I'm just looking for user experiences on someone who's moved DHCP from Windows to Meraki on wired LANs, assume from a help desk perspective.  Something like "oh I switched to Meraki DHCP and I had problems with clients not getting IP address leases" or  "switching to Meraki DHCP worked perfect compared to Windows Server DHCP" or "I didn't notice any difference from my prior DHCP solution"   I will set DHCP up on L3 interfaces already present at each site. No other switch, site, or WAN modifications would be made. ... View more

I have a stack of MS425s with a /30 out to an external network, it works fine so long as you assign it to the SVI and not the physical member switches.  Set the /30 on a VLAN interface that is different from all your switch interconnects, and put in a static route for 0.0.0.0 to the router on the other side of the /30 external link.   If your Internet connection devices are set active/passive it will work on a single IP on the other side too, at least, with my firewall vendor it does.   For the internal switch interconnects, the SVI should act as the internal router/gateway.  Getting to the next level is then taken care of by the 0.0.0.0 static route to the device on the other side of the /30. ... View more

The 8 port 2960s are end of support.  If the requirement for being offline is for security, I can't imagine that throwing a switch into the mix that may have software vulnerabilities is a good idea.  Malware can move laterally from an Internet connected device into non-connected networks.  I'd look for something that is a current sale Cisco switch like SG200. ... View more

@Nash yes, my network is architected as you say, it's the traditional network design.  The aggregation layer is a stack of MS425s.  However, the OP is only talking about 8 switches, it doesn't seem like a big ask to plug them into the MX.   On a side note, our firewall vendor actually advertises the ability the flatten your network and let it do all the internal core functions.  We haven't actually done this, but it's pretty tempting when the MS425s are up for replacement.  Firewall vendor X supports everything the MS425s are doing.  Yes, it's not the customary network design, but the only constant in the IT world is change. ... View more

Yes, the pace of innovation seems to me to have slowed since Cisco acquired Meraki.  But I still like the feature set generally speaking, it doesn't have all the bells and whistles of Mist but it's effective for what we need.  If we all adopted the latest and greatest thing every time it came out we'd all be broke. ... View more

The MX250 cannot handle having more than two switches connected to it at a time????  A firewall with a rated throughput capacity of 4Gbps, 8 copper gigabit and 16 fiber 10Gbit capable SFP+ slots?  You can't be serious.  Really?   If this is really true, you should return the MX250 to your Cisco vendor and, assuming you can't get your money back from Cisco, tell him or her you want a Cisco Firepower 2120 or 2130, which can handle 3Gbps and 5Gbps respectively.  I don't personally run Firepower but it's the product that's gotten Legacy Cisco back in the leaders' quadrant in Gartner for enterprise firewalls.   I am happy with our Meraki switch gear and APs but would not consider the MX from what I've read in these here forums.  I don't have anything else positive to say about the MX, so I'll just leave it at that. ... View more

I was curious about this, so I did some more reading.   https://support.sonos.com/s/article/3235?language=en_US   It appears that you only need *1* Sonos device connected to the wired network and that device will create a separate wireless network just for your other Sonos device(s).   So if you have the controller and the Play:1 both connected to the wired, you may be unintentionally creating a routing loop where the Play:1 is joining both the wired Ethernet from the MS210 and the WiFi network from the controller, which goes back to the MS210.  It sounds like the Play:1 should join the network that the the controller creates.   caveat:  I don't own any of these Sonos devices. ... View more

What happens if you set it up as an access port on VLAN1?  I mean I know Meraki tries to make things as easy/foolproof as possible for the most people as possible, and a Trunk port with native VLAN 1 should work for most things.....   ....But access on VLAN 1 is the proper setting for pretty much any switch manufacturer that isn't Meraki, if you're not using custom VLANs.  Trunks are normally reserved for links that need to carry multiple VLANs on switch-switch links or switch-firewall, switch-router, etc.   ...rant off.... ... View more

I also add explicit deny/any to all our internal subnets on the guest wireless SSID firewall rules.  On top of that, the guest wireless is pure L2, and the default gateway is the (non-meraki) firewall which for sure isn't going to let wireless clients get out of line.   The SSID L3 firewall rules do now allow an explicit ICMP deny, so maybe for some of the people that tested back in April, that is a new feature.  I don't recall it being there when I originally set the wireless up on Meraki gear some years ago.  But now ICMP is in the dropdown on the "Protocol" column. ... View more

