Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Shaun1387
Shaun1387
Getting noticed
Member since Jul 5, 2022
Aug 9 2023
Community Record
24
Posts
4
Kudos
1
Solution
Badges
Aug 9 2023
1:28 AM
Hi All, Thanks for the help with this guys. This is baffling. I picked up your replies on Monday morning and was just about to set about double checking stuff out but i thought i would just make sure it was still dead.... and behold.... without me doing anything, it was working ! No idea whats happened there ,I never made any changes and its a dev environment which only i am using at the moment so i cant explain why it wasnt working on Friday, then was on Monday morning. I cant imagine there was some sort of delay or issue with the dashboard provisioning the commands down to the box which took a weekend to do but in the absence of any other reason ?... dunno. I have been monitoring it since Monday morning and it appears to be working correctly now. Thanks again for your help and assistance guys. Cheers
... View more
Aug 4 2023
6:55 AM
Hi All, Quick overview.. I have a combined network with an MX at the top and some MS switches and MR AP's. I have a requirement to send syslog from all of these devices over a non-meraki VPN from the MX out to a server on the other end of the tunnel. Im not seeing any syslog at all either originating from the MX,MR or MS devices (local packet capture shows no syslog traffic at all) or arriving at the MX to initiate the VPN. Im certain that all i need to configure is the syslog server definition in 'network-wide/configure' which i have done. The routing table looks good, there is a route there pointing to the NMVPN and if is fire a ping off from the MR, MS or MX i see the ICMP turn up at the MX in a packet capture and it fires up the VPN. Its a simple config, all of the vlans including the mgt are routed off the MX so i should be at least seeing them turn up there even if the VPN was broken. Firewall rules look ok as does the site-to-site rules, which im not convinced are the issue anyway as im not seeing the MR/MS generating syslog when doing a lan side packet capture on these directly. Am i missing a trick here ? is there a config item i have missed ? Cheers Shaun
... View more
Jul 3 2023
1:29 AM
Hi Philip, Thanks for that info , its cleared up that point. I have been trying to understand why i couldn't get that flying for a while now. Yeah, i had thought initially if i could get the MX Hub to talk to umbrella SIG then that should do it and I have umbrella connectors on my spoke sites which work fine, but i cant seem to get the SASE tunnels up between the HUB and umbrella, should that work ? Not wanting to derail this topic but I was also looking at scenarios where hosts within azure need to get to the internet but via the HUB MX so policy can be applied, not directly out via Azure. Im fairly new to Azure so i may be missing something fundamental here but i cant get that to work either, im wondering if I need to be looking at something like a def route in azure pointing to the MX.... ? im not even sure if it can be done. ? Thanks again for the pointers everyone. Very much appreciated. Shaun
... View more
Jun 29 2023
5:10 AM
Many thanks Alemabrahao, Is the only way of making this work to enable client split tunnelling ? This leads me to another question actually. Should i be able to get an auto-vpn tunnel up between the vMX i have configured as concentrator/hub, and the umbrella SIG hubs ? I have never been able to get those connectors up unless the MX is a spoke. I was thinking that if i could get that working then the SIG hubs should inject a default route in via iBGP and allow the clients to use SIG for DNS and webProxy which would work for this use case. if not then, how do we address situations where a vMX is used as a hub as i have described and we need client (including anyconnect client) web to go through the vMX to take advantage of traffic shaping or policy rules defined there or even to make use of the SIG web proxy etc ? Thanks again for any insights Cheers Shaun
... View more
Jun 29 2023
3:22 AM
Hi All, I think im missing something fundamental here but i cant see where. I have a vMX in Azure which is configured in VPN concentrator hub mode with 2 auto-vpn spoke sites connected. All good there. The two spoke sites are also connected to umbrella SIG. The vMX is talking BGP to an azure route server to provide connectivity to back end servers in a handful of azure vnets. This is also working fine for auto-vpn clients at the spokes. I have now configured the vMX Hub for anyconnect client connectivity which is working fine for access to auto-vpn prefixes (so internal stuff including the servers in azure), but the anyconnect clients cant get any traffic out to the internet via the vMX. I have configured the vMX to push out the SIG DNS servers (and tried it with googles DNS servers also) but it just seems that any internet bound traffic from the clients arrives at the vMX, but doesnt know where to go from there. I cant see any default routing in the vMX route table either so that may well be the issue but i cant see any way of getting a def route in the route table at all so im at a bit of a loss as to how this is supposed to work. Can anyone put me right here ? I cant see where to go next. Cheers Shaun
... View more
May 4 2023
8:27 AM
AWESOME !!! 😁 I will definitely have a look at this, !
