Thank you @RaphaelL  ... View more

Thank you very much. The thing is that certain high usage clients are meant to be permitted so just trying to explore as many variables as I can in order to define the restriction most precisely ... View more

If you capture the Association, you can see it there in the RSNE-Block if the client uses 802.11r (small "r") which is shown with the AKM type 3. ... View more

Thanks for your help @RaphaelL ! ... View more

@RaphaelL congrats and a very warm welcome to the team! 😎 ... View more

Both are valid points. So the Access privilege options are based on the target network selected. When using the network tag to scope network(s), there will be only four default privileges, given different networks might contain different device types.    You are right about no API support for port management privilege setting.  And unfortunately, the Update an Administrator  endpoint currently does not support the custom access privilege either (in your case Packet_Capture) . I bet there is some good reasons for this, but it may be worth reaching out to your Meraki sales team and submitting a feature request to evaluate.    { "errors": [ "'access' must be one of: 'full', 'read-only', 'guest-ambassador' or 'monitor-only'" ] }   ... View more

Your core 425-16 appears to be connected to each MX250 using ports 15 & 16. The allowed VLAN list of those 2 ports don't exactly match. Maybe missing one of the new VLANs? I can't entirely tell from the change log what VLANs you added and where (on the MX or MS).   Also, it's against best practice to connect the MXs directly to each other. The concept of the heartbeat VLAN is basically not legit as VRRP is sent on all VLANs. So, you're sending it on VLAN 1111 between each MX, but it's also going over every other VLAN trunked to the downstream switch. Using a direct MX to MX link both provides no value and raises the potential of misconfigurations, loops, or dual master situations.   Also, with a network of this size (honestly any network) I would absolutely being using spanning tree.    One more question. Are you migrating the L3 interfaces from the MX to the MS? I'm not sure why you have all the same L3 VLANs on both the MX and MS vs using a transit network between MX and MS. ... View more

Happens to the best of us ! Glad you were able to find a solution !  ... View more

Updates: I upgraded the firewall firmware to 17.x and also switched over the ISP in this site. After that, VPN tunnel is up.. I suspect the previous primary ISP blocks IPSec or have a stricter network security (as I cannot ping my public IP either) and caused the issue.  ... View more

Were you able to find a solution to this?   ... View more

I really feel like I'm hitting  No DHCP response error is seen after a client performs a successful L3 roam (Wi-Fi 5 Wave 2 MRs/Wi-Fi 6 MRs)  on MR 28.6 But my SSID is in bridge mode. When clients are roaming , there is really often a no DHCP response error , but I don't see any DHCP trafic .    Investigating...  ... View more

Hi, no, unfortunately not what I am looking for - I need to be able to see to what switch profile a switch is associated without knowing the profile itself... Actually I think I have found a work-around but it looks very clumsy - several steps required to achieve a simple result. Will play with it today... ... View more

@RaphaelL nailed it. ... View more

I can't find any documentation on the developper page nor from the OpenAPISpec page.   I also saw some more like : Recent 802.1X failure , Poor connectivity  , but there is no documentation listing all the possible alerts.   This endpoint is not listed as 'Beta' but the feature in the dashboard is currently in beta...    ... View more

Excellent ! Glad I was able to shed some light on your issues 🙂  ... View more

Understand that when you NAT inbound traffic to a device the return traffic has to go back out the same Internet circuit.   To make this work, you would have to configure site B as a full tunnel VPN, so all of its Internet traffic went out the Internet circuit on site A. ... View more

Sorry for the confusion.    I need a EtherChannel between two stacks, and the link of EtherChannel on the different physical switches. I think you answer my question. Thank you!       ... View more

@RaphaelL yes exactly, when doing an inspect on that specific page we see there is a call on the dashboard link using the endpoint https://nxxx.meraki.com/o/xxxxxx/manage/support/firewall_configuration_json   We tried the same endpoint transforming it to https://api.meraki.com/organisations/:organisationId/manage/support/firewall_configuration_json and that is where we get the response {"mode":"login"} with status code 200.   Indeed it would be a great addition, in environments with very strict configurations (deny all by default inbound and outbound), we need to make constant manual checks and updates when required. ... View more

FWIW I'm noticing 29.1's proactive steering being more than just at association can cause a lot of client bouncing between APs if the AP steering is incorrect.   I have a space in my home where the AP strongly believes it's appropriate to steer to an upstairs AP, but the client sees that as -87dBm RSSI instead of -60 to the closest AP which happens to be more loaded. That takes throughput down from 400mbps to 90mbps and the client desperately wants to roam back to the primary AP. On 29.1 this is resulting in every 2-3 minutes trying to steer the client back to the other AP and the client being unhappy 30 seconds later and roaming back to the correct AP.   Just like before 29.x, I would highly highly recommend keeping band steering / client balancing OFF unless you notice issues with your clients. Modern Windows/Android/iOS clients are smart and look at the QBSS load element in the beacons to decide which AP is correct. AP-side steering is fraught with peril because how well the AP can hear the client may not correlate with how the client can hear the AP. ... View more

thanks    Lesson I have learnt today is read the API documentation properly ... View more

Hi ,   https://developer.cisco.com/meraki/api-v1/#!get-network-events  Is the endpoint that includes 'all' logs/Events from your network. On the dashboard it is : Network-Wide -> Event log   https://developer.cisco.com/meraki/api-v1/#!get-organization-devices-statuses Is a more detailed and noticeably new 'network health page'. It shows recent warnings on the network. Eg : CRC errors on ports , Recent 802.1X failures , recent dashboard connectivities issues. On the dashboard it is the 'bell' icon on the upper right of your screen when navigating in a Network :      Hope that helps ! ... View more

Is it confirmed that only MX16.16 contains the fix ? Not 15.44.3 or anything else  ... View more