Hi all, apologises for the rather large post but it's a complicated beast.   We have a vMX up and running in Azure (following the Meraxi Azure vMX guide) and it's happily passing traffic from our physical SD-WAN boxes into and out of a number of Azure subscriptions peered to it but as we're migrating more services into Azure I've run across an issue that's frankly driving me bonkers. Our setup looks a bit like this :-   Sub A <-- VNET Peering --> Sub B (The Hub, vMX lives here) <> SD-WAN to our on-premise locations Sub C <-- VNET Peering --> Sub B Sub D <-- VNET Peering --> Sub B etc...   Our issue came to light as we started trying to access a service by passing through Sub B, for example a DNS server in Sub C. Traffic to or from the SD-WAN is no issue at all, but from Sub A or D the DNS traffic (or HTTP for a second simple test) goes to ground. Frustratingly, our trusted test tools ping and traceroute "just work"... Grrrr   If I spin up a temporary Linux box with HTTP and DNS in SUB B, Sub A, C and D can all reach it as well as any location connected over SD-WAN. Looking at the Effective Route Table for a server in Sub A, it seems traffic that's using the "Default" peer route out of Sub A to Sub B is happy, but traffic that's using the "User" route table to get it to the vMX in Sub B seems to fail. The vMX see the traffic arrive in a local packet capture but then it never reaches the destination or sees any response which makes me think that maybe the vMX is getting in the way but for the life of me I can't see how. Of course the simple answer is just move the servers we need into Sub B but rebuilding our multi-layered ADFS setup in a new subscription (currently in a a Sub that's connected to our WAN using a very expensive ExpressRoute link we would like to kill) fills me with dread so I'd rather just peer it in but the DNS servers that also sit in that Sub are being relied on by the other Azure hosted subscriptions so everything dies when we do. "It's always DNS" after all.   I spent an hour and a half on a call with MS support this morning getting packet captures which seem to have failed to catch the traffic in question so while I try to work out why, I thought I'd ask the awesome Meraki community to see if anything jumps out at anyone. ... View more

Hi all,   We're almost at the end of our EU wide SD-WAN rollout (only around 30 sites but still...) and as I'm sure anyone who's ever done this will know, with Meraki "it just works" 🙂   We have a remaining office site that for current political reasons we can't deploy any Meraki hardware to site. We are looking at a simple third party VPN link (Probably using a locally sourced ASA) into a spare MX using the excellent reference article from Aaron Willette (https://www.willette.works/merging-meraki-vpns/) which we've already used to great success for an actual third party that needs access to an internal resource.   I'm hoping to build a pair of 3rd party VPN links so we don't have a single point of failure but getting traffic flowing over the right VPN link seems like a challenge as each of the corporate LAN MX's would publish the same static route into the SD-WAN pointing to their local 3rd party MX. I have a vague recollection that it's possible to do some element of traffic steering using over the SD-WAN using the priority of the hub's that a spoke connects to but I don't think that's possible between hubs. Am I just overthinking the whole situation? ... View more

Hi all,   We're on the verge of moving some connections into production using the vMX in Azure / AWS but the lack of an HA configuration, such as what you can build with the physical hardware, makes me a little nervous. I've seen the scripted AWS failover system put together by @PhilipDAth but I was wondering what you're experiences have been like as far as reliability with a single appliance.   Is the underlying infrastructure generally reliable enough to stick with a single vMX or would you recommend the extra layer of complexity of a second appliance and some sort of user built routing/failover in AWS and Azure (unsure even how yet)?   Thanks all. ... View more

Hi all,   We're having some really strange WiFi drop off / roaming issues on one of our sites (obviously, my site and none of the other 28 we have across Europe 😞 ) that appear completely random across different client manufactures, drivers versions, you name it. There's no pattern I can find to the disconnections so I'm going round and round in circles with it.   However, one stand out difference we have with this particular building is a lot of AP's. We spammed the building with no wireless survey and have 34 AP's over 3 floor, including a conference centre that sees meetings of up to 80-100 people (then of course 100 laptops, plus 100 iPhones, plus 100 personal phones,etc...).   I've made changes over the last 3-4 months to the RF Profiles to allow the AP's to adjust their settings as far as possible and we're seeing some of them powering down to 2dB which is suggesting there is more overlap between them than we probably should have.   So, this brings me to the point of the question, to try to assess if we do in fact have way too much overlap, I'm looking at disabling a few of the AP's to see what that does to the remaining AP settings and coverage and I'm trying to figure out if I simply disable the SSIDs from an AP, does that shut down the antenna completely.   If I switch the SSID to "deploy SSID by TAG", and drop the tag on a few of the AP's does that shut down the radios as well or do I need to power them down completely? ... View more