I don't have any issues, but then again I'm not running 2016 on the local site domain controller. ... View more

well, I was about to upgrade the local DC to 2016, glad I didn't do it yet.  The other DCs in the organization are on 2016 but the local is on 2012R2.  I don't have any problems with Windows 10 clients on 2012 R2. ... View more

I pondered "Per-AP multiple VLAN tagging" a bit more over the weekend.   It seems to me that, from a network design standpoint, that this feature would only be desirable if you were running the same SSID across multiple physical sites/branches, something to where a large flat network would not be desirable due to latency.   Am I missing something? ... View more

WEP key?  WEP has been insecure since, oh, 2001.   "Depending on the amount of network traffic, and thus the number of packets available for inspection, a successful key recovery could take as little as one minute" https://en.wikipedia.org/wiki/Wired_Equivalent_Privacy   Perhaps you meant WPA.  I hope so.    If not - I'm not surprised Meraki couldn't fix it.  They probably have no interest in fixing it, what with WiFi 6 and WPA3 coming out.  It doesn't make much sense to support deprecated, insecure protocols, in my opinion. ... View more

You're using L3 roaming so you don't run out of IPs?  If you're using VLAN tagging for your SSID, you'll get the number of IP addresses that happen to live on any IP subnets on that that VLAN regardless of whether it's /30 or /8.  Like the example below, the VLAN which I blacked out, has a /23 on it, it's for our public wireless and is carried on all floors.  I haven't encountered a situation where we needed more than 512 guest IPs - yet.    Which is another thing - you have different SSIDs for different floors?  Why?  If I have a meeting on another floor, I have to go join another wireless network?  That seems unnecessary to me.  Roaming to a different Meraki AP in our network is pretty transparent.   ... View more

Better is a relative term.   Meraki is easy, and it's Cisco.  Nobody ever got fired for buying Cisco.  Otherwise, they're wireless APs, what do you want them to do? ... View more

I disabled my local status pages.  Because auditors. ... View more

In my experience it takes a while for the web pages to update when you change the IP from DHCP to static on a new switch or AP.  I just wait. ... View more

We don't run MX, we run a competitor's firewall, but the way I do it is just have a different NAT rule for the public wireless on my firewall than for other VLANs in my network.  In addition the public wifi is layer 2 on the inside zone and the gateway address for the subnet is a subinterface on the firewall.  I have the luxury of having a /24 on the outside but you should be able to do it with a /29 also if you have at least 1 free IP. ... View more

Yes, the 2x 1GSFP is why I referenced needing to aggregate the uplinks as well.  However, if you don't have something that supports 10G on the other end I guess the point is moot. ... View more

These reports such as Forrester and Gartner, are biased towards larger enterprises.  We had a CIO a while back who only wanted to purchase products from the Leaders quadrant in Gartner, suffice it to say that, it cost us a lot of money.  One size does not fit all.   Meraki is probably the easiest to manage solution that is out there.  I would sell your customers on that.  Or if they get riled up about Forrester, point them to the Gartner report where legacy Cisco and Meraki were not separated for purposes of the report.   Barring that, you could offer another product line if it's what your customers want. ... View more

nice roof, beautiful location. ... View more

The MS250s support half duplex, I have a couple of large room type audio devices that run 10/half.   The switching capacity is the same between the MS250 and MS350:  176Gbps.  However, the MS350 has double the stacking bandwidth.   https://meraki.cisco.com/products/switches/ms250-48#compare     ... View more

Yes the MS120 will support the aggregation but I would suggest that there may be other limitations to the 120s that you're not thinking about.  For example these only support a 1G uplink.  You'd need to aggregate your uplinks as well, in order to support 2Gbit to the APs.  And while the 120 does support VLANs it's more like L2+, basically only supports static routing.   The MS250-24 is the smallest switch that supports L3.  It also supports redundant power, which I would suggest is pretty important if you don't want to be troubleshooting an AP outage in the middle of the night.  And it has 10G uplinks.  I have a bunch of these and they are great switches.   If you don't have the budget for that, the smallest switch that supports 10G uplinks is the MS125-24. ... View more

Options in DHCP are defined in RFC 2132, 3046 and 3495.  From the screenshot you took of your Microsoft DHCP, it appears the configuration you are trying to copy is non-standard.  You need to adhere to the RFC's and not assign your DHCP options according to your preference.  Vendor specific options start at 43.   iana.org has a good guide as to the expected option configuration per normal standards. https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml ... View more