Thank you @PhilipDAth and EveryONE! I feel honoured and just want to do much more! ... View more

Yes, @Knowguy . That discussion is more complete. Firmware 18.211.3 don't fix this behaviour. @Tishman , feel free to post over there. ... View more

Hi @MarcW ,   Sounds like your non-Meraki peer is turning the tunnels off due to no activity.   Meraki devices send special DPD vpn packets to keep the tunnels alive when there's no traffic. However, not all VPN peers reply to DPD.   Therefore, the best way to keep site-to-site tunnels UP is generating interesting traffic - e.g.: a continuous ping from a host inside a local subnet into a destination at the other side. ... View more

Hi @BradSp    Thanks for updating us and sharing your screenshot. I'm sorry to hear that the Network Support Engineer didn't fully understand the problem you reported.   IMHO, this looks to be a dashboard delay. If the dashboard showed a different neighbour AP list and column "Last Seen" have less than 12 hours at the moment you called Support; then there might be a dashboard delay worthy investigating.   Please, send a feedback using the "Give Feedback" at the bottom right-hand corner of your Dashboard. Recommend informing the support case number as well.    Once you report this dashboard delay behaviour using the "Give Feedback" bubble, our Internal Team will process your feedback and work on it.     ... View more

Hi @RaphaelL ,   Thanks for bringing this up! I'm working with Internal Teams to get it done.   We'll update everyone here in this thread when We finish. ... View more

Hi @BradSp ,   Thanks for bringing this up.   I checked my own lab at home and Air Marshal is showing my neighbours. I've never seen 12hs delay to update the dashboard.   Perhaps you can benefit more if you open a Support case.     ... View more

Hi, thanks for checking.   If it is random, maybe it is related to firmware.   Perhaps you can try latest patch in version 18.211.3. I hope you can also upgrade your non-Meraki VPN peer.   Have you checked firmware? ... View more

Hello @Tishman    Based on what you said, I suspect your Trafic Selectors (TS ; a.k.a. encryption domain) don't match exactly.   I.e.: MX side may have a /24 subnet while the other side has a /25 ; so it works if the other side initiates because MX TS is like a summary route. On the other hand, MX initiating doesn't work because the other side has a /25 more specific TS.   You may want to double-check with the network admin at the other side and make sure both sides are configured with the exact subnets as traffic selector (TS).     ... View more

Hi @Barrowcuda    I believe you will benefit more from Meraki Network Support at this point.   Perhaps there is something We both are missing in your network topology. ... View more

Hi @Barrowcuda ,   It looks like there's a VLAN double tagging issue if you configure your Network Wide Config as "Wired clients behave as if connected to Voice VLAN".   I suspect your AP is already bridging its own LAN port to SSID Voice which is bound to VLAN269. So when it sends packets from the phone, it will forward to trunk port and add VLAN269 tag as if it came from a truly wifi client.   What happens if you configure as "Have no access"?       ... View more

Welcome, my friend! It's never late to share some knowledge! ... View more

Hi @PhilipDAth , I tested and it works. But only if you have full tunnel. Split tunnel, naturally doesn't get traffic instection.   I think it is the same logic as Site-to-Site VPN in full tunnel. ... View more

Gracias @Raul_Sanchez_G    Este tema ya tiene una solución, que es mi primera respuesta. No creo que podamos cambiarla después de que esté marcada como solución.   Gracias de todos modos. Creo que los demás usuarios del foro entenderán que mi segunda respuesta es una consecuencia de la primera. ... View more

Sí, @Raul_Sanchez_G Háganos saber si necesita ayuda para configurar L2TP o el cliente VPN de Cisco AnyConnect. ... View more

You're Welcome! 🙂 ... View more

Hi there! Yes, please let us know what you found. ... View more

Hola @Raul_Sanchez_G    Gracias por sus comentarios positivos y por agregar más detalles.   El error en la captura de pantalla puede deberse a dos problemas comunes:   1) suele ocurrir cuando su usuario remoto está detrás de un dispositivo NAT que (por coincidencia) también está detrás de otro dispositivo NAT. Como resultado, este doble NAT interfiere con los puertos UDP IPSec y, luego, su MX no puede responder a su solicitud de conexión VPN.   Este problema lo presentan muchos proveedores de Internet que hacen lo que se denomina CGNAT.   La solución o solución alternativa para problemas de CGNAT como ese es migrar a una VPN de cliente basada en túnel TLS, como Cisco AnyConnect.     2) su MacOS está realizando una negociación IKEv2 que no es compatible con la VPN de cliente. IKEv2 solo es compatible con la VPN de sitio a sitio.   La solución aquí es configurar L2TP IPSec en su MacOS. Solo asegúrate de que la configuración de VPN de tu Mac OS esté usando L2TP. Puedes consultar los demás detalles de configuración en la documentación del producto. Recomiendo leer los siguientes artículos:   Meraki Client VPN - Configuración de MacOS Apple MacOS - Configurar una VPN ... View more

That's great news @BlakeRichardson !   The "Give your feedback" button in the dashboard works. It may take some time, but new features often come from people that took the time to do a Feature Request. ... View more

Hi @sbcoms ,   Nice plan! Only a small detail: you need to create and configure the Group Policies before creating iPSK groups.   I recommend reading this article as a reference. ... View more

Hi @Thiandanai ,   Are these devices connected by cable or wifi?   Did you check if the devices went to sleep or energy saving mode? ... View more

Hi @Holli69 ,   If you can't ping from C9300 to MX, maybe it's related to VLAN.   I'm assuming the IP 10.105.10.253 is not the C9300 management IP.   What are the port configurations in each case? a) MX port connecting to C9300? is it a Trunk or Access? VLANs? b) C9300 connecting to MX? is it a Trunk or Access? VLANs?  ... View more

Hi @omshiv ,   I recommend reading this Design Guide first so you can have a better idea of what you need to design your solution.   After understanding the components and design, do a quick search for SASE here in the community; maybe your question was already discussed. ... View more

Hi @Holli69 ,   It's like @KH said, We need to know more information.   I think this article can help you. Perhaps you forgot about having a transit vlan in your C9300 (vlan 50 in the example).   Remember that you cannot use management VLAN IP as the same IP in Transit VLAN interface.   ... View more

Good news, Everyone!   Both articles are now updated!   MS425 Overview and Specifications has a clarification about MTU value in the Dashboard.   Switch Settings has a new and improved MTU Settings section covering all.   Thank you, @RaphaelL ! Yes, I realised that while working in first article. This is why it took me longer than usual to publish updates. ... View more