There is an option in the wireless access control settings where you can enable group policies by device type. So for example, you can block Android phones from connecting to that specific SSID if you wanted to. I will warn you that this can be problematic with apple devices as they occasionally have false positives where it thinks an apple macbook pro is an iphone, and blocks it. which requires you to set the policy back to normal. If you use EAP-TLS for the SSID for school owned devices, then you wouldn't have to worry about AD credentials and false positives. BYOD devices simply won't be able to connect as they won't have the certificate. However certs can also be a hassle to deal with (at the start anyhow). If your radius is configured for AD credentials vs machine authentication, then a teacher could use their AD credentials on their personal phone and connect. If you set it to machine authentication then the computers that are in your AD would be the only ones that 'should' be able to connect. Using a PSK for BYOD stuff turns into a monster after a while. Especially if your cycling the password every now and then. In reality its really not going to be 'secure' in the sense that it would probably take little to no effort for someone on school grounds to obtain whatever the password is via social engineering, reading the paper taped to the wall that tells everyone what the password is etc. This is something you'll need to decide of course, how difficult/easy you want it to be for end users. Easier solution for BYOD gear is to just create a guest SSID and leave it open. Lock it down of course so there is no L2 or L3 peer to peer communications. No LAN access. Strictly internet only. This makes it super easy for anyone to connect and you don't have to worry about it anymore. ... View more

In your original spectrum android view, I could only see maybe 2 or 3 neighboring networks on the same channel. But as you can see, your access point can see many more (and I would imagine its more if you expand the list). So there is a good deal of competition for channel 6 alone, no way of knowing for sure how much contention there is channel utilization wise. The built in spectrum tool gives you an 'idea' but my experiences with it have been lack luster so I tend not to believe everything it shows me. It's possible that with all the CCI your seeing, there simply isnt' much you can do to improve it, other than move to 5GHz. However, I case this is the bug i'm referring to earlier with specifically the MR34 model and 2.4GHz throughput issues, I would say swap out the AP with a different model (or just place one on a desk nearby and test). Or contact support, have them downgrade to 24.12 and try again. That will confirm if its the environment, or firmware issue. ... View more

@BrandonS   For some reason I didn't realize that you had two ISP providers. Thought we were talking just one here. If your only using 1 switch, then each MX should only have one connection (since they don't support LACP).   The diagram your showing is if you had two switches.   You don't need a specific VLAN for warm spare. By default the VRRP packets are sent out on all vlans.   Each ISP would need to give you 3 IP addresses (this is only done by giving you a /29)   As for the edge switch between your ISP and your MX, I believe this will be needed unless they are able to hand you 2 uplinks from their side for each ISP.   You can use your core switch for this too if you want. Via that diagram from https://www.willette.works/mx-warm-spare/         Keep in mind doing this now makes that switch a single point of failure.   As for the vIP, if you get a /29, you actually get 5 usable IP addresses. So you use two of them for each MX and then one for the vIP, entirely up to you.   As for your client-VPN, if ISP 1 goes down, even using the vIP, then I would imagine you lose your client-VPN even though ISP 2 is alive. Maybe @jdsilva knows if that DDNS he mentioned earlier solves this? ... View more

@jdsilva I wasn't aware of the DDNS to get around not being able to use vIP. Good to know 😃 ... View more

Pretty sure that you'll need to have the Advanced Security licenses on the spoke MX appliances in order to get those features. ... View more

"Virtual MX is a virtual instance of a Meraki security appliance, dedicated specifically to providing the simple configuration benefits of site-to-site Auto VPN for customers running or migrating IT services to an Amazon Web Services or Microsoft Azure Virtual Private Cloud (VPC)." So you basically would want to apply any of your IPS/AMP/L3/L7 policies/rules at the SPOKE (say an MX65 at a remote site) where as the vMX would be your HUB to simply terminate the vpn tunnels. ... View more

The only thing I can think of is going to Organization>Summary Report Set it to Entire Organization and you can see the last 30 days. Not as granular but I believe this is the only option we have currently. ... View more

Fairly certain that those functions are not included with the vMX, its strictly an Auto-VPN concentrator ... View more

