I found the solution: it's a common issue with AnyConnect DTLS negotiation. You need to open UDP port 443 alongside TCP port 443 on the MX/vMX firewall. ... View more

Hello, by any chance, has anyone identified the root cause of the recurring instability at the beginning of the VPN session?   Thanks. ... View more

Thank you for your reply. Unfortunately, this solution is not applicable in my situation, as the NAS is embedded within the internet router, which means it cannot be unplugged 😞  ... View more

Hello,    Other than the notes section, I think you can add a tag to the network indicating the providers. This can help you quickly identify which networks are using which providers and give you an overview ... View more

Hello @ww,    Thank you for your reply. I am wondering if we lose Internet access, will the static routes to the MPLS network continue to function without any issues?     ... View more

Hello,   Thank you for your insights,   However, is it possible to establish an Internet breakout using an existing MX HUB that already has Internet access and add a default gateway on the MPLS network specifically for Meraki management traffic? ... View more

Hi,   Thank you for your response. Unfortunately, that’s not the case, and we can't ask for it at this time 😞 ... View more

Hello,    Is there a new solution for this use case? Would integrating SAML with Meraki AnyConnect resolve the problem?   Thanks. ... View more

Hello,   I believe the best available approach for backup is to provision from the beginning your organizational infrastructure using Meraki Terraform provider. This approach ensures that you consistently maintain a clear picture of what's deployed under the Terraform state file. Consequently, if any manual changes occur, you can simply execute Terraform apply across your organization's setup to restore it effortlessly. Alternatively, you can opt for Meraki third-party tools to manage your backup needs. Please let me know if this addresses your concerns. ... View more

I didn't find a straightforward solution using Meraki MX since it lacks this feature.However, I previously managed this task with legacy Cisco ASA firewalls :). The workaround involves manually creating objects at the Meraki organization level for each CIDR and organizing them into object groups for each country or region, then setting up corresponding firewall rules. For instance, you can explore IP CIDR or range by country using resources like this example: https://github.com/herrbischoff/country-ip-blocks   Another consideration for the most secure approach is to eliminate this attack surface altogether and replace direct access with VPN connectivity. ... View more

Unfortunately, the dashboard event log hasn't uncovered any significant details about this issue. Additionally, the device logs indicate that the printer is unable to connect to the server.   Given recent changes in email policies by Google Workspace and Yahoo, I'll investigate the potential impact of these updates on the scan to mail service. ... View more

I removed all restrictions to see if there was any rule blocking the flow, but unfortunately, that didn't resolve the issue. I have doubts that it's related to a problem with the firmware version. ... View more

The email service is on the Cloud ... View more

Hello,   Could you try this solution, which might help you:   https://developer.cisco.com/codeexchange/github/repo/baadrdeen/Meraki_vpn_hub_updater     ... View more

Hello,   For your migration challenge, I propose two solutions without relying on third-party VPN peers:   1. Dynamic Routing Solution: - Implement OSPF or eBGP between the L3 device, old MX, and new MX at the hub. - Configure the L3 device to redistribute routes, ensuring both MXs are aware of each other's subnets. - As spokes are migrated, the new MX dynamically advertises updated subnets to the L3 device, maintaining seamless connectivity.   2. Static Routing Alternative: - Place the old and new MXs in the same VLAN for direct communication. - On the new MX, create a summary route pointing to the old MX to handle traffic for all spokes, adjusting the metric accordingly. - As spokes are migrated, add specific static routes on the old MX for corresponding subnets, directing traffic to the new MX. - Document routing changes thoroughly, communicate adjustments to the team, and regularly test connectivity during the migration. - Once all sites are migrated, remove the summary route and unnecessary static routes from the old MX to complete the transition. I think those solutions ensure a controlled and organized migration process without relying on external  VPN peers.   Feel free to ask if I overlook something! ... View more

I completely agree with you. It would be highly beneficial to have a pre-production environment that replicates the production environment, allowing us to thoroughly test our configurations and pipelines. ... View more

Hello,   Regarding your query, here's a breakdown:   Option 1 is recommended If your priority is simplicity and your use case is straightforward, and it provides a more streamlined approach with fewer rules. Option 2 is recommended if you require more granular control over different subnets and ports or if your security policy necessitates distinct treatment for each combination. It allows for a more detailed and specific rule set tailored to specific scenarios.   The optimal choice depends on the specific security policies and requirements of your network. Please let me know if this information addresses your question. ... View more

Hello,   I believe you are seeking documentation on the creation of switch port profiles and the assignment of these profiles to specific switches:   Switch port profile: https://developer.cisco.com/meraki/api/get-organization-config-template-switch-profiles/   Assignment of the profile: https://developer.cisco.com/meraki/api/update-device/   Please let me know if the information I provided aligns with what you are looking for.     ... View more

Hello,   SD-WAN Policies : https://developer.cisco.com/meraki/api/get-network-appliance-traffic-shaping Threat Protection : I'm unsure if we have existing endpoints for threat protection ... View more

Could you please provide additional information regarding the deployed topology? How the AWS and the SRX are connected ? ... View more