Thanks for your reply. We fixed the issue by whitelisting tis snort rule over rdp over non standard ports. WRA uses dynamic ports 49000 to 49999. IDs kept onblocking the packets. ... View more

@MOTAT wrote: Can this be done by locking down to a specific email address instead of a whole domain? Thanks Directly I don't think so, but you could allow it for the entire domain. Then on your email side block email that comes from these sponsored guest requests to all email addresses except the one you want to be used. ... View more

>We change a single phone to use TCP vs UDP   We go a step further and only use SIP/TLS.  TCP lets the firewall know when a stream actually starts and stops, and encrypting it prevents anything trying to do anything tricky with application aware NAT. ... View more

In my experience whitelisting these ID events doesn't work very well or quickly.   Your best bet is start by changing the ruleset to balanced instead of security. The next option is change the mode to detection. Then it pinpoints which part of ID is detecting/causing it.   The other thing you might check is AMP settings.   Also if you can provide the SNORT link to the vulnerability it is detecting     ... View more

I have done this before with MR16s, MR18s and MR20s. It works fine. Access points in general are somewhat directional so with them pointing at the floor you probably will not get the best coverage, however if it is your only option and you have enough points to cover the area needed then it will work.   Phil ... View more

@SoCalRacer  Thank you. I tried publicIp as listed in that doc, but it won't give it, so I assume it won't work because Meraki's API does not function as documented. I'm amending the previous statement, because today it is giving me the public IPs. I'm pretty sure nothing is different from yesterday (I don't believe I changed anything about the query), but it's working now so... I'm not complaining too much, we don't pay for it, but this is one of the reasons why we've stuck with the free licences.    Regarding your other comment, we need them so we can exclude "internal" traffic from our CMS's analytics. There are only a couple ways to exclude traffic with this particular CMS, browser agent and IP. Obviously, we can't use browser agent... All employees are remote, hence the need to collect the IPs of everyone in the company.   @PhilipDAth  Actually it is in the list, you must have overlooked it?  ... View more

Well another case this morning , a teleworker reported some issue with his MX :    Latency dropped right after the reboot but is still high. Maybe a 3rd reboot would fix it. ... View more

@SoCalRacer No. The Sonic Walls are in the headquarter. And we are planning to use MX in shops or small offices to connect to the headquarter. ... View more

Create a new VLAN at the remote site and don't include the VLAN in the VPN topology. This VLAN would use the local internet connection for everything. You would have to then move some clients to the new VLAN somehow so either a new SSID or switchport changes. ... View more

Oh, thank you very much. ... View more

I think about 150 - 200 mainly texas instruments or Bluetooth payment terminals all on the same network wide but could remove from all Shopping Center's & Retail stores. ... View more

Well, if you're able to use 40 MHz if the channel plan allows for it. Then you will have the advantage of using it because even though you cap the througput of every client to 25 Mbps, they will need less time on the air to actually transmit that 25Mbps of traffic.  Because if 40MHz is possible, the potential datarate per device can go up and you could potentially have more efficient use of the airtime. However if the channel plan doesn't allow it because you get co-channel interference from a distant AP on the same channel and then you need to fall back to 20 MHz. This is one of the main reasons to keep your celsizes on the small side and avoid putting AP's in corridors. ... View more

I wouldn't personally use MESH for a large number of users.  Every MESH node you go through halves the thorughput.  Also every problem that every upstream MESH node is having gets repeated to the MESH node you are on.   I would run an fixed line service service to every AP or group of APs. ... View more

I didn't think Umbrella supported Android devices with a client. I believe you could point the DNS to umbrellas servers with a policy.   Also no mention here. https://docs.umbrella.com/deployment-umbrella/docs/2-prerequisites-update   Windows and Mac devices you should be able to download the installers and follow below for help pushing.   https://documentation.meraki.com/SM/Apps_and_Software/Installing_Custom_Apps_on_Windows_and_Mac_Devices ... View more

