We've had this problem recently too.  I opened a case with Meraki support.  At first they said it was the code rev on my MX and were going to back rev it.  A second case of this popped up and I noticed several of the sites in our Org were having the same issue.  I called and spoke with a Meraki engineer.  They looked and found the backend Meraki VPN Registry server(s) were overloaded.  He had to manually push our Org to use different server(s).  That cleared up the issue.  He said there would have to be another re-balance done by Meraki support 6 hours after the actions he took.  So, short answer, call Meraki support if you see this in the log files.  ... View more

You cannot reach a Non-Meraki VPN network (3rd party application) from a Meraki AutoVPN tunnel (Branch site) Only local subnets on the MX that has the Non-Meraki VPN tunnel can reach it. (The AnyConnect subnet should work) If you need access from branches to 3rd party application you need to build a Non-Meraki VPN tunnel from each branch and from vMX to the provider ... View more

can you please confirm, I am bit confuse about peer ID and peer endpoint at non meraki side. here is the script i have used, The tunnel is up but it doesn't pass any traffic, after your reply i have added port forwarding rule at MG side, still not tested due to downtime not approved yet.   over here do i need to give 172.31.128.4?   crypto map CMAP1 40 ipsec-isakmp set peer (public-IP of celleuar gateway) set security-association lifetime seconds 28800 set transform-set VPN set pfs group14 set isakmp-profile 4G-link-backup match address Interesting_Traffic reverse-route static   crypto isakmp profile 4G-link-backup keyring tunnel-keyring-4G match identity address (public-IP of celleuar gateway) 255.255.255.255 local-address 10.243.0.4   mode tunnel crypto ipsec transform-set VPN esp-aes 256 esp-sha256-hmac   crypto keyring tunnel-keyring-4G pre-shared-key address (public-IP of celleuar gateway) key xyz......   MG side: Is this ok?   ... View more

The peer IP is always the IP that is valid on the internet which is the public IP. The NAT device (MG) has to forward the traffic correctly to the VPN endpoint. ... View more

Hi @cocacond Did you manage to setup a non-meraki tunnel with ISR device. Can you share the script for ISR device to setup tunnel. Thanks. ... View more

Hi @Fabian1  i am going to have warm spare MX with ISP2 public IP. One non meraki vpn tunnel is established to our Csr1000v1 in azure, and from warm spare i want to establish tunnel to CSR1000v2. I have no idea, where do you deploy the scrpt primary_link up and backup_up. Is it at meraki side or will be in Azure. I am new to this API thing. If you can share steps so that i will follow them to implement. Thanks ... View more

I suggest you to open a support case. ... View more

You need at least a /29 as you will need 3 addresses, one for each MX and one more for the VIP. That is, you have to check with your ISP about the possibility of increasing your range (and it certainly must have some cost). ... View more

You could first have a try to reduce the radio power of 2.4GHz and enable band steering. If you still have one or two clients with 2.4 GHz, you could contact them. Or you could cut them out by disable the frequenzy 🙂 ... View more

No, the setting of the root bridge only makes it deterministic. But the loop is there regardless of the root-settings. STP will avoid the problems that occur through the loop. ... View more

Like @alemabrahao says - I would be looking at wired 802.1x. ... View more

@alemabrahao @GIdenJoe @KarstenI @rhbirkelund Thank you for your response. I will get back with outcome once it is implemented. hopefully end of feb-2023 ... View more

@Brash @alemabrahao It worked without any issues. I just connected my switch to cisco 2960, after few minutes the switch was up and visible in Meraki dashboard. Thank you both of you. ... View more

Yesterday I had a call with support, and we were able to find the solution. We added the meraki vMX subnet to vMX S2S VPN from meraki dashboard and the Ping started to work from MX to vMX and vice versa. but before i didn't have such subnet added and it was working fine as well. Technically it should not have pinged before for (1 year :)) without adding vMX subnet. So, in conclusion the downgrade has nothing to do with this Ping failure between MX and vMX, it was configuration error. ... View more

Hi, Just curious, are you were able to change the country/Region, how?   post by user Bettencourt is for time zone not country.  ... View more

And this is andriod phone taken the ip of printer. Screenshot from clients connected in MX68 applaince.   ... View more