... View more
May 4 2023
6:50 AM
This is a cool feature and we are making use of it in our dev labs. Big question is though, when will we see this for the Meraki Insight alerts ? At the moment, the MI Webhooks dont seem to support templates all so if you want to send MI related Webhooks to a 3rd party tool which is looking for an API key in the header , its not possible. MI Webhook support for templates would be cool, if only to support API in headers.
... View more
Nov 10 2022
2:00 AM
Hi All, Wondered if anyone else has noticed this.. I have a number of MX devices all configured under reporting to send the 'appliance event log' to a syslog server, this seems to be working except that it doesn't seem to be sending BGP events. I only noticed this as i am seeing some BGP flaps on one device which has just been upgraded to 17 code. Has anyone else noticed that BPG events are missing from syslog exports ? Cheers Shaun
... View more
Nov 9 2022
5:20 AM
Hi, thanks for posting this up. I have a spoke site which is showing some iBGP instability since this upgrade, the other spokes are on 16.16.4 and the hub is on 16.16 which are working fine. In the log i can see that the upgraded branch is reporting its holdtimer as expiring (set to 60 at the moment). it looks as if the iBGP session with the hub is dropping and expiring the prefixes. It stays down for a few mins then comes back up for a few mins, then drops again, with holdtime expired. internet access from this upgraded device is fine its just the BGP session as i cant see any logs indicating the VPN itself is dropping. Has anyone seen this behaviour with this code ? Cheers Shaun
... View more
Oct 31 2022
2:57 AM
Hi GreenMan, thanks for the reply 👍 im confused about this then as <134>1 appears on all syslog messages. I havent as yet seen any other marking on MX syslog output but in the example message below, its marked as <134>1 (whats the '1' ?) yet in the body its making the severity as '0' Emergency. Im inclined to believe that 134 is correct for this particular message as its just an info message. I can see others such as VPN down, port down which should probably be 'Alert' or maybe 'Critial' marked the same as below. it looks like all messages are marked like this so im not sure whats going on here ? Cheers Shaun "@version": "1", "message": "<134>1 1666888028.631071690 XXXhostnameXXX events IDS: New rules installed", "type": "syslog", "event": { "original": "<134>1 1666888028.631071690 XXXhostnameXXX events IDS: New rules installed" }, "@timestamp": "2022-10-27T16:27:08.639193004Z", "log": { "syslog": { "facility": { "code": 0, "name": "kernel" }, "severity": { "code": 0, "name": "Emergency" }, "priority": 0
... View more
Oct 26 2022
6:22 AM
Hi All, does anyone know what ' <134>1' means when it appears in a syslog message from an MX ? I wondered if it was category or a code that donates 'Meraki' but i cant find anywhere which explains it. Im working with some data ingestion engine rulesets and it would be useful to know what that signifies. Cheers all ! Shaun
... View more
Aug 4 2022
2:07 AM
Hi All, Think i have worked this out then. In order for clients connected to the same site as a one armed vpn concentrator in hub mode (in our case, this is a vMX in azure) ,you need to stand up a non-meraki ipsec to umbrella manually. The documentation suggests that in this config, its not possible for auto-vpn traffic to utilise the hubs non-meraki tunnel to umbrella, so if you need branches to get to umbrella, you still need to set up spoke on-ramp auto-vpn connector tunnels to umbrella in the normal way. I have it working in this way at the moment but wondered if anyone can confirm that this is the way its 'supposed' to work ? Cheers Shaun
... View more
Aug 1 2022
6:03 AM
Hi All, I'm sure i'm missing something here. I have a couple of my spokes connected up to umbrella connector hubs with no problem but i cant see any way of getting the Auto-VPN hubs themselves to connect to the umbrella connectors as well. Im not sure i understand the 'umbrella-hub' expected behaviour here. I would have thought that there would be a way to get access to umbrella direct from the auto-vpn hubs to cater for clients attached to the hub site itself ? The documentation just mentions that auto-vpn hubs and connector hubs dont automatically form tunnels with each other, which i can see is the case. But other than that, the document doesn't explain how this can be remedied. How is this designed to work in this scenario ? Cheers all Shaun
... View more
Jul 28 2022
8:26 AM
