Hi,   Firewall rules on MR Series Access Points and MX Series Security Appliances are processed in a top down fashion, with Layer 3 rules being processed, followed by Layer 7 rules. Unless traffic is explicitly blocked by at least one rule, it will be allowed through by a default allow all rule.    Please find the below-mentioned document, This explains how the rules will be processed on MXs and MRs respectively.   https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Layer_3_and_7_Firewall_Processing_Order   Cheers!   Raj ... View more

Hi @Tudor_Butiulca, So, the Meraki APs will only push the splash page to the client when they see HTTP traffic coming from the client device. It is possible that on windows 8.1 and windows 10, Microsoft has introduced a to send HTTP traffic by default to trigger the splash page which might be missing in Windows 7. A packet capture will confirm this behavior.   I did a bit more research and it seems like Windows does indeed check a Microsoft site for connectivity, using the Network Connectivity Status Indicator site (NCSI). There are a few variations of the connection checking process:   NCSI performs a DNS lookup on www.msftncsi.com, then requests http://www.msftncsi.com/ncsi.txt (HTTP file). This file is a plain-text file and contains only the text Microsoft NCSI.    I would recommend to take a packet capture and see if the NCSI packets are being sent by the windows 7 device and if so, we need to further investigate on the Meraki side. If the windows device is not sending those packets, we might want to check what service pack is being used and make sure it is up to date and check what is breaking it.   Cheers!   Raj ... View more

Hello,   You are looking at the right place to configure radius accounting. However, at this time, there is a known issue happening to cause the radius accounting option not to be displayed on the dashboard. Our developers are aware of this and working towards a resolution.    If you have already configured radius accounting, the config will stay with the APs and they will work as expected, it is just not displayed on the dashboard but if you are looking to configure accounting for the first time, I am afraid, we might have to wait for a resolution.   Please open a ticket with Meraki support so that we can track the progress of the bug and keep you updated when it is resolved.   Cheers!   Raj ... View more

@Printen-IT Got you. If we are not using a splash page, I do not think we can do anything from the Meraki side to proactively trigger the end clients when using radius authentication as the APs will act merely as bridges in between the authentication server and supplicant.    One thing you can consider is creating a separate SSID for the phones with something like centralized web authentication with ISE or even do a sign-on splash page with AD authentication so that we can set the splash page frequency to match the credential refresh period so that the clients will re-authenticate. ... View more

Are you using splash page with AD authentication? If so, what is the splash frequency set to? If you set the splash frequency to correlate around the same when the customer's authentication will expire, The AP will try re-authenticating the clients. If the s[plash page frequency is set to a greater time than 90 days, the AP will not prompt the client to proactively re-authenticate as from APs point their previous auth session is still valid. Let me know if this helps.   Cheers!   Raj ... View more

In terms of policy application, there should be no difference between an MX and an MR, however as mentioned by @ww, you will get to restrict the traffic going to/coming from certain countries when you have adv sec license.    I would still prefer to have an MX to do all the cool stuff like content filtering, AMP/IDS to keep you more secure which a router can't do but if you are only looking for layer 7 policy application, then yes, you will do just fine with an MR and a router.   Cheers!   Raj ... View more

Unfortunately, this is not available as of yet. Please go ahead and leverage the "Make a Wish" button on your dashboard to submit your feedback. This would be really useful and we might come up with a feature like this.   Cheers!   Raj ... View more

Hey guys,   I want to keep you all updated on this. I checked with our team and it seems like our developers are looking into this and there are no updates available at this moment. @Richard_W  we are sorry for any inconvenience you might be going through, please give us some time while we work on this and the support engineer you are working with will get back to you once an update is available. Thank you for your cooperation.   Best regards,   Raj  ... View more

@joshbennettjtb Please check with your account manager if they can make any such adjustment. They should be able to guide in the right direction.   Cheers! Raj ... View more

@Felippe Is the issue reproducible on demand? if so, I would recommend taking a packet capture on the wired port of the AP. Take a not of the time you got disconnect from wifi calling and check the frames for that particular time. This will give you some visibility if it is the AP or the router.   I suspect the issue is with the router but the packet capture will confirm the behavior.   cheers!   Raj ... View more

I was doing some digging into the logs we are seeing in the MacBook and it seems like we will see such failures when there are NAT issues between the client and the server (MX). What kind of modem are you using at home? Can you please verify if it is not doing any sort of weirdness with NAT? Also, When connecting from the windows computer and from the IOS devices were you using the same ISP? If no, can you use the cellular hotspot (The connection that is working for the IOS devices) and see if that will make any difference?    Cheers!   Raj ... View more

  I do not see any issues with using an Omni on a 2.4Ghz and a directional/semi-directional antenna on a 5 Ghz band as long as we are connecting the antenna cables in the correct ports. So, the sector antenna is a directional antenna which will be best served for the PTP and PTMP links. If you want a flashlight kind of coverage, a patch antenna will be the best one to go with.   Cheers!   Raj     ... View more

@KevinH From the MX on-premises, are you advertising the client VPN subnet into VPN? This needs to be done under the "Security & SD-WAN > Site-to-site VPN configuration" page. You need to select yes for use vpn column for the client VPN subnet. Once you do that, you should be able to connect to the Amazon resources from client VPN as you are doing it from the local hosts at the MX site.   Cheers!   Raj ... View more

Hello @Dave2000 I am sorry to hear that. Is it the same update that is getting blocked again? Would you mind opening a support ticket for further investigation?    Cheers!   Raj ... View more

Here are the MTBF values:   MX67: 515,646 MX67W: 268,886 MX100: 389,000 MX250: 336,800 MX450: 336,800   Cheers!   Raj ... View more

At this moment. This is only in regards to Microsoft updates. Please open a ticket with Meraki support if you are also having issues with Adobe files for further investigation.   Thanks and regards!   Raj     ... View more

At this moment. This is only in regards to Microsoft updates. Please open a ticket with meraki support if you are also having issues with Adobe files for further investigation.   Thanks and regards!   Raj     ... View more

I second @PhilipDAth answer here. Easy way to separate the network from the existing organization along with the licenses and also the best way if they want to keep most of the configurations as it is.   However, if the new owners want to start from scratch and don't want to do anything with your configurations, It is easier to create a new organization and transfer the equipment and the licenses. Starting from scratch would be a better approach if they have to change too many settings from your existing configurations.   Cheers!   Raj ... View more

@jappling You can move the license from the existing org to the new org as long as you have admin rights on both the organizations. This move needs to be done by Meraki support though.   So, either you or someone who has organization admin access on both the organizations call into support, there should be no issues moving the license as long as the license is valid.   Cheers!    Raj ... View more

@antienhe  Just a safety precaution, please make sure to mask out sensitive information like API key or network IDs in the public forum for security purpose. This information is sensitive and can easily be misused.   Cheers!   Raj ... View more

@GIdenJoe I will try to get this feedback up on my side, but the best way to approach is via "Make a wish" as that will go directly to our product team.    Meanwhile, One way you can try to achieve this is by leveraging flow preferences. We can play with the option a little to mould the outgoing traffic on interested interfaces based on the requirement.   Cheers!   Raj ... View more

@CptnCrnch That is a good observation. I have never tried this but I feel like cellular kind of assumes itself as the secondary uplink during the time of failover. Can you try enabling No-NAT only on the primary uplink and see if that makes any difference to this behavior?   Cheers!   Raj ... View more

I would expect the wall rotation to serve as a refresher but I have not tested this either. refresh plug-ins are what I generally. I would also keep an eye on the RAM time to time just to make sure the browser is not spiking and crashing it   Cheers!   Raj. ... View more