Gotcha. I was suggesting a look at the ARP table because that's the only way to correlate a device's MAC and IP addresses. Maybe you're not able to find the management port's MAC address either.   Let's try to find the MAC first. Go to Switching > Switches, then select the switch name where the UCS mgmt port is connected. That should give you a list of clients like this:   Look for the specific switch port. If the switch is able to learn anything from traffic that the UCS mgmt port has sent, it will display the MAC and IP addresses. (If you don't see those columns listed, click on the wrench icon in top right and check the boxes next to MAC address and IP address.) It's possible that you won't find an IP address listed there for the UCS. That's because the box hasn't sent any ARP replies that identify its MAC address with an IP address. Maybe it doesn't have a static IP address configured already, or maybe the box is just sitting idle and quiet, not transmitting. This is the point where you can dump the ARP table of the upstream MX or switch that's acting as a router on the UCS's VLAN and hopefully find the IP address listed there. Try to do a packet capture on the switch port. Go to Network-wide > Packet capture, then select the switch and port where the UCS mgmt port is connected. You can kick off the capture with no filter at all; the capture will have any traffic to/from the UCS, as well as any broadcast traffic too. That might be a ton of packets to sift through. If you know the MAC address, then use filter ether host xx:xx:xx:xx:xx:xx (where xx's are the hex digits). That'll capture only packets to/from that MAC. Here's another idea - go to the switch port's settings and change the VLAN number to something that isn't used anywhere else in your network. That will isolate the UCS mgmt port onto its own VLAN, then you can capture on the switch port without a filter and you won't get any broadcast traffic from other machines. You might have to let the capture run for a long time if the server is idle and quiet. Let me know what happens! ... View more

Hi texmansru47,  The video posted above is part of the "Capturing Packets with a Security Appliance" eLearning module. We have a handy downloadable capture filter summary "cheat sheet" on page 6, but you can get it here directly. Otherwise, if you go to Switching > Switches, do you see your UCS server listed as a client? Hopefully you know its MAC address from that page or from a physical label on the server itself. Often the IP address will be shown in the Clients list too. If it isn't, you'll need to look at the box where the routing for the server's subnet takes place. For example, that might be an MX security appliance. If that's the case, you can display the MX's ARP table by navigating to Security & SD-WAN > Appliance Status, then select the Tools tab. Toward the bottom is ARP table. Select the Run button, then see if you can find the server's MAC address in that output. If you don't find the IP address there, go for a packet capture and filter on the server's MAC address (ether host xx:xx:xx:xx:xx). The server might be sitting idle and not transmitting anything for a long while, so you may have to let the capture run more than a minute. Downloading the capture to Wireshark will let you run for much longer. Hope this helps! ... View more

Hey Paul, Does the cloud provider have any IPsec logs from their end that they could share with you? Dave H   ... View more

Out of curiosity, what IP address is/was the MX using for itself in the 20.20.20.0 subnet? Could it have been using 20.20.20.1, the same address as the HP core SVI? Perhaps the HP hardware swap just forced a readdressing that no longer conflicts? Dave H ... View more

Hi Paul, what's at the far end of the site-to-site VPN tunnel? If it's a non-Meraki device, there could be a tunnel lifetime that expires or a rekeying even that occurs every hour. Dave H  ... View more

Hi, MatthewG3! That's a great question. I don't know of a way to clear the MAC address table from the dashboard. There might be a way via an API call, but will have to research that. Otherwise, the MAC address table is built to learn new entries dynamically, as ethernet frames arrive on switch ports. Existing entries get refreshed the same way. However, learned entries will automatically age out if no further frames are received for a fixed amount of time. That tends to keep the table up-to-date and tidy, with no manual intervention required. On Catalyst switches, MAC table entries age out after 300 seconds (5 minutes). On MS switches, the age out timer can vary depending on the chipsets used in the specific model. I hope this helps! ... View more

I used to work in a large hospital. One of the IDF closets in the basement was located inside another room. That's the door to the IDF, right behind that big box-shaped cart. So when you went in the IDF to work on something, you never knew when someone would push a cart back in and block the door shut. Oh yeah -- that box-shaped cart is the morgue cart.     The real problem with that IDF room was that the entire outer room could get filled with lots of carts, beds, etc, without warning -- to the point that it was impossible to get the IDF door open at all. I had a friend who went in the IDF to work for a while, and the door closed. A short time later, hospital staff filled up the outer room completely. He was by himself, with no one anywhere near, so he had to use the two-way radio he brought with him to call for help. That's the IDF door toward the back, impossible to get in or out of. And yes, that's the morgue cart again, over against the opposite wall. Complete scary log jam. ... View more