There is a better solution for you, Secure Connect. This is the evolution of Meraki and cloud security together. Secure Connect allows easier and more flexible ways to deploy MX sties to have the traffic inspected. Onboarding a spoke to Secure Connect does inject a default route to the spoke MX. We also can deploy MX hubs to Secure Connect which does not inject the default route. We can mimic the default route by using the Secure Connect Hubs as Exit hubs. There are flexible options how MX spokes communicate to MX hubs. Check out the Meraki Secure Connect documentation and the hub integrations here. In most cases we can move customers from Umbrella SIG to Secure Connect while retaining the same Umbrella org.  ... View more

If meraki sites are connected to Secure Connect via AutoVPN they will automatically be advertising to Secure Connect reachable subnets.    When you connect a non-meraki device via IPsec you will also define the routable subnets in the configuration. Once both tunnels are connected, you would need to enable a source-destination cloud firewall rule to allow connectivity as the default private app and network rule is a deny all. then the sites would be able to communicate with each other.    ... View more

ISE module by itself does not cause a conflict. If you have traffic set to split exclude and ISE is set to [Block untrusted server]; the split excluded traffic is blocked. Could you use the ISE module for purposes outside of Secure Connect, yes. Same with NAM- just have to be careful to deploy properly or there may be issues as you saw. If you are not using ISE or NAM, best to not include the modules.  ... View more

This would depend on how the PoS/IoT device communicated. The clientless ZTNA supports web ports only. If a private resource communicated that way, then the answer is yes. If the private resource used other ports then then client based remote access would be needed.  ... View more

Can you expand on the question please?  ... View more

The support team and PM team are working to help resolve the issues during the private preview of hub to hub connectivity.  ... View more

I would contact support to diagnose the issue. There is the chance that when you tried to connect to a specific DC it was down for maintenance, periodically updates are done that might take a DC out for a short period of time. This is the reason the auto select is there to connects users to the best DC at that point in time.  ... View more

I would contact support as that is not expected behavior. The "Auto Select Nearest" in reality just queries the server addresses and chooses the best one so choosing the DC individually should work sicne that is what is happening anyway. Do you have a need to connect to a specific DC? ... View more

If you are trying to access a private application over a VPN solution you need either Secure Client VPN terminating on the MX or Cisco+ Secure Connect which has remote access as a service. Once connected to the VPN you would be able to access the private resource (192.168.x.x as an example).  ... View more

Is this question specific to Cisco+ Secure Connect? Reason I ask is Secure Connect eliminates most of the need to do port forwarding with a mor secure way to access resources behind a MX.  ... View more

We have a private preview of Meraki hub to Secure Connect as a supported topology, as we progress we will continue to work with your organization to implement when appropriate.  We can not control which sites/services respect XFF headers and which do not.  VPN exclusion is available for major applications, DNS based on hostname, and L3 via CIDR.  ... View more

Any MX license will work with Secure Connect. There are some overlaps between Advanced Security and Secure Connect; the most common reasons you would want to keep both are: geo based firewall rules, youtube content restrictions and Adaptive Policy.  ... View more

Sorry if I was not clear. What pieces are your trying to connect together is what I am trying to understand. Your original post mentions AnyConnect (client VPN), Azure, CSR (Cloud Services Router), and MX100. Where are you trying to terminate a VPN session and how do you want to authenticate? ... View more

Cisco+ Secure Connect is a specific solution; it should not be read as Cisco and... My question is what components are you trying to use? I see MX100 and Azure but no mention of Secure Connect the product.If you are asking creating a tunnel between Azure and a MX100 you will find better results in the MX community. AnyConnect to MX100 also better in the MX community. ... View more

Is this question specific to Cisco+ Secure Connect or are you asking about other products/deployments? This community is focused only on Cisco+ Secure Connect, we do not have the knowledge to help with other products/deployments.  ... View more

I will try to find some public documentation on the support for XFF header. Hard to prove out with the way Umbrella works. Best I can provide is screenshot of my device on SIG with the XFF header of my actual public IP which will be respected by websites that honor the XFF, as google does. This is using Secure Client as the connectivity method, Secure Connect and Meraki Cloud On-ramp are not currently supported with XFF. the XFF became the standard way SWG operates about a year ago.    ... View more

Umbrella does support XFF headers so the location would be preserved. AnyConnect, proxy chaining, PAC file, and IPsec are supported connectivity methods. the Meraki Cloud On-Ramp and Secure Connect are not currently supported.  ... View more

1. We have found that not every deployment has caused issues with communicating to Meraki dashboard over Secure Connect tunnels, hence there is not default exemption of Meraki dashboard destinations in VPN exclusions. We are working on root cause analysis.  2. Hubs will be supported soon, no public timeline to share beyond that. Please engage your Meraki team for more detail if desired.  3. The MTU size requirement is documented, we are looking to provide the option to increase MTU and support fragmentation, work ongoing in these areas.  4. VPN exclusions are only by CIDR for TCP/UDP/ICMP and for DNS hostnames are supported. The UI is a bit confusing on this front, feedback submitted.  ... View more

New video on how easy it is to bring in new employees with Cisco+ Secure Connect.  https://app.vidcast.io/share/068ff2f6-62ab-4674-96c5-653d2ebb4d93 ... View more

Will we have to change anything on the vMX-M appliances? Currently all Meraki sites connected to Secure Connect will be configured as spokes with Secure Connect seen as a hub. Hub to hub connectivity to Secure Connect will come in the future.  Do the vMX have to change to Routed mode? Yes Will the vMX appliances now be seen as a spoke? Yes What sort of latency will be introduced on top of the current latency seen in the AutoVPN config? If you are asking about site to site connectivity there will be some latency added. We are introducing another hop and a policy evaluation. The latency added will depend on multiple factors, there is no stated number. Does the Essentials licensing allow for traffic steering at the remote sites? For example, to exclude certain traffic from being routed via Secure Connect? (Meraki licensing is Advanced Security) Secure Connect is not dependent on a specific MX license. VPN exclusion rules can be done for IP/CIDR for any MX license and application based VPN exclusion rules require the SD-WAN Plus license. ... View more