Hi all,   We're almost at the end of our EU wide SD-WAN rollout (only around 30 sites but still...) and as I'm sure anyone who's ever done this will know, with Meraki "it just works" 🙂   We have a remaining office site that for current political reasons we can't deploy any Meraki hardware to site. We are looking at a simple third party VPN link (Probably using a locally sourced ASA) into a spare MX using the excellent reference article from Aaron Willette (https://www.willette.works/merging-meraki-vpns/) which we've already used to great success for an actual third party that needs access to an internal resource.   I'm hoping to build a pair of 3rd party VPN links so we don't have a single point of failure but getting traffic flowing over the right VPN link seems like a challenge as each of the corporate LAN MX's would publish the same static route into the SD-WAN pointing to their local 3rd party MX. I have a vague recollection that it's possible to do some element of traffic steering using over the SD-WAN using the priority of the hub's that a spoke connects to but I don't think that's possible between hubs. Am I just overthinking the whole situation? ... View more

Hi all,   We're on the verge of moving some connections into production using the vMX in Azure / AWS but the lack of an HA configuration, such as what you can build with the physical hardware, makes me a little nervous. I've seen the scripted AWS failover system put together by @PhilipDAth but I was wondering what you're experiences have been like as far as reliability with a single appliance.   Is the underlying infrastructure generally reliable enough to stick with a single vMX or would you recommend the extra layer of complexity of a second appliance and some sort of user built routing/failover in AWS and Azure (unsure even how yet)?   Thanks all. ... View more

Hi all,   We're having some really strange WiFi drop off / roaming issues on one of our sites (obviously, my site and none of the other 28 we have across Europe 😞 ) that appear completely random across different client manufactures, drivers versions, you name it. There's no pattern I can find to the disconnections so I'm going round and round in circles with it.   However, one stand out difference we have with this particular building is a lot of AP's. We spammed the building with no wireless survey and have 34 AP's over 3 floor, including a conference centre that sees meetings of up to 80-100 people (then of course 100 laptops, plus 100 iPhones, plus 100 personal phones,etc...).   I've made changes over the last 3-4 months to the RF Profiles to allow the AP's to adjust their settings as far as possible and we're seeing some of them powering down to 2dB which is suggesting there is more overlap between them than we probably should have.   So, this brings me to the point of the question, to try to assess if we do in fact have way too much overlap, I'm looking at disabling a few of the AP's to see what that does to the remaining AP settings and coverage and I'm trying to figure out if I simply disable the SSIDs from an AP, does that shut down the antenna completely.   If I switch the SSID to "deploy SSID by TAG", and drop the tag on a few of the AP's does that shut down the radios as well or do I need to power them down completely? ... View more

Hi all,   We are trying to enable the AD connector on a number of MX appliances spread across our European offices but failing in what seems to be a completely random fashion. We've followed the setup process outlined in the following article on each of the DC's we are trying to work with and confirm all of the relevant settings are in place.   https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances   When we add the AD credentials (We're using the same service account with just the relevant permissions), we can get the status to report back as OK but getting the LDAP group list to populate is where we are falling over. It seems to be completely random whether it works or not. We appreciate that we need to point to the sites local DC to capture the login details but even that's not consistent. For example, our office in The Netherlands has been failing talking to its local DC but worked (for the first time today) when pointed at one in the UK. On the same UK site, their local MX refuses to talk to the same DC that is happily working for MX in The Netherlands. This seemingly random pattern repeats itself across half a dozen different sites and I cannot find any one link between them. Does anyone have a clue what could be causing this?   ... View more

Hi all,   I'm working through the process of migrating one of our offices from a Checkpoint firewall to an MX but I've run up against an issue and I can't think of a sensible way around it. The site has a DMZ behind the Checkpoint firewall with a server that makes connections both to the internet (easy to reproduce) but also to a single server in a data centre across our global WAN. That connection has a policy on the Checkpoint that uses NAT so the connection looks to the data centre server as though it's the firewall making the request and as the local office LAN is a subnet the data centre knows about, it just routes the traffic back. The DMZ server in question is a third party black box so we are hoping to avoid having to connect it directly to the LAN in the office as we cannot be certain how up to date it is. Is there any way I can reproduce that DMZ <> NAT <> LAN functionality with an MX or do I need to starting thinking about having routes for the DMZ subnet advertised across the WAN? ... View more