Hi all,   Can someone help me wrap my head around this please?   We're looking to implement firewall rule that would permit traffic to specific destinations, while continuing to block everything else. The challenge is the destinations are cloud services so tend to contain many changing IP addresses.   Looking of the details in the document below, it suggests it's possible, but only if the MX sees the DNS request to match it up with the client connection. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings   What's not clear is if that DNS request must come from the client itself, rather than from an onsite DNS server that the client is talking to.   Am I right in thinking this only works if the client machine is making the request to, for example Google DNS 8.8.8.8., so that the MX sees those requests and can match them directly back to the client IP then asking to get to sitexyz.com? ... View more

Hi all,   We're working to deploy a couple of MX's into regional data centres and will be using BGP to peer into the Auto-VPN. We've agreed an internal AS number to assign to the Meraki side but we don't have all of the data centre parts of the system in place yet. Are we able to still activate the BGP settings in the Auto-VPN so we can get the Meraki side of things updated to BGP and stable again (I understand the Auto-VPN will have to reconfigure itself internally) before we have to add in any BGP peers? I'm assuming we can, it's just not clear from the documentation ... View more

Hi all,   We've had a vMX up and running in AWS since the middle of April but somewhere around the early hours of June 6th it dropped all of the SD-WAN links. It's not in PROD yet so we didn't pickup a monitoring alert.   Anyway, we still have dashboard access and neither a vMX or AWS Instance restart has not shaken it back into life but something hit me while I'm trying to figure out what's going on. The AWS Security Group is built from the dashboard recommended firewall rules for the site as recommended in the AWS vMX setup guide, including all the usual suspects for dashboard access, you know all the funky UDP ports and the like, but that gives you no ports I would have thought needed for IPSec (4500, 500, etc).   I kinda assumed the dashboard did uber magic and the fact it was working made me suspect that was the case but maybe the initial setup had less rules on SG and the connections were up before it closed off the doors.   I know this is something that should make sense but I'm way down on my coffee supply this morning. Should we have more outbound/inbound rules in place the IPSec links that the SD-WAN needs to operate? ... View more

Hi all,   I must be missing something here because it just can't be this hard. The EC2 instance is up and running (using the Meraki setup guide - https://documentation.meraki.com/MX/Installation_Guides/vMX100_Setup_Guide_for_Amazon_AWS) and using the "customer data" from the authentication token. We can reach the appliance's public IP (we have a rule allowing port 80 inbound temporarily to troubleshoot) and it confirms internet access but no connection to the dashboard over port 7734. However, AWS flows confirm it's sending and receiving data from the dashboard over port 80 and port 7734 but it just will not phone home and show up in the dashboard at all.   What have I missed? ... View more

Hi all,   Before I go completely bonkers, can I run a question by you all to see if I'm in fact trying something impossible.   We have an existing MX HA setup on site that's happily running and providing SD-WAN links to an expanding number of our offices but we are looking to move some third party IPSec VPN links over to our Meraki infrastructure as well. To help separate out the traffic from our SD-WAN (We don't need everyone to know about the links, they are for single local services), we're following this article - https://www.willette.works/merging-meraki-vpns/. It makes sense and I've most of the infrastructure up and running with the exception of the primary WAN link. I'm trying to use 3 additional IP's from our available public subnet but the IPSec MX's seem to not want to use them and keep falling back to WAN2. They are part of the same public subnet assigned to interfaces on the HA MX's and I'm half thinking this is the cause. I'm not seeing any errors but they just don't seem to want to use the primary WAN connection. There's a mention in the article about needing a separate organisation for the VPN link to avoid any VPN subnet overlaps but the impression I got from this was avoiding overlaps between third party subnet and a subnet on the SD-WAN but it's not clear. Can anyone confirm if this should be possible or am I going to have to look at a separate organisation? ... View more

Hi all,   A question popped up in our team meeting this morning that I hadn't considered. If a website is dropped into a category by Brightcloud that a local MX happens to block (Parked Domains for example), is there a safe way to allow a management IP address to bypass the URL category list and get unrestricted internet access to be able to confirm the type of site? I'm assuming it's not obvious from the URL or users description.   We could of course connect out of band to check it or simply whitelist the URL on the MX but that releases it for all users so I'm kinda hoping there may be a more elegant and controlled option we could consider.   Thanks, Martin ... View more