Make sure the AP's are on a network that can reach meraki cloud on UDP/7351.  And if you are on a newer firmware version also have them allow TCP/443 outbound.  And if you are using a firewall that does SSL decryption, don't let the firewall do that because it messes up the connection. ... View more

It would be best to open a case.  From your description this all looks okay.  Feel free to post screenshots of your SGACL and the assignment on both ports. ... View more

Strange, it looks like website is not pushing the fields to the body of the API call.| Did you initially add an iPSK on the GUI or did you immediately start with doing API calls? It is possible that when creating the SSID the first time you need to already have 1 PSK and GPO in place to add this.  And perhaps you can then via API add multiple key/GPO pairs. ... View more

@GIdenJoe it isn't something I'd heard of before, but it seems they are a thing!  See this link from FS: https://community.fs.com/article/tunable-optical-transceivers-what-are-they-and-when-should-they-be-used.html ... View more

Pinging towards wireless clients usually is not that stable. If  you can see the PHY rate on the clients please do check. Then check on the Meraki side what the SNR of the client is (if you go to an AP status page you can see each connected client and his upstream signal strength which is the SNR).  If it is above 30 dB your connection is excellent.  Then you still need to check the airtime utilization on the channels of the AP on the same page.  Also check which channel the clients are connected on.  If your 2.4 GHz radio is busy and your client happens to be connected on 2.4 then that is normal. Having 150 Mbps speed on a wireless client is excellent throughput if you have multiple clients in that area.  If your application requires low latency and/or low jitter then you will need to check airtimes, QoS tagging on your wireless frames (by doing an OTA capture). ... View more

That very much depends on your network needs, users, tunnels etc. Check out the Sizing tool, it will help you select the correct MX model 🙂 Meraki Sizing Tool ... View more

If your internet circuit is a regular internet circuit then you can only prioritize outgoing traffic from your calls.  So on the traffic shaping page you can create a rule that matches your VoIP traffic and set the outgoing DSCP to EF.  Also do not forget to set the actual contracted down and upload speed of your circuit all the way on the top of the traffic shaping page. However incoming traffic will arrive via your ISP in the order it was sent. So options: - have the phone lines come directly into your network and use dedicated WAN circuits. - have a separate SIP trunk that does not mix with your internet traffic. - apply bandwidth per client limits and set other traffic types to lower priority. ... View more

I can for sure. Just would prefer not to have the extra hop and share the 10gb link with other switch to MX traffic. ... View more

Hi @carlto , This might interest you 😉 "BGP peering over IPsec VPN tunnels can be enabled on the Meraki Security Appliance. This unlocks new dynamic routing use cases for customers in addition to enabling resiliency and redundancy over IPsec VPN peers. "   https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN         ... View more

Greetings, It is possible that some existing traffic hasn't failed over solely with the configuration changes. Some traffic, especially sensitive traffic like voice/video calls or some streaming services for example, might not failover since that would break the connection completely.    I would suggest testing with a new client, or at least a client that has been disconnected for at least five minutes from the network and then testing again. After that, if possible, I would physically disconnect WAN 1 to force the traffic to failover.   If some IPv4 traffic still egresses from WAN 1 - I would suggest contacting support and opening a case so that we can investigate further.    Immediate failover/failback is also an option but we should troubleshoot prior to enabling that option.   https://documentation.meraki.com/General_Administration/Support/Contacting_Support https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover#.E2.80.9CImmediate.E2.80.9D   ... View more

The reason why you are struggling with this is because of the current design.  If you can correct your system design, you'll have fewer issues. ... View more

It's not quite what you described - just wondered if you'd seen / tried this:   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Blocking_and_Allowing_Clients   This can also be done via MAC Authentication Bypass and an appropriate central RADIUS server (like Cisco ISE), in conjunction with 802.1x - this would be the recommended way for anyone looking at mulitple sites, I'd say ... View more

Or use the Cisco offering - Cisco Secure Connect. https://documentation.meraki.com/CiscoPlusSecureConnect   It has proper native integration with Meraki.  No VIPs required. ... View more

Can you share what you setup on the MX for this? ... View more

If you are sure your routing is ok and you did the capture correctly and not see anything on UDP port 1812 leaving the switch, then you should capture the EAPoL frames on the port.  Your supplicant might not be sending EAPoL frames to the switch. ... View more

Once "eBGP over non-Meraki site-to-site VPN connections" is configured on Hub MX, can those 3rd party prefixes/routes learned on MX Hub be propagated to other MX branches over Auto VPN?  ... View more

You can use BXD SFP's on Meraki managed/monitored Catalyst switches but on native MS switches it is NOT supported.  The choice of switch is not fitting for this requirement. ... View more

I would try reseating as @GIdenJoe has said, and if that doesn't work, contact support.  You might have a faulty component. ... View more

You should be able to have a rough estimate how much bandwidth you could have using 20 MHz by using a taking the average PHY rate of all clients you expect to be connected to the AP and then taking about 2/3 to 1/2 of that as actual goodput. However the best thing you can do is allow for a few testing days of normal usage and just check the AP's of interest what their average airtime is.  If you keep below 50% in heavy use you should be fine using 20 MHz. ... View more

Nuff said 😉 ... View more

I would still push the support engineer to escalate internally. This is too big of an issue to just leave it alone. I'm also curious what the technical reason would be since those switches still are regular C9300L's. As an engineer for an MSP I'm always looking for detailed information. I also recently had to ask the question about cross compatibility between BXD SFP's and C9300-M and regular MS switches.  Luckily I got an answer there before committing to a buy. I do feel your pain, damn... ... View more

Hi @RahulPrasadh,   Yes, that should do it. You can also add custom expressions for a more specific set of IPs or subnets. ... View more

For Content filtering specifically, instead of adding the * wildcard for the *.outlook.com example, you will have to simply add the outlook.com to the blocked/allowed list. This will enable anything ending in outlook.com to be blocked or allowed.   One thing to be aware is that the Allow list takes precedence over the Block list.   You can see a breakdown of the process at this link: https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering#Patterns_for_Blocking_or_Allow_Listing_Specific_URLs   BR, Ioana ... View more