You Need to configure a Virtual IP on the MX that will „float“ between those two and stay on the active one. https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Virtual_IP ... View more

Yes: "You must have a secure web server that is accessible with a trusted certificate to be considered trusted." ... View more

It's described quite nicely in the docs:    You'll have to define the trusted Domain that will be resolved by a Trusted DNS server that will resolve a trusted hist URL Apart from that it's not really easy to troubleshoot your issued without further knowledge about your environment. ... View more

Which MX are you using for this? ... View more

The docs are quite good explaining it: Next-gen_Traffic_Analytics_-_Network-Based_Application_Recognition_(NBAR)_Integration    ... View more

Sorry, but there is any Secure Client license you‘d be able to purchase from Meraki. Strictly speaking, you’re not even allowed to use Secure Client without having the licenses in place. 🤔 ... View more

As I understood, MX is going through bigger architectural changes, so it's obvious that things will break. I also had a rather rough ride with this one. Therefore it's great to have you guys like @GiacomoS around here to be right next to us as users.   Just a rather personal side note: as a partner, I'm able to get quite good background on what's happening behind the scenes. Perhaps it would have been a good move to announce more prominently that this release contains rather huge changes in the background. I've never had huge issues with running Beta version before this one and it seems that a quite high group of users is running those because of that. Therefore, I can understand the annoyance in this thread. ... View more

ISE: Access-Request: User-Name = host/W10CLIENT.company.local Access-Accept: User-Name = W10CLIENT$@domain Class (25) AVP   FortiAuthenticator: Access-Request: User-Name = host/W10CLIENT.company.local Access-Accept: User-Name = host/W10CLIENT.company.local No Class (25) AVP Your FortiSomething is giving back the wrong Username and class. Therefore, it has to be configured correctly.   On a sidenote: why would anybody even think about replacing ISE with that FortThing? Serious question. ... View more

Just to get this straight: you're using Intune alongside System Manager? ... View more

Syslog is great, especially if you feed it into something like Splunk or an ELK stack. ... View more

You could be using Site-to-Site VPN translations, but IIRC this is an AutoVPN only-feature. ... View more

I even bet that these rules will work. 😉 ... View more

Support would be able to enable inbound rules.   Otherwise, you can restrict access inbound via NAT: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX#Detailed_(Secure)_Configuration ... View more

Not exactly what you're searching for, but does Okta give something similar like this? https://guide.duo.com/append-mode ... View more

As only one Metadata file can be uploaded at a time: it doesn't look like this is possible. ... View more

Seeing it too. Looks like a mixture of "Network-wide", and Insight. Sounds awfully like Catalyst Center. ... View more

Sounds like you want to go for Version 18.2 using Trusted Traffic exclusions https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Trusted_Traffic_Exclusions ... View more

SecureX (the base "product" for Secure Client Cloud Management is EoL: https://www.cisco.com/c/en/us/products/collateral/security/securex/securex-eol.html   As far as I know, it's planned to continue the Cloud Management platform, but I don't have any specific information about how this will look in the near term. Hope to get those infos on March 7th. ... View more

Sorry, but I still didn‘t get the point. What do you mean by  „So in this case I can solve this issue by making every client on the VPN not able to talk to said endpoint over group policy but I have to set this rule for every client in group policy to not talk to the endpoint.“?   you don‘t have to do it for every client themselves. That‘s what Group Policy is meant for?!   if you want to make specific policies for every client, just go for dedicated Group Policy for every client. These could be dynamically assigned by ISE e.g. ... View more

Filterung by IP is so 90s 😉   How about using Group Policies for specific Clients? ... View more

Everything you're asking for is described here: https://documentation.meraki.com/MX/Networks_and_Routing/Configuring_VLANs_on_the_MX_Security_Appliance   Anhing else that's unclear? ... View more

Another observation: Device Utilization went down noticeable:     ... View more