Is there a way to allow template access to users? Where a user can add/remove or move a network between templates?  ... View more

If only SecurePort was supported on MS120 family , that would solve your issue. ... View more

It was a pleasure to help you. Guys, just to let you know that I was helping @mcoomber  closely, one of the things that was missing was to create VLAN 30 on a 3850 switch that was between the MX and the MS. In addition, not all APs had the switch port configured for trunk, which was also causing the problem (this was confirmed by Meraki). So in short, it wasn't just about allowing VLAN 30 in the SSID and configuring trunk on the ports, it was still necessary to configure the VLAN on the Catalyst switch. ... View more

Also, I see the MX WAN interface resolving DNS when it is connected to the Internet, but not associated to a template/has no network config. ... View more

@NolanHerring We moved to 31.1.7 a week ago, 500+ AP's, MR33/36/44's - all seems OK so far ... View more

@RaphaelL Yes the painfully slow loading is getting very old. The fact you cant disable it under early access makes it worse, either give me the option to turn it off or disable the old version.  ... View more

Yeah between all the different types of power events and what the end users describe, it's likely what we are being told are power outages may not directly affect the devices I'm checking. UPS kept things up, partial outage, etc. I guess what I would say to OP given that is if the Meraki says it lost power it did, but if it doesn't it's doesn't mean there wasn't some sort of utility event. May or may not matter with what you are trying to monitor or correlate. ... View more

I think it's a private beta that is rolling out soon ... View more

Hey @JanJonsson , can you send me a direct message with the case number? I'll have a look 🙂    Giac ... View more

Yea... there are some... growing pains 😬 ... View more

I made the assessment that the overhead of managing specific firewall rules for Teams Room setups was really not worth the effort, so I just stuck them on an internet only network with very lax rules.   May not be the best idea but was enough for my scenarios. ... View more

When we downgraded back then, we downgraded back to 18.211.2.  Unfortunately, we're having huge issues with the 18.xxx firmware branch in regard to random reboots.  We're still working with support on the issues.  At the moment we've had to go all the way back to 15.xxx in order to gain stability.  We'll be upgrading to 18.211.5.2 soon to see if that has fixed anything. ... View more

Hi, there are a few caveats for using FQDN in L3 firewall rules:   The MX must see the client's DNS request and the server's response in order to learn the proper IP mapping. The communication between the client and DNS server cannot be intra-VLAN . Additionally, in some cases the client device may already have IP information about the web resource it is attempting to access. This could be due to the client having cached a previous DNS response, or a local DNS entry in a host file. The MX will not be able to block communications to the web resource in these cases. You should configure a L3 allow rule for DNS traffic, eg:                       this rule should be placed above the rule containing the FQDN. hope this helps!   ... View more

Update:   This seems to be a specific usecase, and only applies to "VPN concentrator" mode MX's with both internal/mpls as public connectivity. When it is a "VPN concentrator" to "VPN conecentrator" the VPN registry log shows always just the public "peer_contact" IP, even when the tunnel  is set up over private IP:   VPN tunnel connectivity change vpn_type: site-to-site, peer_contact: 217.x.x.x:42111, connectivity: true       When it is a spoke hub connection the VPN registry log shows the correct "peer_contact" as an private IP. VPN tunnel connectivity change vpn_type: site-to-site, peer_contact: 10.3.x.x:42111, connectivity: true     Regards, Frank ... View more

Hey, Was this resolved for you. We have been experiencing this for months and cannot find a fix. ... View more

Well I didn't know that, thanks for that nugget @RaphaelL  ... View more

Thank you. I understand what you are saying but the elements needed to track a bug we are hitting in the MR code is only easily seen/noted in the Connection Log data -> Failure Reason text.  We can correlate it to some event logs but when doing that we get a ton of false positives.   The actual data/text from Connection Log data -> Failure Reason so far is the only place where the data is available.   Same with the "Failure stage" = Association.  Basing on just this information doesn't fulfill the need and we get a ton of false positives again. Example date: Failure stage: Association Failure Reason: auth_mode='wpa2-psk' 11k='0' 11v='0' ft='1' reason='invalid_pmkid' radio='0' vap='5' channel='11' rssi='51' ... View more

Hi ,   Deny LAN won't deny access to the Internet. If you have a MX and MR , I would put the rules on the MX.   1- Deny LAN on the MR  2- Deny RFC1918 on the MX  3- Allow "internet" on the MX    That is how we have our Guest SSID configured. ... View more

thank you! ... View more

Just to add to the answer provided by cmr :  MX devices running MX 19+ firmware, MS devices running MS 17+ firmware and MS390/Catalyst devices running CS 17+ firmware will use the username admin and the password will be the serial number (Cloud ID) of the device (upper case letters and dashes).  All devices running other firmware versions will use the serial number (Cloud ID) of the device (upper case letters and dashes) as the username with no password.   https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page ... View more

Hi @RaphaelL! I wanted to follow up regarding this as I have some new information. I was able to confirm with our development team that they have observed unexpected behavior with AI-RMM on networks that are bound to templates. I have reached back out to the development team in hopes for them to provide some additional details regarding the unexpected behavior and will circle back here when I get an update. With that said, we currently can't recommend using using Busy hour for any network that is bound to a template. ... View more

Lets hope it doesnt trigger ids bug.   @Hannah-C @Port range "1024-400"  should be 4000? ... View more