If I'm interpreting this correctly, this will have been instigated by a change in the Meraki setup by your own Organization admins.    I would suggest you contact your own people prior to speaking with Meraki Support. ... View more

I'm not 100% certain, but I think it likely that the cellular IP is a dynamic IP (probably an RFC1918 one) allocated by the mobile carrier to the mobile data link itself, which will then be (Carrier Grade) NATed to a general public IP, unless you order an appropriate data plan for your SIM. ... View more

@Bruce    I really appreciate your input, Bruce.  I will make sure to keep this in mind and configure accordingly.     Thank all you guys for your help on this.   Originally, I was doing networking more in depth, but I moved away from it for a few years as a Telecom Manager for the State (GA Dept of Public Health).  I am now back to doing this and looks like I have gotten rusty on a few things.  I "discovered" the Meraki product and it has surely made networking life easier than it used to be.    I know I will be posting here quite a few times in the future for tips and information - Hopefully, you all will not tire of giving me advice here and there.   ... View more

You will need to line up the mobile data connection for that MX via wired uplink, beforehand.   It's not possible to do ZTP via LTE connection only. The modem in that MX supports up to 300 Mbps, I believe, with the very best of coverage etc.    In practise the chances are you may not get that, but I gather the limiting factor is often the capability / flexibility of the carrier's infrastructure to support all the relevant standards. If you need VPN to work, this can be limited/prevented by carrier grade NAT implemented on the carrier's network;   a SIM designed for a data-specific plan is usually the best approach. ... View more

Almost...   You have to tell AWS what traffic to send to the vMX:  all the IP subnets that you want to be able to access your AWS resources,  at the sites on the other end of the AutoVPN tunnels.   You don't want all your AWS traffic going out through the vMX - it will be a one-armed VPN Concentrator, not a firewall to protect your AWS instance.   Of course, those subnets might still mean all the traffic... ... View more

Are you using AutoVPN on your MX? ... View more

Content filtering is ON.   Standard no porn, no malware, no spam, etc. categories.   Using the URL lookup tool, the content resolves are Business and Economy which is not a blocked category. ... View more

Why would you want them to access the Internet by hairpinning in and out of the other site?   Why not have their local MX split tunnel (don't tick the Default route box, when configuring the AutoVPN tunnel to the Hub).   make sure you have the Advanced Security license. ... View more

@Craieggg Thanks for the information I will work on those processes. ... View more

Thanks for the help @GreenMan . Your explanation really clears my query.  ... View more

>So, there is no API to extract the video with the detections even post-capture right?   You can use MQTT and it sends you the rectangle coordinates for every object in the frame.  You can then draw the rectangle on top of the image yourself.   This is the specific MQTT reference: https://developer.cisco.com/meraki/mv-sense/#!mqtt/raw-detections-a-list-containing-object-identifiers-oids-and-their-x-y-coordinates  ... View more

I'm with @GreenMan .  Disable the WiFi on the Z3 and get something like an MR36.   The first thing you'll notice is the better coverage the MR36 provides.  You can position the MR36 closer to the middle of where you need coverage (you still need to get a cable to it). If you need, you can then getting a second MR36 for MESH.  Note that your throughput drops by more than 50% when using WiFi through that MESH MR.     Going sideways; I've had a good experience using the DLink power link extenders (which extend your network over the power lines in your house) ... ... View more

Good job on solving the Checkpoint issue.   The reason you couldn’t use the /16 is because if you do then the subnets for both locations end up being 143.161.0.0, and you can’t have that if you want to send traffic between them. (Each octet in an IP address is 8 bits, so a /24 means the first three octets define the subnet, whereas a /16 means only the first two octets define the subnet).   If you’re using a /24 at each site, you have 254 available IP addresses per site, so if you’ve only got 20 devices (even 50) that’s more than enough. The VPN can work for all the devices on the network, but that depends on the routing being setup correctly, and the network segmented properly. ... View more

Thank you for the response. Will try doing the CSV part and let you know I get on.    Really appreciate your assistance.   Regards,   Toheeb ... View more

Generally testing means connecting something to it - preferably your 'thing', used by your people, accessing your apps in your way.  Free trials are definitely the best  😁 If you just want to see something configured, you may be able to go through your Meraki account team, to get a demo - it depends how involved that is.   You may be able to get something similar from your preferred Cisco partner, too. ... View more

I double-checked this one with the PM team;  the sheet is correct - the PHY requirements of that plug-in can't be met by MS125 ... View more

Update: I enabled ICMP and was able to ping and connect via ssh, after exiting terminal session, I asked a remote colleague to connect via ssh. He was able to connect successfully after a few attempts. Subsequently asked him to exit session after which I tried to initiate a ssh session and the request timed out. He can continue to connect (login) but my ping / ssh sessions time out. It seems that once a session is established it locks out all other requests - still trying to figure out the duration - whether it's temporary or in perpetuity. ... View more

I think you'd just order MS390-48U instead. ... View more

I have checked and confirmed that all vlans on both ends of the trunks are identical   I did enable udld to enforce and stp loop guard on my agg trunk ports    the udld is causing an error from a neighboring switch that is connected to the same core not directly connected to the stack that is throng the error       ... View more

Awesome. Glad it resolved your issue.   Good luck with the rest of your project ... View more

@M4TT we have our DC MXs set up as @GIdenJoe said.  They have been completely trouble free for a year or so with 8 remote sites over dual connected SD-WAN and an increasing number of homeworkers with either small MXs or Z3s using the supernet method described.   We use Sophos XGs as the main internet facing firewalls and their NAT plays nicely, I believe Palo Alto does not, not sure about other vendors. ... View more

We'll be happy to help, but don't forget - your Meraki license buys you 365-day, 24 x 7 access to Meraki Support.   If your query is urgent, picking up a phone gets maximum priority over email / cases raised through Dashboard.  (check out Help > Get help, top right of Dashboard) Remember to check out the Meraki documentation pages before asking - the aim is that the KB articles are 'Meraki-simple' to access and understand - plus you're likely to get pointed there, if that's where the answer is available, whomever you ask   😁   https://documentation.meraki.com/   So, just by way of example:   https://documentation.meraki.com/zGeneral_Administration/Support/Contacting_Support Enjoy your Meraki journey! ... View more

Our intention is to pool / load balance the bandwidth. ... View more