Before planning for templates, make sure that you understand what they are and how they work. Especially, look at the way IP addressing is done. If you come from a traditional setup with summarized networks for your branches, you will be a little bit "shocked" how addressing is done here. And you should be aware that every change of the addressing in the template will renumber the addressing in the networks.  At least for me, these are too many drawbacks and I only use individual networks. For automation, the Meraki API will help you to keep your networks consistent.   https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/MX_Templates_Best_Practices   ... View more

Never used them myself, but have heard good things about http://www.acceltex.com/skins/ ... View more

Outgoing traffic is not controlled by these 1:Many rules. The outgoing traffic would still use the interface IP of the MX. ... View more

The MX has a different concept for the usage of the additional IPs on the external interfaces. You do not configure any aliases, but the moment where a 1:1 NAT exists, this IP is also used for outgoing communication.   In the Firewall-section of the MX you need an 1:1 entry: Public IP: 11.1.1.1 LAN IP: 192.168.1.1 ... View more

Actually, I don't really get what you are trying to achieve. Most important is, that your MX-Ports in use are two LAN-Ports and not the WAN-Ports. For these two LAN-Ports, Access is perfectly fine.   EDIT: You say "ABC can not see XYZ". Does this mean the other direction is working? Or in general: What is already working? ISP1 to ISP2, ISP2 to ISP1, any Branch to MX, any Branch to the other ISP? How do you test? Are your test-packets allowed on the target-devices? ... View more

I did some more tests and it seems that the mentioned statement is not valid (or not valid anymore, I did these tests on MX 15.33):   I installed a new web-server on my server-LAN and placed the eicar test-files in the Web-directory.    Test1) Accessed it from a PC in the user-LAN: MX blocked the download. Test2) Connected with a client-VPN and accessed the file (so this is the original question): The MX blocked the download! Test3) Accessed the file from a PC that comes through a 3rd party VPN: This one was very strange. The Download was allowed (AMP 4 Endpoint directly kicked in) but the MX Security Center logged a "Blocked" action which was obviously not done.  Test4) Configured a port forwarding from the internet to the web-server and accessed the file. Same as with Test3, the download was allowed but the Security Center says "Blocked". EDIT: Later ... (you should not do tests like these while doing parallel other stuff)   Only Test1 was an AMP-Block, the other events in the Security-Center came from IPS as there is also a signature for Eicar. ... View more

That was one question I asked a Meraki Engineer on last years CiscoLive. There I was told that it's only for native downloads from the internet to an internal client. ... View more

Sounds good, I would also expect that it will work. When adding the route to the router/firewall, make sure that this device is able to "hairpin" the traffic. For example, a Cisco ASA would not do that without dirty config. ... View more

The approach of configuring a 192.168.0.0 network on Site B can not work. That would be L2 bridging which is not available on the MX and in most cases not a good solution.   There should be no difference in the VPN connectivity of dual-armed vs. one-armed. Is it only the VPN-connection that is failing or also the connection to the VPN registry?   Have you done any changes at the site1 MX? Is there any config for the 192.168.10.0 in MX1? That could be a problem. ... View more

But if two systems are synchronized or one replicates to the other, then we can not call this a backup. If the dashboard config gets screwed up, the switch will be screwed up seconds later automatically. ... View more

You can, but you should not. The MX SSID is a rogue for the MR and both do not share any information. There will be no fast roaming between them and RRM does not know how to deal with that. ... View more

Option 2) "do not respond to DHCP requests" as there is already the "real" DHCP server in that VLAN. ... View more

In addition to what already was mentioned: How is your content filtering on the MX configured? If it is "Full list" try "Top sites only" and look if the problem stays the same. I had some installation that had the same symptoms with "Full list". ... View more

One more reason to run DHCP on the server and not the MX: All systems are automatically registered in DNS and can be tracked and/or accessed by hostname/FQDN. ... View more

I do not think that there are general best practices. But there are different goals that a hotel could have. Some want to make money with the WLAN, some want to provide best guest experience. As a traveler, I of course prefer the second goal. If your local rights allow this, I would go for the "click through" splash page. The guest has to accept an "acceptable use policy" and is connected to the internet. That is very convenient for the guest. ... View more

As always: "it depends". Best you go through all the possibilities that you have with Meraki-Splash-pages and pick the one that fits your need. Here are some documents to start: https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Splash_Page https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Customizing_the_Splash_Page https://documentation.meraki.com/MR/MR_Splash_Page/Splash_Page_Details_for_Meraki_MR ... View more

That will be a basic policy-based IPsec VPN with IKEv1 which is supported on both platforms. Here is a guide for the RV-side: https://www.cisco.com/c/en/us/support/docs/smb/routers/cisco-rv-series-small-business-routers/smb4939-configuring-a-site-to-site-vpn-tunnel-between-cisco-rv320-gi.html Just replace the crypto with what is supported on Meraki MX like AES 128, SHA1, DH5 ... View more

Not the way that you have an FMC and FTP managed by the Meraki-Cloud. For having *one* cloud-managed solution, the Cisco Defense Orchestrator (CDO) is the Cisco solution. But it is likely that it does not fit your needs (yet). But you still can manage the FTD/ASA locally. Yes, I also do not really like that, but for now, it is IMO the only usable way. ... View more

Actually, the possibilities are highly limited here. The traffic from VPN-clients is subject to the L3 firewall, but for your use-case, you would need differentiated access. And as we can not apply group-policies via RADIUS for VPN-users as it is possible with wireless users, all clients are treated the same. I really hope for more possibilities with the coming AnyConnect support.   How do I solve this problem? Nearly all my Meraki implementations have an additional ASA for all Client- and external S2S VPNs. A cheap Firepower 1010 is very often enough here. ... View more

> Anyone can justify why Meraki sells transceivers that cost 40X compare to a 3rd party compatible units?   I would say "easy money" ... We had an "only Cisco" customer that refused to save some bucks on third party optics because he wanted the "official" ones. And what I heard, that was not the only one.  ... View more

I have a broad range of 10GTEK modules running in MS-switches and they are working fine for a couple of years. A colleague had one SFP+ that did not work, but well, that's how it is sometimes.  ... View more

I think it happened once about two years ago that Meraki deleted parts of some organizations based on programming mistakes. I assume these customers had been happy to have a backup to apply. Also, think about completely messing up your config. With a backup, you could easily go back. I wonder why Meraki does not have something like this build in the system. "Cloud" does not automatically mean the data is safe. ... View more