My daughter (field engineer) giving it a try. ... View more

What is the benefit of having SSID's per floor?  If they are near the end of a floor or are walking between floors the experience would be more seamless if the SSID's were all just 'X Guest' etc... ... View more

Are some of your networks in the EU? ... View more

Good to know it was temporary.   ... View more

@BrandonS wrote: @Adam wrote: I agree the RMA process is pretty painless.  We still keep some unlicensed hardware spares on hand though for critical stuff where the 1-2 day downtime would be a problem.   There is also this enhanced Meraki support program that seems to not be well known: https://meraki.cisco.com/lib/pdf/meraki_now_solution_guide.pdf Interesting. Kudos for the link.  But I'm sure it'd still be cheaper to keep a few physical units on hand.   ... View more

I agree the RMA process is pretty painless.  We still keep some unlicensed hardware spares on hand though for critical stuff where the 1-2 day downtime would be a problem.   ... View more

Two things I'd try.   1.  Just set the * as the default in Security Appliance>Content Filtering for blocked and in your Group Policy configure the whitelist to append. 2.  Try just setting a single site to blacklist in your policy to test if for some reason it is the * thing messing it up.  ... View more

What types of things are you trying to set for the Security Appliance Only section that aren't working?  In the Dropbox policy I've referenced, those work just fine.  Here is what I do since we block File Sharing.  I append whitelisted dropbox items then if the user is part of that AD group it maps to this Meraki Group Policy and allows them.     ... View more

Example: if your ISP provider gives you a block public IP's.  The single cable your service delivers would need to connect to a switch using Layer 2.  One way to do this without having to use additional hardware is to just setup a few ports on your Meraki switch with a VLAN that you don't use.  Note:  All the ports would need to be the same VLAN so the traffic stays together.  The cable from the ISP would connect to one of those ports and then one of those ports would go to the MX WAN port to service traffic as it currently does and then another one of those ports would go directly to the server you desire to have a WAN IP.  At that point, you could assign a WAN IP directly to your server.  The traffic will be going direct and not through the MX so you'll want to make sure to lock it down at the host level and also using ACLs if desired.     EDIT:  Then all traffic to/from that server will be the WAN IP.  No NAT necessary.   ... View more

Strange that makes me wonder if there isn't something upstream causing the VLAN 10,20 issues.  ... View more

I just tested that from my dashboard.  Took < 10 seconds for the switch to get the config update.  Note:  I only changed one port.  It was an access port and I changed it from one VLAN to another.  My dashboard is on n86 though so your host could be different.  ... View more

Are you making the changes to an AP or Switch?  What type of changes are you making?  I can possibly try in my dashboard to see how long it takes.  Also double check Help>Firewall Info to verify the things listed there are not possibly blocked upstream.   ... View more

I don't believe there is.  What type of retention are you trying to achieve?   If you need extremely long retention then Meraki cameras may not be the best bet at this point.  But using the "Enable motion-based retention? Deletes footage older than 3 days in which no motion was detected." Adds quite a bit more duration to the recordings than you'd normally get.  ... View more

I've thought the same thing.  On my vast to-do list is to code a dashboard using the APIs to build a single screen to show me all of my networks, WAN1, WAN2 status and perhaps even let me nickname them so I recall what service they are.   ... View more

I'm not sure about that specific alert but does the source indicate a client, or perhaps a mail server on your network?  I typically use the source and destination to try to start running captures to gain more insight into what is going on.   ... View more

I think I may be getting a sense of what you have going on here.  So in your "left" image, it shows the 802.1x "Access Policy".  The only settings that tie to that policy are in Switch>Access Policies and they look like this:   Group Policies, on the other hand, are configured under Network Wide>Group Policies.  They look more like this:   I believe there are two ways you can assign the Group Policy to a device.  One is manual as you observed and that would be annoying.  The second is to go to Security Appliance>Active Directory and link your Active Directory Group to the Meraki Group Policy.  I don't believe this shows up in the dashboard when you view a computer but it definitely works.  Then you can just assign users to that Active Directory Group and they'll automatically get the permissions from the Meraki Group Policy.     ... View more

I've never noticed that before but hopefully it is a normal part of the IDS process after it gets its rule updates or something.  Here are some snippets from my logs as well.  I'm at firmware 13.28 and Prevention/Balanced mode.    ... View more

Are you in a 24x7 environment where you can't schedule evening maintenance windows? ... View more

The above mapping works for me with content filtering as well.  We use it to allow users to get to Dropbox so we just have to make sure they are in the AD group and it automatically maps to the Meraki group and allows them access.  Although there is a slight delay for it to sync.  Which part(s) aren't mapping/working in your test because it seems like you are trying to do what we are doing? ... View more

One other option may be to set up a different port to connect to the AP as a test.  Keeping it as simple as possible.  Something like this although I don't know what your native VLAN is.   interface fa1/0/6 switchport mode trunk switchport trunk encapsulation dot1q switchport trunk native vlan ? switchport trunk allowed vlan 1,10,20 ... View more

If you wanted an MX64 instead of the MX64W can you just exchange it with your reseller?  But worst case, just copy/clone an existing MX64 network and then assign the MX64W to it and it should get the majority of the settings except for the device name, static IP etc... ... View more

@AjitKumar is correct.  You cannot currently step the upgrades.  Is there any particular reason why you'd want to do this?  If it is for stability testing do you have any other networks with fewer APs?  We typically do firmware updates on those smaller networks first to make sure things are stable before rolling it out to our sites with more APs.  One potential, but not ideal, option would be to split your devices into two networks.  But that would be only if you absolutely have to do them separate and have no other networks.   ... View more

I may not be fully understanding what you want to accomplish but here are my thoughts.    If you want rules like blocked website categories etc to apply to all users then you just set it up in the content filtering section etc.  If you want more granular control then you can map AD groups to Meraki groups in Security Appliance>Active Directory.  That way whatever group they are associated with in AD will automatically link to a policy in Meraki.    We basically have the default content filtering blocks for everyone in the company then we have some groups that we selectively assign for exceptions (slightly more or less access in special circumstances).   ... View more