesting_Traffic
... View more
Aug 15 2023
2:53 AM
Hello, I have generated two API keys from my admin account xyz@.... which has full access, intention was that with second API, i will be using for monitoring purpose. but it is said the API should be read only. What is the way to make second API key to read only with same admin account. I dont see any option to make it "read only" from dasboard. I have tested the key with site24x7 tool and it fetches all the nodes info from Meraki. or should i keep it like this as it is. thanks
... View more
Jul 17 2023
6:52 AM
Hi @cocacond Did you manage to setup a non-meraki tunnel with ISR device. Can you share the script for ISR device to setup tunnel. Thanks.
... View more
May 2 2023
1:28 PM
Hi @Fabian1 i am going to have warm spare MX with ISP2 public IP. One non meraki vpn tunnel is established to our Csr1000v1 in azure, and from warm spare i want to establish tunnel to CSR1000v2. I have no idea, where do you deploy the scrpt primary_link up and backup_up. Is it at meraki side or will be in Azure. I am new to this API thing. If you can share steps so that i will follow them to implement. Thanks
... View more
May 2 2023
12:12 AM
Yes the setup is new. It was installed and connected to Meraki cloud one week back. but two days back due to Power outage happened, the configuration was lost.
... View more
May 2 2023
12:04 AM
@alemabrahao I had a call with Cisco umbrella support and found out with basic license package i cant integrate Meraki appliance with umbrella. License upgrade needs to be done for integration to be working.
... View more
May 2 2023
12:01 AM
Hi, Any idea why i need to give static IP WAN1 everytime after hard reboot of appliance. We had a power outage at site and device did not connected back to Meraki dashboard, so when login into the device locally there was no WAN IP. Even though configuration were saved after giving the details before. Thanks
... View more
Apr 24 2023
5:12 AM
@alemabrahao As per my understanding the virtual IP address(VIP), i need to get it from ISPs? or will give any private subnet by my own? Since i am using only only /30 subnet for both ISPs. Can i continue with /30 address i.e using only MX uplink IP for the time being?
... View more
Apr 24 2023
1:29 AM
Hi, As shown in diagram, I have two MX-85 connected to ISP1 and ISP2. At the moment i have configured MX85(primary) connected to ISP1 and established non-VPN tunnel to CSR1000v1 "CSR1000v1". Now i am going to add MX-85(backup) connected to ISP2 as warm spare. If i add another peer non-meraki tunnel as CSR1000v2, how MX-85 in warm-spare will know it will use second tunnel. What i am thinking is if Primary MX has tunnel to CSR1000v1 after failover of MX(primary), the backup will use the same tunnel(CSR1000v1) not CSR1000v2. Any idea? Note:Both tunnel will have same private subnets. Thanks
... View more
Mar 21 2023
1:45 PM
Hi, I am trying to integrate Cisco umbrella to my network with MX appliance. I have generated the key and secret in Cisco umbrella and added to Network-wide-->general-->Cisco Umbrella account. After doing above step, then i have tried to enable umbrella protection but got error. I am not able to identify how to fix this one, any idea? I dont see any IP restriction from MX side that makes it unauthorized to connect to Cisco umbrella.
... View more
Mar 16 2023
9:06 AM
@Brash As mentioned by @Ryan_Miles If i am setting up the root bridge and backup, we can avoid loops.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 1864 | Jan 24 2024 12:46 AM | |
| 2654 | Jan 24 2024 12:28 AM | |
| 1131 | May 2 2023 12:04 AM | |
| 1150 | Sep 20 2022 3:05 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 2654 |
© 2025 Cisco Systems, Inc.