Go to Wireless>RF Spectrum Click the AP in question and then click the Interfering APs tab and see what your results are. Your client perspective might be very different from your AP's. Its also very possible that there is a good amount of non-wifi interference. The built-in AP spectrum analyzer in my experience isn't the most reliable, so your probably not going to be seeing everything that is really going on. If you remove the throughput limit, what results do you get? Even though you only have a few clients on that AP, there could be so much going on near you on 2.4GHz that its just not reliable. The escape route as @PhilipDAth mentioned is to get on 5GHz if possible. With all that being said - I will mention that I know someone else was also having specific throughput issues with the MR34 on 2.4GHz radio. What firmware are you running? I would ask support to change that specific AP to 24.12 and then run the test again and see what you get in case this is the same issue. ... View more

The only API that exists for updating an SSID is as follows:   { "name": "SSID_NAME_HERE", "enabled": false, "splashPage": "None", "perClientBandwidthLimitUp": 0, "perClientBandwidthLimitDown": 0, "ssidAdminAccessible": false, "ipAssignmentMode": "NAT mode", "authMode": "open" }   However, I know there are more options because when I GET for any specific network I have, the results yield many more options.   Example of a WPA2-Enterprise network:   { "number": 0, "name": "TESTING_123", "enabled": true, "splashPage": "None", "ssidAdminAccessible": false, "authMode": "8021x-radius", "encryptionMode": "wpa-eap", "wpaEncryptionMode": "WPA2 only", "radiusServers": [ { "host": "10.10.10.10", "port": 1812 }, { "host": "10.10.10.11", "port": 1812 } ], "radiusAccountingEnabled": true, "radiusAccountingServers": [ { "host": "10.10.10.10", "port": 1813 }, { "host": "10.10.10.11", "port": 1813 } ], "radiusCoaEnabled": false, "radiusAttributeForGroupPolicies": "Filter-Id", "radiusFailoverPolicy": null, "radiusLoadBalancingPolicy": null, "ipAssignmentMode": "Bridge mode", "useVlanTagging": true, "defaultVlanId": 208, "radiusOverride": false, "minBitrate": 24, "bandSelection": "5 GHz band only", "perClientBandwidthLimitUp": 0, "perClientBandwidthLimitDown": 0 },     So I just tested this on an SSID that has Visibility set to 'Advertise this SSID publicly'   And I got these results:   { "number": 3, "name": "TEST", "enabled": true, "splashPage": "None", "ssidAdminAccessible": false, "authMode": "psk", "psk": "testing1234", "encryptionMode": "wpa", "wpaEncryptionMode": "WPA2 only", "ipAssignmentMode": "NAT mode", "minBitrate": 6, "bandSelection": "5 GHz band only", "perClientBandwidthLimitUp": 0, "perClientBandwidthLimitDown": 0 },     So then I changed it to 'Hide this SSID'   I don't see any change in the GET unfortunately.   The Meraki API is very much still a work in progress, and they are updating it overtime but it is still lacking very much.   ... View more

Assuming you don't have any custom RF profiles.   Then follow the below   ... View more

Can you ping 'past' the MX ?   Not familiar with the vMX, but juuuuuuuuust in case its something this simple.   Firewalls don't usually let you ping them, so in case that is the issue.   Check this? Maybe try adding the 10.140.2.0/24 into this list and try again.       ... View more

@jdsilva "You can set the SNMP server to receive Traps on the Network-wide > Alerts page". I was wondering what you were talking about and then I found this: https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration "Contact Meraki Support to have the feature enabled on the desired organization." Why wouldn't they just enable this by default aaaargg. ... View more

I'm fairly certain that the reason why its showing up as a rogue is because its being 'seen on LAN'. That is the 'trigger' for it being there. As for the 184 part, if you click on that entry it will expand so you can see what the entire list is. A good chuck will be your own Meraki gear. I see 239 'other ssid' in my building, all the neighboring networks etc., people driving by with hotspots. But at the top is HIDDEN showing 309. Also on all the channels. Granted my list is sitting in the Other SSID column, not Rogue, but I think because you have all that other existing gear on your network its all adding up. The things I worry about are when I see an actual rogue on the LAN, and if there is someone spoofing. Otherwise I'm not sure if I would worry too much about what your seeing with the hidden portion. ... View more

