For the network types it is simple: If you only use MS switches you could have a switch network, or if you only use an MX you can use a Security & SD-WAN network.  However if you have multiple devices types ex: MX, MS and MR in the same location you could choose to have a combined network where all device types are. The reason for choosing a combined network is to merge clienttracking and traffic info in one place.  However this does have implications on the use of group policy assignments. There are reasons why you would prefer to split up your network if there are L3 switches between your MX and MS or MR's in the access layer.  Because only MX can do client tracking via IP. https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Combined_Dashboard_Networks https://documentation.meraki.com/MX/Monitoring_and_Reporting/Client-Tracking_Options   Summary report should explain itself.  You can generate reports on an individual network (even if it is combined you can still get the wireless only or switch only info).  The fields can be chosen in the report and you can see the results by running one. ... View more

I have a question about your compliant and non-compliant DACL's.  I thought MS switches do not support DACL's only referenced group policy ACL's through Filter-ID. ... View more

I'm not going to fully highjack this post.  Gonna do another one perhaps with some graphics to thoroughly explain it. ... View more

I think the frame before that one should have the proposal flag on it. In RSTP and MSTP (which also uses RSTP as convergence mechanism) whenever there is a link that comes up or a change in the BPDU's coming from the root each switch will send the updated BPDU down it's designated ports while shutting those ports down.  The downstream bridge that has it's root port there must send an agreement back to open the port up again for forwarding. It will not do that on alternate ports so those ports stay blocked.   So it might be a needle in a haystack but somewhere in your network you probably have a non edge port that is flapping or more than 1 switch vying for root bridge status. ... View more

I wish 😉 I have a very weird issue between a pair of MX250's and two stacks of MS355-24X2's that is truly kicking my ass. For some weird reason whenever I add a new VLAN downstream of the MX'es forwarding to the active MX just stops and I even get RSTP topology changes until I remove both uplinks on the active MX250 and it fails over.  I haven't been able to zero in on the actual issue. ... View more

Usually the port config remains on the switch as long as the switch is in the same dashboard network.   You'll have to completely remove the stack and recreate it using the remaining members. Don't forget to remove the stacking links on those members. ... View more

It wouldn't hurt to run a longer packet capture to capture the actual BPDU's and see what is happening. The capture filter you need is: ether host 01:80:c2:00:00:00 ... View more

Traffic shaping in this way is more intended to be done on a Cisco router instead of an MX. The only way you can "some" control is use the 3 configurable queues (high medium low) and assign traffic from each source subnet to a specific queue.  But a true limit will only be done per flow. ... View more

Ouch that does not seem to be a good behavior for the algorithm ;). It is imperative that you don't mix your primary channels since that will cause alot of collisions.  Usually I keep the primary channel as the lowest one. ... View more

I agree, but the MA-ANT-27 is still wide enough (120º) while covering at least 90 meters depending of course how high it will be mounted over the buses since those buses will probably be quite formidable obstacles for the signal.   MA-ANT-25 does not provide much more coverage directionally than the MA-ANT-20 so in my experience the 27 is the best match for somewhat longer distances 60 - 100 meters. ... View more

Personally I don't really get the use case for the current iteration of port profiles since you can just use tags to organize your port types and keep them in sync with each other.  There are also a few features missing. ... View more

There is only 1 thing missing which I would really enjoy having is a form of intelligent capture.  So each association, re-association, 4-way handshake, 11v frames etc... is captured and can be downloaded for each client for at least a day coupled with a complete eventlog. This would make tshooting strange issues like clients suddenly being dropped or bad roams alot easier. ... View more

That's weird and shouldn't officially work. ... View more

Does hybrid connect router mode support port forwarding or DMZ host?  If so you could at least forward UDP/500 + 4500 to the IP of the MX (or vIP if you have an HA pair).  If the Azure gateway does not support customizing the remote IKE-ID you will have to set the local IKE ID on your Meraki VPN (using IKEv2) to your public IP. ... View more

As long as you don't have a circle of switches the outage should be quite minor.   RSTP reconverges by blocking the links between two switches while sending a proposal BPDU and the other switch should immediately send a response if it agrees. If you have a good star topology the outage should be minimal (less than 2 seconds).  If you have a circle you could experience a count to infinity issue where you go down for a while before the topology can resolve itself. ... View more

In a combined network with access points the GPO will be enforced on the AP which does not have the full possibility to have URL filtering like that.  In that case you will have to split up your network.   Or if the routing happens on the MX directly you could also force the clients on a different VLAN and then apply the GPO to the VLAN instead.  Then you can combine Wireless and MX on one network with the desired policies. ... View more

Hmm tough one.  If it's a single client it could be a driver issue.  However it would be a great idea to have an over the air capture at the location of that client on the channels of both AP's there and try to see when it decides to roam if anything precedes it. Some stuff that can precede it: - interference from something else - alot of retransmissions - 802.11v messages from the AP's to the client. ... View more

Also think of Meraki ACL's as VACL's, not RACL's as one would expect.  You also have a 128 ACE hard limit so you'll have to be quite coarse in your rules.   This hard limit is a reason to consider mixed environments where you have a Catalyst distribution pair of switches to allow for complexer ACL's and VRF support and keep the access switch Meraki to take advantage of the dashboard. ... View more

That makes perfect sense now 😉 ... View more

There are no 1 GB DAC cables.  The lowest speed any DAC cable exist is at 10 Gbps.  Since the MS120 series only has SFP it does not support the 10 Gbps needed for DAC cables.   Each switch series also shows the compatible accessories in the datasheet. ... View more

First you'll have to check the signalstrength of the client at it's closest AP and the second one. See if both are not in an edge zone where alot of packets are retransmitted. Also check if there is any problem with the channel that is being used by the closest AP.  Check on the RF spectrum page if there is any issue (high channel util/a interferer).   Also check if you have client balancing disabled (preferably) on your RF profiles.   The only thing you can do on your clients is reduce roaming aggressiveness to medium-low and see how that goes. ... View more

Oh really?  So you had your client going back to the original AP just to regain it's connectivity? ... View more

Usually that only should happen when you factory default the device.  If your device did that on it's own then you may have a faulty device or perhaps a firmware bug. ... View more

As long as your device comes online on the regular internet connection it will get the dashboard config to set the second port to WAN2. However make sure the people onsite don't use that port as LAN port 😜 ... View more

On the Aruba switches you can verify your VLAN config as follows: - show vlans ports <portnumber> detail (then you will see ALL VLAN's on that port) However if you are using comware based HPE switches you can do: - display interface <interface number> (usually gigabitethernet 1/0/1 format a bit like a Catalyst)   Also on Aruba switches you can define a vlan as voice and that should also be visible in that first command.   So if you are sure each port only uses 1 data vlan and 1 tagged voice vlan you can use an Access port on Meraki with a voice VLAN.  If not then you need to use a trunk port with all necessary VLAN's allowed. ... View more