Hi All,   I got a design question. Can Meraki VMX be my primary Azure Gateway/Firewall ?    Further details: Planning to have some applications services in Azure cloud (IAAS/PAAS) , those applications can be access via private link ( site to site IPSEC) or via Public IP Address. I was wondering if VMX can behave as "windows defender" and be the gateway where Azure sits behind it ( i know technically it cannot be done, but just wondering if there is a work around solution to achieve my goal )   If can't , i am wondering where do i place VMX in the design , do i give it private or public IP ( or both) to still have access to internet and also to access local resources that would be behind Azure firewall    Appreciate your feedback ... View more

Hi All,   i am trying to find out if we can use MX as a radius server without confiruing an external radius device like nps. has anyone been across this ? and what are the requirements / model number..etc for MX ?   If yes, can we also integrate it with AD or any 3rd party IAM ?   appreciate your reply ... View more

Hi, I got a scenario where my L2 MS is connected to mesh solution called APT.  APT nodes find each other using Discovery packets. The APT nodes use the contents of the discovery requests to decide which node will be the master and which will be the client (slave). The client node then attempts to connect to the master using a UDP/IPv6 socket and the link local addresses of the Ethernet ports. The IPv6 address is resolved to an Ethernet MAC address by the Neighbor Discovery protocol. An ICMPv6 Neighbor Solicitation sent from the client to the Neighbor Discovery multicast address of the master. APT Discovery packets use an IPv6 packet sent to the Multicast address of FF02::1, with UDP payload data with the SRC and DST is set to port 2210.....etc   now as i was reading, i wasn't sure if i should create a multicast address on the MS switches by creating PIM-SM (L3 Settings) following this link  https://documentation.meraki.com/MS/Layer_3_Switching/MS_Multicast_Routing_Overview or by simply configuring multicast listener discover (MLD) Snooping for IPv6 Multicast , also mentioned in the same link i just posted.  I have never done such settings, appreciate if someone out there had done a semilar solution   ... View more

Hi,  we have a meraki MR / MS and MX at head office. we are using NPS as our radius server hosted in Azure. We are using PEAP ( EAP-TLS with x.509 certificate based authentication) using user certificate.   Everything is working well but we started getting an issue : when a user PC is connected to both wired and wireless network ( both networks got 802.1x enabled) , the user laptop is preferring the wired as expected. our wired gateway is 10.1.10.1 ( our switch ). On the other hand, the wireless AP IP is ( 10.1.20.1 ).    we have enabled re-authentication on the switch every 300 seconds. When the PC is trying to re-authenticate the wired network, it is taking long time ( around 30 sec ) , then the wired is failing and the user laptop gets switched to the wireless network.    we have played around with the Metrics for both networks on the laptop as per the attached screenshot but that didn't fix it. My assumption is that, when the pc is trying to reauthenticate the wired connecting (by fragmenting the certificate and sending it) , the wireless profile is kicking in as it is trying to give the pc an access to the network ( also by fragmenting the certificate and sending it all the way to nps ) and this is why it is taking longer during the re-authentication process, but i wasn't sure why the wired ends up failing and the wireless takes over.    Is there a way to fix this issue ? ( we want to keep reauthentication on , disabling it would fix the issue but it is not recommended ) Also, can we pin-point the problem ? is it the laptop behaving the way i explained, or is it that the switch is receiving the same certificate from two different resources and is getting confused ? or is it related to NPS ?  ... View more

Hi,  we are trying to get 2 x MX to be deployed in HA mode at a site. Issue is that service provider is only providing us a /30 peering IP Address with their NTU. We asked them support one of the following options : To provide connectivity to both of our MXs, we may need an IP range with subnet mask of /29, which will provide the capacity to connect 6 hosts. This will eventually suffice our requirement to provide IP addresses to both of our MXs.                                               Option2 : Providing extra port at NTU with a new IP range of /30   To provide connectivity to both of our MXs, we may need an extra port at NTU with a new IP range of /30, which will suffice our requirement to provide IP addresses to both of our MXs.                                The problem is that the ISP came back and said they don't support any of the above options ( or won't support ) and that the only thing they can do is to provide us with /29 public IP addresses which we can statically route into our internal network. would this solution work ? if yes, how would you configure it ? ... View more

Hi, I got a VMX (referred as VMX1) running in Azure VNET1 , and in the same VNET i got other resources (VMs) that are reachable by VMX1 I have another VMX  ( referred as VMX2) running  in Azure VNET2 ( different region) which is intended for back up. VMX2 also got resources configured in its same VNET 2 ( VMs ) and can reach them.    VMX1 got a VPN tunnel ( IPSEC) with VMX2. I am not 100% sure how the tunnel was established and if i can terminate it. this is an issue that i will park for now    VMX1 is able to ping  VMX2 however, VMX1 is unable to reach any resources in VMX 2 although i have added those resources under VMX2 local subnet.    my questions are: 1- Any idea how to get the local subnets at each VMX advertised to the other VMX ?   2- can i turn off IPSEC tunnel between VMX1 to VMX2 while i keep the IPSEC between VMX and my other MX's ?  ... View more