top of page
Search

Meraki MX Site-to-Site Down: Event Log and Local Status Page When the Dashboard Is Green-ish

  • 4 days ago
  • 2 min read
Cisco Meraki network security troubleshooting lab
Cisco Meraki · Techclick CLI troubleshooting lab
Dashboard Auto VPN looks odd. Branch cannot reach HQ. The MX has internet for updates.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Cisco Meraki for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Internet for Meraki cloud is not the same as Auto VPN to HQ. Use the local status page and event log for VPN registration.

Why this ticket shows up

MX can reach dashboard on 7734/443 and still fail Auto VPN if UDP 500/4500 or the peer is wrong.

Symptoms operators actually see

  • Dashboard reachable, Auto VPN down

  • NAT-T issue

  • Warm spare failover leftover

  • Uplink load-balancing flaps the tunnel

CLI first — copy this block

Run these on the Cisco Meraki device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# on a PC behind MX
ping 10.0.0.1
tracert 10.0.0.1
nslookup mx-local-status
# MX local status page 127.0.0.1 / setup.meraki.com from LAN
# Event log: VPN registry / non-Meraki VPN

How to read that output

If you can ping 8.8.8.8 but not HQ, look at Auto VPN / non-Meraki VPN events, not the WAN.

Triage order

  1. Confirm WAN internet

  2. Read VPN events

  3. Check uplink IPs registered

  4. Fix NAT-T or peer IP

  5. Test a single subnet

Classic traps

What you see

Real cause

Fix

Factory reset the MX

Peer IP changed

Update the peer

Disable load balancing blindly

It may be the flap source — test first

Change with data

Build a Palo tunnel instead

Auto VPN may only need a registry refresh

Try that

Proof the ticket is closed

  • HQ ping works

  • Event log shows VPN up

  • Dashboard tunnel green

Say this in an interview

MX dashboard reachability is not Auto VPN. I split cloud control from site-to-site.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page