+1 on what @PhilipDAth said. But candidly, I try to avoid running anything like web or ftp servers internally.  Far less expensive and less risk for us to just get something externally hosted.  Then I don't have to poke any holes in my network.   ... View more

Just checked from my side and interesting that it only allows you to input a single AD server.  Especially since Security Appliance>Active Directory allows multiple (albeit unrelated).  ... View more

Interesting I had not heard of compact sfp before.  I did some reading and I don't see any documented support but the sfp technology is somewhat standardized.  Had you tried it in a Meraki switch yet or are you just doing discovery? ... View more

Another thing you may want to try is overriding the DNS on one of the computers to see if it makes a difference.  Try just using a static of 8.8.8.8 and 8.8.4.4 or something to test.  Could be some strange upstream DNS issue.  ... View more

And, of course, if you have any specific questions on best practices etc be sure to ask them here.  There are a lot of great people in this community that could help short-circuit your learning curve.  ... View more

Agreed, that doesn't look like a Meraki content filtered page.  Try adding that site to the whitelist to see if it changes anything.     Edit:  Try a different browser and computer as well.  Based on this could be a local thing https://support.mozilla.org/en-US/questions/1003223 ... View more

Depending on how your VLAN subnets are configured you may be able to supernet.  For example:   Engineering 10.0.1.0/24 Sales 10.0.2.0/24 Finance 10.0.3.0/24   Then you'd create 3 ACLs Deny Any 10.0.1.0/24 10.0.0.0/16 Deny Any 10.0.2.0/24 10.0.0.0/16 Deny Any 10.0.3.0/24 10.0.0.0/16 ... View more

Individual clients can certainly be restricted using policies as everyone pointed out above but you may also want to look into the Security Appliance>Traffic Shaping section to set some global limits.  There you can configure a global per-client limit (maybe 20M) in your case as a catch-all.  You can also configure Traffic Shaping Rules based on subnet range or service type.  For example, limiting 'All Video & Music' to say 10M.   ... View more

As you typed that I was thinking the same thing.  api_key should have been xxxxx indicating your API key 😉 ... View more

If you are using the Meraki Hub/Spoke I don't think you should need any static routes as long as the desired LANs are set to 'Use VPN' 'Yes'.  View Security Appliance>Route Table and search for the subnet of the spoke site and it should show something like this with a green bubble in the status.   Meraki VPN: VLAN Peer: Spoke Name - appliance ... View more

On the Security Appliance>Site to Site VPN page in the 'VPN Settings' section is your Local Network subnet set to 'Use VPN' 'Yes'? ... View more

I heard this as well.  Makes sense for them to acquire a solid Identity Management solution.   ... View more

You'd have to try to manually reproduce that to test it. But the lesser practical solution would be to get a static IP or better battery backup.  I'd be surprised if the MX doesn't keep trying to check it's port for a DHCP connection.  Also verify you are on the latest firmware.  ... View more

I don't get a captcha on that page? ... View more

I agree with all the above feedback.  This isn't really a new attack it is just a quicker way of getting the pw hash vs having to wait for someone to auth or to force it by sending de-auths.  Either way the hash still has to be cracked.    The Hashcat folks found this while researching ways to attack the upcoming WPA3 standard.  There isn't much Meraki could do for this since it is an inherent flaw with WPA2.  Moral of the story.  If possible, use a long password so it cannot easily be cracked via rainbow tables etc.   ... View more

You shouldn't have to mess with the multicasting settings.  If your ports between devices are Trunk 1 with allowed 2-6 or 'All' then you should be fine.   ... View more

Are you setting them as static IP?  If so double check the inputted information.  I've sworn they were the same only to find out I put the gateway and subnet in the wrong fields or transcribed a number wrong.  Always best to start with the basics and work up from there.  Then double check port config is the same etc.  ... View more

It may be possible to get 802.1x to auth on devices that support it but we run a separate dedicated wireless network and do mac whitelisting since most devices don't support 802.1x. ... View more

@HenningPedersen wrote: How do you plan to power the MV12 when using WiFi? I'd be interested in knowing this as well but I assume it is similar to Nest and Ring devices that require 110 power. Which, for me, it is easier to get an ethernet with POE to the device rather than 110 in most cases.  ... View more

Your best bet is to run some captures to see where the traffic is getting stopped.   ... View more

I don't think that is possible but is there ever a situation where you'd want your people to connect to the shared SSID in your building instead of the corporate SSID? If not then I'd say don't have the exact same SSID.  Each of you have different ones then you can just push that and it'll only connect when they are in that building.  ... View more

If I'm not mistaken, multicast traffic will stay within its VLAN.   What are you wanting to accomplish? ... View more

@PeterJames   Ultimately I agree, the reporting/alerting could be significantly more robust.  I've run into a number of scenarios where the alerting was limited.   ... View more