Both internal and external.  All external calls go though the pbx so we can just mirror that port.  But internal calls don't.  ... View more

It can bridge/mesh as long as it has power.   Some sources: https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Using_a_Cisco_Meraki_Access_Point_as_a_Mesh_Repeater https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Extending_the_LAN_with_a_Wireless_Mesh_Link ... View more

My guess is it will become the MV17 😉 ... View more

Aren't the helper/relays usually on downstream switches to help there know where to look for the DHCP server? ... View more

I may not be understanding this but as long as you have a layer 3 switch can't you go to Switch>'Routing and DHCP' then select the interface or create an interface and run a DHCP server from it?and turn on the DHCP server feature? ... View more

Thanks, I've been trying to be more active.  This community truly helps me keep up on everything Meraki.   ... View more

@MRCUR That's right, it's all coming back to me now.  We did that for printers at one point for one of our sites.  Ultimately it was easier to just set port security on the switch ports with stick mac whitelist and whitelist size limit of 1.   ... View more

So can you ping and get replies?  And I'd mostly referenced looking at the VPN logs.  ... View more

Hello @KayouMT, I'm a little confused.  If you are using Mac based authentication then don't you just have a whitelist of macs on your NPS server and when it authenticates using that mac it passes.  There shouldn't be any username/password unless you are doing user based authentication?  ... View more

Got three of the MV12W's ordered today.  I'll post back here when I have them installed to provide feedback compared to the many MV21's we have implemented.  I know the MV12's don't have optical zoom like the MV21's do but we don't really use that feature anyway.   ... View more

I agree with @Uberseehandel, loan switches are the only way to know for sure.  We have MS250's as the core in one of our environments and they work without issues.  We had some issues early on with our MS425 stack but sounded like most of that has been resolved with firmware.  When you have stacked switches it always makes firmware updates a little more tricky too.  ... View more

If interoperability is your primary concern why not get Meraki's POE injectors? MA-INJ-4-US   Edit:  Actually looks like the devices you are using are waterproof, I assume an outdoor use case? ... View more

Will the ASA and the new Meraki be at the same IP or will the Meraki be at a new IP?  Also double check any error logs on the Checkpoint side to see if any indication of the subnets stuff. I'll check with my contact to see if he can remember what we did to clear that up.   ... View more

We tunnel our MX100 to a Checkpoint.  I don't have control over the Checkpoint side but I remember them saying they had to make sure the subnets matched.  On your side reference Security Appliance>Site to Site VPN and check what you have specified as the 'Private Subnets' and compare that to the Checkpoint Side.  If you don't make much headway let me know and I'll ask them exactly what they had to set on their side.  It was either the same subnets or supernetted.    https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Troubleshooting_Non-Meraki_Site-to-site_VPN_Peers#Event_Log:_.22failed_to_pre-process_ph2_packet.2Ffailed_to_get_sainfo.22 ... View more

I definitely am.  We have been chomping at the bit to get cameras with audio.  We have been using Nest cameras in the interim for areas where we need audio.  I have orders pending and ready as soon they are available.   So far as I can tell here is a little cheat sheet on the MV12 models since there isn't a compare yet. 12N - Narrow - 73° horizontal field of view (FOV), 256GB 12W - Wide - 114° horizontal field of view (FOV), 256GB 12WE - Wide Entry -  114° horizontal field of view (FOV), 128GB ... View more

25.9 is the latest stable wireless firmware.  We usually upgrade one or two sites to verify there are no issues then we do the rest of our sites in phases.  All have been complete for a couple of weeks and we haven't had any issues.  ... View more

Do they have distinctly different WAN IP addresses?  Or are they both using the same IP in a primary/spare setup?  Are there any other devices that could be connected to the WAN uplink that could use the WAN IPs.  Also you may want to consider using the virtual uplink IP feature.  Here is a paste from the documentation:   "Use virtual uplink IPs: When using this option, both MXes will use a shared virtual IP (vIP) when sending traffic out to the Internet. This option requires an additional public IP per uplink but allows for seamless failover because the IP address the network is using to communicate with the Internet will be consistent. The vIP for each uplink must be in the same subnet as the IPs of the MXes themselves for that uplink, and the vIP must be different from both MX uplink IPs." ... View more

We setup each port on the MX with the tenant vlan and deliver that port to their tenant suite via the home run.  Note we also provide DHCP from the MX.  That way in the tenant suite they can just connect their own switch, router AP etc or optionally we provide one of these  https://www.amazon.com/gp/product/B002HAJQGA/ref=oh_aui_search_detailpage?ie=UTF8&psc=1 and these https://www.amazon.com/gp/product/B004UBU8IE/ref=oh_aui_search_detailpage?ie=UTF8&psc=1 The AP above can be configured to just pass through the DHCP from the LAN   We played around with the idea of installing Meraki APs in the building and just doing SSIDs with their Vlan but ultimately decided not to since some tenants want to use their own hardware.   ... View more

We have a similar setup.  We have separate /24 vlans for each tenant.   Example: Vlan 1 10.17.1.0/24 Vlan 2 10.17.2.0/24   Then in Security Appliance>Firewall we create a supernet rule for each tenant vlan preventing them from getting to all other tenant vlans. We also setup traffic shaping to limit each tenant subnet to a predefined amount of bandwidth.  ex/ 10M   The only thing this does not do is separate their traffic from a public IP perspective.  Would be nice if I could 1:1 NAT some public IPs from our Internet interface to their vlan interface but not possible that I've found.  ... View more

You'll likely need to use layer 7 firewall rules to block the IP ranges or DNS names the service uses.  There isn't a predefined category for that type of service since the "Internet Communication" category includes Gmail and Facebook messengers.  ... View more

You'll likely need to use layer 7 firewall rules to block the IP ranges or DNS names the service uses.  There isn't a predefined category for that type of service since the "Internet Communication" category includes Gmail and Facebook messengers.  ... View more

If the locations have an MX they can do a VPN tunnel back to your core where the Radius server lives.  Then you can give the APs static LAN IPs to use to add to RADIUS.  Should be more secure to keep all that sensitive traffic in a tunnel vs traversing the internet.  ... View more

Also worth checking if your computer is whitelisted in the dashboard.  Many restrictions are not applied to whitelisted computers vs a standard policy machine.   ... View more

Are you wanting to add multiple admins from a single client or are you thinking about having to add admins as you loan it to different clients.  In that case I'd remove the prior admins and add the new ones so you don't get prior clients tinkering with a new clients experience.  But as far as I know there isn't a limit to the number of admins you can add.   ... View more