Hi all,   We've recently connected one of our data centres to our existing Auto-VPN SD-WAN using MX250's and these are talking BGP to routers in the DC to pickup around 20 subnets from the data centre routers. The strange thing is, those routes are only visible on the local MX's in the data centres (as BGP routes). They are not visible in the route table on any of the other hub or spoke MX's that are part of the same Auto-VPN configuration but somehow the traffic still gets through.   I'm investigating as we are looking to hook up 2 other data centres that will then also feed us around 650 routes for the rest of the global organisation and if we get all of those routes appearing in Auto-VPN it's going to swamp the MX64's we have in our smaller offices if they are still recieving all of those routes but just not making them visible on the dashboard. ... View more

Hi all,   We're getting closer to what I hope will be a relatively simple task but I'm way out of my depth here so thought I would ask if the community has any advice on the subject.   Essentially, we have an existing SD-WAN covering around 30 sites in Europe. The rest of our global organisation are using other technologies for regional connectivity and our top level idea is we deploy one (probably an HS pair) of our Meraki organisation MX's into each of the other regions, and have them peer locally using BGP to share routing between their local region and our MX so we have dynamic routing across the regions.   The Meraki documentation is reasonably good but I've logged a support ticket to ask a few extra questions, mainly around timescales for activation and what interruption (if any) we are likely to see to our existing SD-WAN when we ask the support team to activate BGP.   Does anyone have any experience of setting up BGP and if so any pitfalls we should look out for? ... View more

Hi all, apologises for the rather large post but it's a complicated beast.   We have a vMX up and running in Azure (following the Meraxi Azure vMX guide) and it's happily passing traffic from our physical SD-WAN boxes into and out of a number of Azure subscriptions peered to it but as we're migrating more services into Azure I've run across an issue that's frankly driving me bonkers. Our setup looks a bit like this :-   Sub A <-- VNET Peering --> Sub B (The Hub, vMX lives here) <> SD-WAN to our on-premise locations Sub C <-- VNET Peering --> Sub B Sub D <-- VNET Peering --> Sub B etc...   Our issue came to light as we started trying to access a service by passing through Sub B, for example a DNS server in Sub C. Traffic to or from the SD-WAN is no issue at all, but from Sub A or D the DNS traffic (or HTTP for a second simple test) goes to ground. Frustratingly, our trusted test tools ping and traceroute "just work"... Grrrr   If I spin up a temporary Linux box with HTTP and DNS in SUB B, Sub A, C and D can all reach it as well as any location connected over SD-WAN. Looking at the Effective Route Table for a server in Sub A, it seems traffic that's using the "Default" peer route out of Sub A to Sub B is happy, but traffic that's using the "User" route table to get it to the vMX in Sub B seems to fail. The vMX see the traffic arrive in a local packet capture but then it never reaches the destination or sees any response which makes me think that maybe the vMX is getting in the way but for the life of me I can't see how. Of course the simple answer is just move the servers we need into Sub B but rebuilding our multi-layered ADFS setup in a new subscription (currently in a a Sub that's connected to our WAN using a very expensive ExpressRoute link we would like to kill) fills me with dread so I'd rather just peer it in but the DNS servers that also sit in that Sub are being relied on by the other Azure hosted subscriptions so everything dies when we do. "It's always DNS" after all.   I spent an hour and a half on a call with MS support this morning getting packet captures which seem to have failed to catch the traffic in question so while I try to work out why, I thought I'd ask the awesome Meraki community to see if anything jumps out at anyone. ... View more

Hi all,   We're almost at the end of our EU wide SD-WAN rollout (only around 30 sites but still...) and as I'm sure anyone who's ever done this will know, with Meraki "it just works" 🙂   We have a remaining office site that for current political reasons we can't deploy any Meraki hardware to site. We are looking at a simple third party VPN link (Probably using a locally sourced ASA) into a spare MX using the excellent reference article from Aaron Willette (https://www.willette.works/merging-meraki-vpns/) which we've already used to great success for an actual third party that needs access to an internal resource.   I'm hoping to build a pair of 3rd party VPN links so we don't have a single point of failure but getting traffic flowing over the right VPN link seems like a challenge as each of the corporate LAN MX's would publish the same static route into the SD-WAN pointing to their local 3rd party MX. I have a vague recollection that it's possible to do some element of traffic steering using over the SD-WAN using the priority of the hub's that a spoke connects to but I don't think that's possible between hubs. Am I just overthinking the whole situation? ... View more

Hi all,   We're on the verge of moving some connections into production using the vMX in Azure / AWS but the lack of an HA configuration, such as what you can build with the physical hardware, makes me a little nervous. I've seen the scripted AWS failover system put together by @PhilipDAth but I was wondering what you're experiences have been like as far as reliability with a single appliance.   Is the underlying infrastructure generally reliable enough to stick with a single vMX or would you recommend the extra layer of complexity of a second appliance and some sort of user built routing/failover in AWS and Azure (unsure even how yet)?   Thanks all. ... View more