Air Marshal is a little buggy in the sense that if a mobile device like an Android or iPhone connects to your wireless, then disconnects, and starts to broadcast its own internal HotSpot, it will show it as a rogue 'seen on LAN'. Obviously its not true. However, the mac address 02:9f:c2 matches Ubiquiti gear. The fact that it is showing it on VLAN 172, to me at least, means you have old Ubiquiti gear on your network. I would very much look into tracking these down if those are no longer in use. Its very possible that your clients still have configurations for that old gear and they are flip flopping between the old network and the new. The signal seems VERY strong, so they should be very close to your Meraki gear (within like 15 feet I would say). ... View more

Even if you could (which you can't with Meraki), why would you want to if you don't mind me asking. It's usually never a good idea to do this, even on a cisco WLC. ... View more

Do you mean syslog? Syslog requires that you configure an IP, but SNMP simply uses the community string and then you poll it from a remote device (like solarwinds etc.). You can lock it down with firewall rules if you want to make it more secure though. ... View more

Easiest and only solution that I can think of is to tie each SSID to a TAG.   So if you have three SSIDs, create a unique TAG for each one.   Then under SSID Availability, change the Per-AP Availability so that the SSID is only enabled on 'some' and not 'all' by default.   Then insert the tag you want to use.   Then on the access point view, remove the tags from the AP and it won't broadcast any. ... View more

Which specific setting are you trying to save? The same button will say 'Update' if its for ports. Otherwise the save icon usually appears if you scroll all the way down. ... View more

Yea that 'force to upgrade' thing I'm not a fan of. Now your forced to push it out 30 days, and then set a calendar reminder 5 days before, to push it out another 30 days. Over and over. They should send an email that states they recommend we upgrade, not actually force it. Grrr ... View more

@Asavoy Ah ok well that sucks. Sorry your having trouble that is indeed firmware related based on what your saying. If you could, I would say maybe try to get the last train of the 24.X code on the MR34's (you'd have to have support do this now as I don't think its available anymore, and they might even say no actually. Not sure). When I moved my super old MR16 and MR18 to 25.X they started having big issues, rebooting randomly etc. I'm lucky enough that I phased them out with new MR33 but not everyone has that luxury. ... View more

@Asavoy Sorry I probably misunderstood. I thought you were saying that Meraki as a vendor couldn't handle more than 3 SSID's. They can, but what your referencing isn't them saying you can't. It's them saying you shouldn't, which are two different things. You COULD use all 15 SSIDs, but best bet is your wireless will start to suck. SSID overhead can become a problem when you start to go over like 5 SSID's, which is why we recommend 4 or even better 3, or ever more betterer less lol. Each SSID will send a beacon, that beacon consumes airtime. The more you have, the more management overhead you have. That applies to the 802.11 protocol, not any specific vendor. Same rules apply even if you have Cisco/Aruba etc. To visually see what I'm referencing, see some of the links below. http://www.revolutionwifi.net/revolutionwifi/p/ssid-overhead-calculator.html http://wifinigel.blogspot.com/2013/08/its-well-known-rule-of-thumb-when.html As for the firmware versions for each product train, I feel you trust me. However to be fair, any vendor will have bugs in their code. Cisco specifically over the last year or two has been pretty bad at doing any QA before releasing code versions for their WLCs. No vendor is perfect =( Also, the 2.4GHz band your talking about only getting 3-10Mbps. That is going to be 100% on the environment, possibly configuration but doubtful since you sound like you know what your doing. I can max out my Meraki 2.4GHz radio no issues. But I have had an office in a big city that gets less than 2Mbps on 2.4GHz. Had this with Cisco, had the same with Meraki. Not Meraki's fault that the wireless in that specific environment is terrible with interference, other neighbors. Its a giant mess, which is why I do my best to get away from 2.4GHz when I can. Just too crowded sometimes. I force any production SSID to 5GHz only when I can. For your 2.4 issue I would do some spectrum analysis, how many other networks do you have in the environment. What kind of interference is causing the problem. Is it CCI/ACI, wireless, non-wireless etc. ... View more

@Asavoy I'm with you on wanting the ability to delete them to clean things up. That is why I mentioned the renaming because it will at least hide them. I'm not sure what you mean about it won't work properly with 3 or more SSID's. Are you running into a bug? ... View more