Thanks Again GreenMan, That clears that up for me. The VPN option would be the 'goto' in any other environment but its not really going to work in this case. Another option, if such a thing exists...., may be to find and deploy a local Syslog server to site which has an HTTP Push capability, see if the messages can be relayed that way. Actually, that might be quite a neat solution.🤔 Thanks again for clearing that up for me, If i find something suitable i will post back up here. Cheers Shaun
... View more
Jul 28 2022
8:08 AM
Cheers GreenMan ! So I have my webhook destination set up and working, the test webhook seems to work ok and im getting webhooks through ok for the alerts I have configured under configure->alerts. What i really need is for syslog messages to come in via webhooks as well, I have an MX on the network which is happily generating syslog messages locally but I need them in a central , off network location and they arent currently coming through on webhooks at the moment. VPN between the local LAN and the remote site isnt an option nor is exposing a syslog to the internet. am I right in now thinking that this isnt possible via Webhooks? The documentation seem contradictory (if only i could lay my hands on the doc that said it was possible...doh!) Thanks again for your help Cheers
... View more
Jul 28 2022
3:07 AM
Hi All, I had read somewhere in the Meraki documentation (which i cant seem to find again...) that syslog events should also be sent as Webhooks. Can anyone confirm that this is possible (or not!) as i cant get it to work, and i cant see any obvious switches or places where it would be configured. This is for an MX running 16.16.4 code. Cheers All ! Shaun
... View more
Jul 22 2022
1:19 AM
Cheers guys, beats me ! It was the last thing I had thought would be the issue but now that we know its a possibility hopefully it will help others when strange things start happening. 😁
... View more
Jul 21 2022
11:17 AM
4 Kudos
further update. Opened a support call with Meraki, turns out the code on the MX was actually version 10 despite the dashboard reporting 16.16.x Meraki support did a step update first to 12.x , then 15.x then 16.16.4. OSPF now working fine and my VPN oddities have cleared up. bizarre !!!! 😲
... View more
Jul 21 2022
2:44 AM
quick update.. have upgraded the MX to 16.16.4. Made no difference
... View more
Jul 21 2022
1:14 AM
Thanks for the reply's guys,👍 Hi Philip, the MX is running MX16.16 according to the dashboard. Currently, i have it connected to the router via a dedicated vlan (no SVI) and a pair of access ports on a 3750 switch, just so i could do a port mirror on the traffic. I have tried it cabled directly to a layer 3 port on the router with the same results. it works fine with OSPF disabled, drops off the network when OSPF is enabled. I will see if i can find any release notes for 16.16 , see if there is any mention of this as a caveat. Im having a few other oddities happening with this particular setup, I have a vMX in azure running as a Hub and two MX devices running 16.16. The vMX site to to site vPN is showing all green, the two spokes are showing disconnected from VPN registry, a packet sniff shows there are clearly talking to each other though... one for another time perhaps, but im now wondering if its got to do with the software on the MX as you suggest. hmmmm
... View more
Jul 20 2022
9:35 AM
Hi All, I have a strange issue with an MX i have in my SD-WAN lab here. I have this MX configured in Routed/Spoke mode using a single IP on the LAN side. Looking at the documentation, in this mode it should support OSPF connectivity to a peer on its LAN ports. I have a Cisco 2951 connected to the LAN port correctly configured for OSPF. When I switch on OSPF in the dashboard two things happen. The LAN port on the MX looses connectivity. i ran up a span on the port and could see on wireshark that the MX is not responding to any traffic (unicast/multicast) being sent to it and it occasionally sends ICMP's to the 2951 along with a load of other broadcasts (LLDP for example). Its ignoring the OSPF hellos as well as ICMP's from the 2951 and other hosts, in fact everything. It does seem to have an ARP entry for the 2951 as does the 2951 for the MX but thats about all thats happening. The MX drops off the dashboard completely. No idea why this should be happening. If i then turn OSPF off on the dashboard, reset the MX and let it boot, it pulls down the updated config and works fine again. My understanding is that this config should work but i cant understand why the LAN Port would just start ignoring traffic. Not sure whats happening on the WAN side, I havent looked at that yet but i suspect its something similar. Has anyone seen this before or know why it may be happening ? have i misunderstood something fundamental here. ? Cheers for any help guys ! Shaun
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2319 | Jul 21 2022 11:17 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 2319 |
© 2024 Cisco Systems, Inc.
