Given the intermittent nature and the fact that it's random clients and not even all clients at site, this is going to be hard to track down. Do your VDI clients or servers have any logs that indicate what the issue is? I could see perhaps it being a utilization issue at the sites where it's happening and it just happens that the client in question is the one getting dropped. Are your vdi clients capable of doing testing of any sort when the issue occurs like pings, traceroutes, etc? For monitoring and historical information on utilization, I'd recommend something that monitors with SNMP. IMO, Outside of the live uplink monitor at the exact moment of the problem it's harder to track down historical utilization issues with the dashboard. Something else you could do is setup traffic shaping for the VDI services to try and prevent drops: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/SD-WAN_and_Traffic_Shaping
... View more