Hello Everyone,   We've been dealing with lots of QOS issues to our remote workers.  I am down multiple rabbit holes trying to figure out a means to gain more stability in the connection.  I have my ISP involved as I believe it is the ISP.  The end users who is remote are typically customer support folks on the phones. They will let us know their connection to the phone system indicates it dropped or they lose a call etc.  When this happens we are noticing in many cases the primary uplink is changing. We've also noticed our uplink statistics show small packet loss .5, .8,1,1.5,2.  This morning I have seem 8 instances of packet loss.  We were measuring to 1.1.1.1 and 8.8.8.8 but have since change it to our ISP's gateway and Umbrella's DNS. Called Meraki 3 times and said they believe i need to get in contact with the ISP to run tests on our circuit.  That was scheduled last night but have not head back from them yet.   One thing I've noticed is our uplinks are not load balanced and I asked my manager why and he said they never enabled it because our primary uplink is a 500mbps circuit and secondary is 70mbps with burstable options.  The circuit that has been the problems for us is the 500mbps.  There is no saturation of the link, it is under utilized.  Also the change over from primary to secondary is so quick, that I wish that it wouldn't switch over because i wonder if it would at least keep our phone calls and VOIP server established and just create a little bit of noise on the line. ... View more

Good Morning,   This should be a straight forward question.  We have been using Client VPN with IPsec Settings configured and users are using Windows Always On VPN and is using its own subnet.  We have a desire to get AnyConnect working while our users still use the Always On VPN.  When I go to enable AnyConnect, it asks for a subnet.  Do i have to create a new subnet or can I use the same subnet our traditional VPN has been using?   Thanks! ... View more

Probably a simple question so here goes.  We just configured a site to block everything except the US and Canada and learned that a specific IP in Australia needs to be allowed.  As a quick fix, I added Australia as an allowed country.  How would I go about prohibiting Australia but allowing a single IP from the country? ... View more

Hello! We have Client VPN setup successfully on our primary MX at one site using the L2TP over IPsec configuration. It points to a Windows Server using NPS.  I am looking at duplicating that same scenario at our secondary site.  I essentially copied our current configuration with the exception of changing the host name and deployed it to my windows machine. When i attempt to connect, Windows prompts for credentials, but eventually gives me an error, "The remote connection was denied because the username and password combination you provided is not recognized or the selected authentication protocol is not permitted on the remote access server."  I do see these errors in Meraki:    Jun 15 11:23:44   Non-Meraki / Client VPN Non-Meraki / Client VPN negotiation msg: <l2tp-over-ipsec-1|998> deleting IKE_SA l2tp-over-ipsec-1[998] between 175.165.112.219[165.166.112.219]...61.85.127.191[172.30.20.12] Jun 15 11:23:44     Non-Meraki / Client VPN Non-Meraki / Client VPN negotiation msg: <l2tp-over-ipsec-1|998> closing CHILD_SA net-1{1482} with SPIs ca095fa1(inbound) (947 bytes) 5a2f103c(outbound) (666 bytes) and TS 175.165.112.219/32[udp/l2f] === 61.85.127.191/32[udp/l2f] Jun 15 11:23:10     Non-Meraki / Client VPN Non-Meraki / Client VPN negotiation msg: <l2tp-over-ipsec-1|998> CHILD_SA net-1{1482} established with SPIs ca095fa1(inbound) 5a2f103c(outbound) and TS 175.165.112.219/32[udp/l2f] === 61.85.127.191/32[udp/l2f] Jun 15 11:23:10     Non-Meraki / Client VPN Non-Meraki / Client VPN negotiation msg: <l2tp-over-ipsec-1|998> IKE_SA l2tp-over-ipsec-1[998] established between 175.165.112.219[175.165.112.219]...61.85.127.191[172.30.20.12]   Things I have done or not done. I have looked in the Radius log and do not see the it receiving the authentication request. I have confirmed that the VPN adapter in Windows is set like my primary to Allow the 3 protocols listed on the Security tab, including PAP.  I checked the registry setting on my computer for AssumeUDPEncapsulationContextOnSendRule but again, if it works for the primary, i would think i would not need to verify this. I have NOT configured anything new on my NPS server, do I need to add this new MX as a Radius client? One aspect of the primary config that confuses me is that on the Windows NPS server, under Radius Clients, the Meraki setup shows the IP of the Radius server and not the IP of the MX.  This document outlines the need to add the IP of the MX: https://documentation.meraki.com/MX/Client_VPN/Configuring_RADIUS_Authentication_with_Client_VPN   I know I must be missing something simple.  I appreciate any assistance provided.  Thank you.   ... View more

Hello Everyone,   Should be a quick question, our primary MX is setup and operational.  We want to setup the warm spare MX.  It's been in the rack for some time now and not powered on.  What kind of set up should I do before setting it as a warm spare?  I am feeling like the spare needs to have an uplink prior to going through the warm spare configuration process. Thanks for the input. ... View more