Also, don't forget about the rule (drop down option) to which blocks wifi traffic from the wired network. This is on the AP config and always gets me when it randomly turns on. ... View more

Hey Dieghito!   Welcome to the community.    Everything in life has it's pros and cons 🙂    Because Meraki is so simple and easy to work with it can sometimes be even more annoying when thing gets tough. Have you thought about using an external API tool to assist with troubleshooting if it is a really annoying problem? ... View more

Yep, connect one ANT-25 antenna to both the top ports, and another ANT-25 antenna to both the bottom ports. The difference with the MR84 (being a 4x4 access point) is that all the ports are dual band (so both 2.4GHz and 5GHz) and you want to have the antennas covering the same area so that all the smarts of 802.11ac Wave 2 work as expected. ... View more

>Now I can make a wish and have them support face-id   You effectively can.  The dashboard supports SAML.  You would just need to provide a SAML Idp that supports authentication using face-id. ... View more

This is why I extensively use the "virtual stacking" feature. In every org I always apply tags to ports with identical configuration (except name ofcourse) and always use the tag to filter the correct ports so I always have consistent configuration across the board. Ports to end users have the access tag and a descriptive tag for the VLAN used. Ports between switches always have the trunk and isl tag. Ports between switch and ap always have the trunk and ap tag, and so forth. Also make sure you make some good filters before tagging is applied to the new switches. Learning to use the stack:part of name port:1-12 always helps to quickly select correct ports. ... View more

That person that configured loop guard on endpoint ports does not understand STP. It only makes sense to use BPDU guard on access ports to endpoints.   Since I haven't seen any Meraki network using OOB cloud access I have never been able to implement loop guard because dashboard configuration does not allow it. ... View more

Maintaining fewer major releases is easier I guess 😉 ... View more

The 1 and 10 Gb uplinks provide diverse physical paths, hence the preference for including the 1's (preferably aggregated).     Thanks for the quick response.  ... View more

@Dkurtz you can force 10Mb full duplex on the 1Gb ports but you cannot force 10Mb half duplex which has caught us out for one old device, time for a crappy hub I think... ... View more

I completely understand and agree that this is the Windows host. I'm just hoping that someone else in this group might have experienced a similar issue. The Meraki devices, I can see in the packet captures are doing what they need to.  ... View more

If you only need wireless behind one internet connection it's usually better to use an MX appliance (which can do PPPoE) that has wireless on board MX67W. ... View more

BGP on MX appliances is only meant to import the routes of a site or datacenter into SD-WAN and vice versa to have site subnets available to BGP peers in a HQ or Datacenter site. ... View more

I've requested that info be corrected. ... View more

It's simple: Does your computer know when it is receiving TCP data from a webserver that it is passing 12 routers on the internet and perhaps passing through an MPLS network?  No it does not.   Your computer if it is connected with a wire uses ethernet to talk inside it's own network which encapsulates IP if it is an IP packet.  It does not speak MPLS or VXLAN or LISP or GRE or whatever might be used upstream.  That's the whole point of using the TCP/IP and OSI reference model.   To give you an example like your case: You have a Meraki switch that will serve clients on a network and the router/firewall or whatever intermediate device is a VTEP.  The Meraki switch will send UDP packets to it's known Meraki cloud servers upstream towards it's default gateway (so that is UDP inside of IP inside of ethernet).  Then the upstream device takes that packet and sees that it needs to send that packet across it's VXLAN tunnel to the VTEP at the other end.  So it encapsulates the ethernet frame inside a VXLAN header and slaps another UDP + IP + ethernet on that and routes it towards the other VTEP. That VTEP then decapsulates the outer headers to reveal the inner packet and sends it on towards the end firewall or gateway towards the internet so the switch's packet is forwarded in the direction of the Meraki cloud. ... View more

In one armed concentrator mode you only have one uplink, so you can never experience a dual active issue if a VPC peer switch would fail because both up and downlinks would be gone on a single appliance.   However VPC is in itself cannot be used in this case because the MX does not support port-channels. Individual links to both MX'es is okay though. ... View more

Thanks all, I am most interested in the 5G range, and the charts have helped me to decide how to place it. NOT in the location I first thought! ... View more

Congrats, @MerakiDave! ... View more

Hmm I believe that last part is a little hard because you can have a multitude of switchtypes in one single dashboard network.   Maybe a pop-up like the QoS and stormcontrol pop-ups you get when you have MS1x series switches in your network would be a better choice.   It's easier to check if something is then to check everything for something that isn't. ... View more

I have used ASA's before.  I haven't seen zones being used for routing??  Only interfaces. ... View more

If your inner traffic is not tagged, your outer traffic will not be tagged to. Please make a capture on the final switch right before the packet enters the LAN interface of the MX. Or make sure you have rules in place to tag the packets at the MX. ... View more

That's what i was looking for...many thanks! rgds roger ... View more

@Ozzy03260 Something to remember on the Meraki MS switches (which is different to Cisco Catalysts if you're used to them) is that you don't have to create VLAN - the switch will pass traffic on any VLAN out of the box. All you have to do is assign an access port to a VLAN. By default all trunk ports will forward all VLANs, but you can restrict (prune) this to just the VLANs you want. When you create a VLAN interface on the Meraki switch you are essentially creating a gateway (SVI in Catalyst terms) that allows that VLAN/Subnet to communicate with all others. You can then restrict communication between VLANs/Subnets (and even within a VLAN/Subnet) using ACLs. ... View more

The feature I find lacking in the MX traffic shaping rules is matching on existing DSCP tags. It's better IMO to give corp laptops QoS trust and let the client itself apply the tagging. Since Teams uses the same source ports for voice like skype4b and the same source ports for video you can easily build a GPO with a netQoS policy that adds support for these. However the voice part which is using UDP 50000-50019 should already be tagged DSCP EF which should be matched by the MX when you use default QoS rules in the realtime queue. Btw normal strategy for video conferencing uses AF4x PHB, not the high throughput AF1x. ... View more