Yep, should be bidirectional.   On access points when capturing from the dashboard however it's only upstream (RX) traffic. ... View more

The built int "whitelist" policy can also be applied to a client to bypass all restrictions. ... View more

QoS features on MS switches is extremely basic. ... View more

Thanks everyone.. I tore my network down to a single vlan (1), and then established a single vlan flat network. Once everything came online successfully, I changed vlan 1 on the MX to vlan 10, changing the trunk to my MS to native vlan 10, and native vlan 10 on the trunk going to my MR. All lan ip's set to DHCP and left the vlan box empty. Went in the MS settings and overrode the management vlan to 10. I gave it 10 minutes and came back and was successfully migrated off of vlan 1 completely. I then build out vlans for Data, IOT and Wireless clients, pulling all my devices off of the Management vlan. I then used wireless vlan tagging allowing IOT and Wireless, and forced all my devices onto the appropriate vlans by using group policy's. The home SSID is bridge mode with vlan tagging.  Finally got this right.  Cheers! @GIdenJoe @chuyendang @Roger_Beurskens @BlakeRichardson  ... View more

Well I wouldn't call it SDA just yet. If it's just the SGT's they will be supporting you could call it trustsec. Up until now the MS switches only supported VACLs, not even PACLs or RACLs that's why you could only push a dynamic VLAN onto a port instead of a dACL which technically is a per session PACL.  So making the jump to SGT's makes me wonder where they will be supporting the SGACLs. Enough ACL'ing for today 😉 ... View more

The client has purchased a Meraki MS120-24P to replace the Netonix.   I will be glad to get rid of the Netonix, and the Microtek used to bypass firewall to allow the ISP to manage the switch. ... View more

For me the Meraki DHCP is great, easy to use, and pretty fail safe from my experience.  However, no P2P means some Apple functions (and others I'm sure) will not work. ... View more

I bet the old router was giving out a different DNS domain name than the new MX in DHCP.  As a result I bet Windows firewall has decided it is in a different location and turned on, blocking remote RDP.   I suspect if you turn off Windows firewall it will start worlking. ... View more

>Or if you really want their email you could setup an excap.   I looked at doing that with my first customer that asked, then found SplashAccess could provide the service for less than I could get it built. ... View more

Your topology is doing exactly what RSTP and classic STP does. So switch 1 is the RB so that one will have both links in designated state and forwarding. And all other switches will have equal cost on both links towards that RB.  But since sending port 48 is numbered higher, port 47 will be the Root Port FWD and port 48 will be ALT BLK on the other switches. So to fix your problem you have to make sure switch 1 port 47 goes towards the primary MX. I myself however prefer not connecting the uplinks of access layer switches directly to an MX but going through a CORE switch stack which allows for better east west traffic.  If both MX'es are in the same room you can also connect your MX directly to your CORE stack and then only two links i total would be blocked. ... View more

switch to 802.11ad. Manufacturers are just milking their 5 GHz tech and sticking their heads in the ground. Everybody wants a piece of the 5 GHz spectrum.   ... View more

Normally the MX is equipped with the correct downlink ports according to the maximum throughput so the need for downstream LACP is not needed. However what I do find a little problem is the following: The lack to designate 2 ports to the same WAN link. Take following scenario into account: You have two rooms where you terminate a WAN line and there is a router in each room, downstream those routers do an FHRP to have the same subnet available on both locations for redundancy.  So you need WAN1 of your MX available in both rooms, so you connect the WAN1 to a switch stack in that same room and then that switchstack uplinks to both core switches.  However if a switch in that stack fails that happens to contain your only WAN1 link from the MX, the entire device has to do a failover.  Whereas if you would have been able to have a bundle upstream you could connect to two switches in that stack and have better redundancy that way. ... View more

In the EU you follow the ETSI rules and these are as following: For the 2.4 GHz ISM band you are allowed 20 dBm EIRP. For the 5 GHz bands it's a little more complicated: UNII-1 and UNII-2 (channels 36 through 64) are allowed 23 dBm EIRP. UNII-2e (channels 100 through 140) are allowed 30 dBm EIRP. The power levels you configure in Meraki and Cisco gear for that matter are the IR values (intentional radiator) so the antenna gain is not added to it to come to the EIRP. So in case of a MR45 which has in 2.4 GHz a gain of 5.4 dBi, you would be able to go no higher than 14 dBm Tx power. And for 5 GHz there is a gain of 6 dBi so if your channel is below 100 you would not be able to set it higher than 17 dBm TX but go up to 24 dBm if using channels 100 and above. However in a good Wi-Fi design you should keep your AP Tx power as close as possible to the Tx power most of the Wi-Fi clients have which usually varies between 12 and 14 dBm for 5 GHz clients.  And since you want 2.4 GHz to be less desirable you usually keep that one at least 5 dB lower so 8 dBm is a good value there. ... View more

GldenJoe thanks for that I will look into the Unifi side of things to see if there is anything that needs to be whitelisted since all are Unifi based i presume that is one of the reasons i cant see the option to whitelist, but if the meraki dashboard does I will certain add those the MD if and when i get one of these ... View more

The Cisco Aironet AP's with WLC do support wireless mesh with ethernet bridging and VLANs. ... View more

I had to replace a lot of switches with that noise issue.   Once I got 21 switches at once.   ... View more

I think the traffic recognition is based on destination port as Microsoft's Windows 10 distributed update traffic is recognised as BitTorrent, simply as it uses the same port at the receiving end... ... View more

Well group policy and MAC won't work since the users are on different systems at any given time. I ended up using Jumpcloud and setting attributes to users at this point. Since my intention was to schedule service availability to users and not systems this was the best way. ... View more

This thread is old, but figured I would post here anyways since it was in question. https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Troubleshooting_Group_Policies Confirms it is in fact stateless (and is stupid IMHO) ... View more

Not only can it be turned on, it can't be turned off.  I have them all set to alert mode because that's the closest I'm allowed to get to off... ... View more

We have a number of Ingenico PDQs and they have the same issue, on their display you actually see each wireless network repeated for each AP in range... ... View more

Thanks,  I have it configured in this manner now.  I appreciate the help. ... View more

Whole the solution above may work, it needs to be noted that Meraki MX does not currently support true Source NAT.  ... View more

It definately works.  Used it several times. ... View more