The "very small config" is based on the fact that you do *not* configure one tunnel per branch office. Four your 20 sites, you configure exactly one line in the dashboard. But by referencing 20, 50, 100 networks in the availability, the tunnel is setup on all these networks.   This is needed because on Meraki we *do not* have routing between non-Meraki and AutoVPN tunnels.    The term "non-Meraki VPN-hub" is nothing official. It was meant to emphasise that the peer for these tunnels is not a Meraki Hub in the same dashboard org. Because in AutoVPN we would have full routing capabilities. ... View more

Oh, ok ... and you could cool it down even more. 🙂 ... View more

I also only looked at the list prices. I think on antennas, the discount is typically quite high. And especially with Acceltex/Ventev gear, some more euros/dollars/whatever can be saved. Another reason to consider: The outdoor APs have a shorter hardware warranty. ... View more

Three reasons: Inside a warehouse, the AP typically doesn't need to be weatherproof, there is more channel flexibility for indoor usage, and the MR46E is cheaper than the MR76.  But as noted, this was not general advice; it was just a hint in case this AP was not considered before. ... View more

Are these APs already ordered? In most circumstances, I assume you would be better off with an MR46E and the dual-band patch antennas. ... View more

As mentioned by @GreenMan, with Passphrase based WLANs, 802.1r is not that relevant. It saves a round-trip time when roaming, but roaming is typically fast enough without. Other than that, I am running WPA3 Personal and Enterprise with the major operating systems without relevant problems.   And: With regards to security: nothing good ever comes out of transition modes (ever) (Quote from Stephen Orr, Distinguished Systems Engineer, Cisco) ... View more

You can't use your internal Switch for this. Without VRFs, the internal and external routing tables can't be separated, and you build a possible way around the firewall. Use dedicated L3 switches like a CBS350, Catalyst 3560CX, 9200CX. ... View more

This would be great. I always have two additional accounts for RW and RO. I also tried one account for which I changed the permission to write when I wanted to configure something and back to read when only collecting data. But that is not really practical. ... View more

Oh, yes, I forgot about that nice little device! ... View more

MS120 is not SGA capable. Only MS130-X and the Catalyst platforms. ... View more

Submitted, that one looks really comfy! ... View more

I am fine with that. I always use the color-blind option because I like these colors more than the default. ... View more

The Meraki MX works differently than you expect. Both devices need a constant connection to the dashboard. With the /30, you are pretty limited here.  What can you do: Get/29 subnets from your ISP. This is the best option. Connect the first ISP to MX1 and the second ISP to MX2. In this setup, the active firewall will always use only one ISP: ISP1 while MX1 is active and ISP2 while MX2 is active. Place a NAT router in front of the MXes. With a private subnet between the router and the MXes, both can communicate to the dashboard at the same time.   EDIT: I didn't see that you have /29s on the LAN side. If option 1 with a /29 transfer is not possible, then option 2 is even easier. Instead of a NAT router you can take two small L3 switches and work without NAT. On this L3-Switch, the /30 goes to the ISP, the /29 goes to the MXes.   Some more information on the different options: https://cyber-fi.net/index.php/2024/02/19/connecting-your-meraki-mx-to-the-internet/   ... View more

Good catch! The last part of the formula is correct on the page with L_H*L_S, but the "*"  is incorrect in the formula. This is the right place to report this.   Happy learning! ... View more

What kind of login requests are you talking about?  ... View more

The "Availability" option is exactly what you need when you are not (yet) ready for vMX. You configure the non-meraki VPN once, and any branch that is configured in the Availability option, will build an individual IPsec-tunnel. With that you have a very small config even for a large amount of branches. Your non-meraki VPN-Hub still needs to be configured to accept the session from all branches. ... View more

What do you want to achieve here? Is it access control? For that you build *one* VPN-connection with three subnets local and three subnets remote. If only a subset of subnets need to communicate with each other, you control that with the org-wide-firewall that you find on the same page. But this only works for AutoVPN. If you need to control it for extranet-VPNs, you are out of luck and either don’t control the traffic into your network or move the VPN to a different device that is more capable in terms of extranet-VPNs. ... View more

Theoretically, they can be subject to any filtering. But I wouldn't expect any ISP to do that. ... View more

We all thank you for your effort to sort out all potential problems and to report on how to do it better! 😁 ... View more

And for the switching line, they were only talking about Catalyst-M and not the "normal" MS line.  ... View more

Yes, I am also waiting for them to offer the option to migrate to the new license. For nearly all customers it still is the "future" because co-term is far away. ... View more

In the future, the upcoming Subscription Licensing can cover both under the common "MS200 Medium" license. ... View more