Welcome to the Meraki Community @DGXSecurity  ... View more

Using Umbrella DNS should give you the built in security for the known bad or malicious sites - that constanly gets updated, but you would not be able to add your own without the Umbrella subscription, ... View more

You will have a hard time finding that kind of info here. Best suggestion would be to contact your SE or support directly ... View more

Based on the screenshot here: https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Amazon_Web_Services_(AWS) under Choose the EC2 Instance Type it may be 10gbs, but I suspect if you go into AWS you will be able to see if it's different by selecting the different SKU.   I don't use AWS so can't directly do myself. ... View more

You definitely do need an actual public IP. That can be accomplished by direct connection to the MX from your ISP or via 1 to 1 NAT and appropriate rules in an upstream firewall. vMXs and Concentrators are the most likely scenarios for the latter situation. There are also corner cases with some ISPs like Starlink operating things with CGNAT. Without your IP addresses we can't be certain if you are hitting any of these situations specifically.   The one other situation that may occur is your ISP blocking 443 upstream to you despite giving you a public IP. I've definitely seen things like that. You may need to check with them. The ones I've dealt with will usually disable that blocking on business accounts  upon request. I suggest a quick call to Meraki Support who can verify your connectivity vis-a-vis the IPs and verify if your Anyconnect traffic is making it to the MX. ... View more

Once "eBGP over non-Meraki site-to-site VPN connections" is configured on Hub MX, can those 3rd party prefixes/routes learned on MX Hub be propagated to other MX branches over Auto VPN?  ... View more

Click the ? in the upper right of the dashboard to see the various options. ... View more

Thanks Mloraditch... I didn't think of that. I'll have to do some testing.... ... View more

You must contact Meraki Support. See first question here: https://documentation.meraki.com/MS/Deployment_Guides/FAQs_Migrate_to_Meraki_management_mode#After_Migration ... View more

DM sent! ... View more

An still the "Switch stacks will learn MAC addresses from ports in the STP blocking state which can trigger a constant flood of MAC flaps in the event log" that has been there for ages ??? ... View more

If you're using a cloud based radius having a few failed auth's in between happens quite alot.  It's best to look at the logs of your radius service to see why it rejected that auth. ... View more

Another Source of Deployment  https://learningnetwork.cisco.com/s/article/meraki-starlink-deployment-guide  ... View more

You want to use the "Optimal Gateway Selection" feature in AnyConnect.  It causes it to connect to the fastest (which usually means closest) responding VPN head end. https://community.cisco.com/t5/security-knowledge-base/anyconnect-optimal-gateway-selection-operation/ta-p/3124296   ... View more

@cmr yes, you are right.  I had a brain bubbu.... I will edit my answer to make it clear. ... View more

It requires you to buy Cisco AnyConnect licences.  I think they are well priced for what you get ... ... View more

Good afternoon,   thank you for your support,   I had already called, we arrived to do some tests but it didn't work, regarding the DNS, I had already changed it to Google's 8.8.8.8 and it didn't work... ... View more

I'm sorry, I didn't mean add that info to the EA Menu. I meant the documentation article. It seems a note has been added that client vpn does not work period and that obviates a need for any screenshots, but it's not clear about regular Meraki or 3rd Party VPN. I see the line about the MX working if it initiates, but nothing saying you can or cannot add a rule to make remote initiation work. I'm presuming not as there is no way to create a rule for inbound traffic directed to the MX. As far as local initiation goes, are all Meraki VPNs covered by this or will some of them possibly not work either? Honestly, this feature seems like one of the ones that should remain gate kept.    ... View more

That is quite strange (a disappointment even ?) because the 9800 WLC uses the native Nextunnel for monitoring ever since 17.12.3.   But I can wait, and use the old "app" for putting switches into monitoring mode. I do have some customers that dont like that way , at all, and they are just waiting for the rest of the Catalyst switches to work like the C9800.   ... View more

I am not 100% confident that it would help as someone could get lost in the amount of text.   But here are my 20 cents (inflation) on this: I assume that this data is coming somehow from a database, and each entry is internally tagged to a software release and a model. In times of HTML5, I would like to have a button list at the top with all models where I can deselect all devices that are not important to me. These buttons could be preselected based on my inventory (either of the org or, which is likely more difficult, the inventory of all orgs the user has access to). ... View more

It could be that NPS is not responding which is the same net effect as a denial. There are also other NPS logs that may not be enabled for whatever reason which may help.   https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/troubleshoot-network-policy-server You can do a packet capture on the NPS server to make sure you are getting the radius traffic and if you are what responses are (or aren't) being sent. If the requests are getting to NPS and NPS isn't responding or is sending back denials you at least know you have a Microsoft side issue. If the packets are occasionally not getting to the server at all, may need to check along the traffic path to see where they may be dropped. ... View more

They will operate with their last good config, but its impossible to know the exact reason with just knowing they are offline.    Likely multiple somethings in this document are not working: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity   Could be vlan issues, could be firewall issues, could be routing. May be helpful to hook a laptop into the port the AP is using and seeing if you get dhcp and can get online and get to the internet in general. You may also be able to download logs from the local status page and provide them to Meraki support ... View more

It would cause problems during onboarding for Meraki management and possibly for Meraki monitoring as well.  However, it may well work once onboarded.  I was going to test exactly this in February, but the DHCP option issues stopped the testing before I got to modules.  Hopefully I'll be in a position to test it soonish as the native IOS-XE release might have fixes for the DHCP options... ... View more

Great! Hope it works for you, and glad to help. 😁 ... View more

any update  ... View more