Hi all,   We are trying to enable the AD connector on a number of MX appliances spread across our European offices but failing in what seems to be a completely random fashion. We've followed the setup process outlined in the following article on each of the DC's we are trying to work with and confirm all of the relevant settings are in place.   https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances   When we add the AD credentials (We're using the same service account with just the relevant permissions), we can get the status to report back as OK but getting the LDAP group list to populate is where we are falling over. It seems to be completely random whether it works or not. We appreciate that we need to point to the sites local DC to capture the login details but even that's not consistent. For example, our office in The Netherlands has been failing talking to its local DC but worked (for the first time today) when pointed at one in the UK. On the same UK site, their local MX refuses to talk to the same DC that is happily working for MX in The Netherlands. This seemingly random pattern repeats itself across half a dozen different sites and I cannot find any one link between them. Does anyone have a clue what could be causing this?   ... View more

Hi all,   I'm working through the process of migrating one of our offices from a Checkpoint firewall to an MX but I've run up against an issue and I can't think of a sensible way around it. The site has a DMZ behind the Checkpoint firewall with a server that makes connections both to the internet (easy to reproduce) but also to a single server in a data centre across our global WAN. That connection has a policy on the Checkpoint that uses NAT so the connection looks to the data centre server as though it's the firewall making the request and as the local office LAN is a subnet the data centre knows about, it just routes the traffic back. The DMZ server in question is a third party black box so we are hoping to avoid having to connect it directly to the LAN in the office as we cannot be certain how up to date it is. Is there any way I can reproduce that DMZ <> NAT <> LAN functionality with an MX or do I need to starting thinking about having routes for the DMZ subnet advertised across the WAN? ... View more

Hi all,   As we're deploying out MX's across our EU sites we have run up against a little issue with a site that has 4 different small subnets supplied from their ISP, one of the joys of the IPv4 exhaustion and a lot of locally hosted services. While we will likely end up moving the services across to the first 2 subnets, there's a lot of third party involvement which will inevitably lead to service outages, as they do when you don't have visibiity of both sides of a connection. Obviously we could assign a subnet to each WAN interface (We're running an MX-250) but is there any way we could make use of the additional subnets? ... View more

Hi folks. We're starting our roll-out of around 25 sites across Europe who will all be receiving a HA pair of MX's (64, 100, 250 depending on site size). The hardware is being shipped directly to site by Meraki and we have a varying level of IT support on each site, from dedicated IT staff through to the guy who fills the coffee machine. We're configuring all the sites ready to support dual internet feeds for future expansion (a task you need the local status page for on an MX64/MX100) and then configuring them for HA. It's a relatively simple task if all the hardware's sat on your desk but a little trickier to achieve on a remote site. A quick Google this afternoon returns a selection of links but none that really walk through the process in enough detail to make it easy to explain to someone remote. Does anyone have a handy guide that we could use to help simplify the process and make it easy to follow? ... View more

It appears that Meraki has decided that I now speak Dutch so the latest email update from them has picked Dutch accordingly. As far as I can tell on the dashboard I'm set for English so I have no idea where this has been changed.    Any clues folks?   ... View more

Hi all, this has me puzzled. We have replaced an older model Cisco Catalyst switch with a Meraki  MS210-24P but it's not visible on the topology, neither is the MR32 on the other side of it. Before we started, our topology looked like this :- MX-100 <> Catalyst 4500 (Our core) <> SFP fibre <> Catalyst <> MR32 The new setup looks like this :- MX-100 <> Catalyst 4500 (Our core) <> New MS225-48FP <> SFP fibre <> New MS210-24P <> MR32 None of the new hardware appears on the topology view, nor does the MR32. I must say I'm not 100% certain the MR32 was visible before the move but if I use the search on the topology view it lists 1 device found but it's not visible.   We moved the fibre connection to the MS225 because we were burning up a 10Gbps SFP+ port on the core switch for a generally 10Mbps throughput connection. The links between all of the switches are trunks carrying native VLAN1 plus a couple of others in use on site.   Could it simply be that the topology view isn't updated in realtime or maybe only after a switch restarts (VLAN1 was filtered off the trunk initially)? ... View more