You do not need a SM license to enable Android Apps within the Chrome OS. ... View more

I am assuming this is a North American device. Below are some of the first things to look at. If those don't work I would get a USB modem to test the sim in. It rules out carrier/sim being the issue. Then you can go to meraki with that info and get alot farther if needed. I also have heard that on the ATT side you need a static IP and then they will provide the correct APN once you have that setup.   My cellular uplink is stuck at 'Connecting' Built-in Cellular - Ensure the following: The SIM is activated with the PIN disabled or the correct PIN entered. It may be necessary to use an external modem, or work with the cellular provider to have the PIN disabled or the SIM unlocked. There is no external USB modem connected as the MX will prefer an external USB modem to the internal modem, if available.  If a custom APN is needed, ensure it is applied from Cellular section of the Uplink tab on the Security Appliance > Appliance Settings page. The SIM card is fully inserted. ... View more

Thanks @PhilipDAth, not a bad idea at all, especially if there's not a big difference in cost to begin with. ... View more

>But also it would be dumb to keep buying license for switches and what not that will not leave my work room.   I guess that is where I disagree.  The lab kit is being used to improve your network solution.  It is clearly for commercial gain.   Do you pay Microsoft for the licence on your machine in the lab? Do you pay the power company of the power you consume in the lab? Does your company pay for the coffee you drink in the lab?   People create products and services primary for commercial gain.  🙂 ... View more

I live @jdsilva's answer.  Another potential option is the email system you use may allow a mail rule to be configured on a schedule.  So you could must move/dete the alert emails between certain times. ... View more

Please do not use an MR20.  Without having the scanning radio that the MR33 and above have it will not be able to adapt to RF issues in the environment very well.  You have too many users to make this a viable option.  You will be forever trying to tweak it to make it work well.   This is really a high density use case.  You are going to have not just 30 connections - but 30 simultaneous connections all being used at the same time following a lesson plan. And lets face it - there is a reasonable chance students will have their phones and other devices attached as well.  Even if they aren't meant to.   If you want some future proofing and expect a long life time out of the kit I would take a look at the MR55.  It supports WiFi6 (which is a new technology) - so it has a long lifetime ahead of it. https://meraki.cisco.com/products/wireless/mr55   A slightly cheaper option is the MR53.  It supports 802.11ac wave2 - which most of your WiFi clients will probably be right now.  It is still a high density AP and will handle the load well.   The MR55 and MR53 will give you a robust problem free solution you never need to touch.     The next step down depends on your clients a bit.  If you have lots of Apple Macbook Pro's (or 3x3 clients) then you should take a look at: MR45: https://meraki.cisco.com/products/wireless/mr45 - A next generation WiFi6 access point MR42: https://meraki.cisco.com/products/wireless/mr42 - A current generation 802.11ac wave2 access point. https://meraki.cisco.com/products/wireless/mr53   The vast majority of clients have 2x2 WiFi.  So if you are mostly driven by price then take a look at the MR33. https://meraki.cisco.com/products/wireless/mr33     Because most clients are 2x2, a single MR5x series AP can handle about the same load as 2 x MR4x series APs (when using 20Mhz channels).  This is because the MR5x series (basically) have twice as many radios in them.     Head this warning - do not go any lower spec.  Sure it will work, but you will have intermittent issues around performance and stability.   If it was my money, I would use the MR55.  But that's because I like solutions I never have to touch after I put them in. ... View more

@nyuszy wrote: This is a shared environment, 2.4 GHz is so much infected that I don't want to enable it all anyway. Anyway I'd consider doing this, but there's nothing like that officially supported for MR74, and a pair of ANT-20 for $199 list price is too much for this. $129/pair here: https://merakinow.com/products/ma-ant-20   I know it is expensive, but may be worth it for full Meraki support..     ... View more

@TimBisel Caroline and me, of course! We high fived in real life instead.. ... View more