You need a Catalyst to do advanced stuff with ACLs, is what I would say. ... View more

I hate to answer a question with a question but is your telco provider limiting you to L2 or do you just have the switches and switch ports configured that way?  Even if you don't need it now, I would go L3 in case you need to add another VLAN in the future, or if you want to put ACLs on either side.     Of course if the telco is limiting you to L2 for whatever reason then you don't really have a choice.  Although I don't know any reason they'd do that, if they are dropping off straight Ethernet.  Which, if you have the circuits plugged directly into your switches, it seems they are handing you off straight Ethernet.   $0.02 ... View more

Even with a huge discount on Meraki gear, Ubiquiti is probably still going to be significantly cheaper and it will do the job just as well.  You'd have to get probably 75% or more off the Meraki gear to match it.  I have the full Ubiquiti stack - cloud key, USG, PoE switch and 2 AC-AP-Pro APs, the whole thing cost me less than $550.   Plus the Ubiquiti APs look way cleaner on the ceiling than Merakis do.  My wife loves the way they look, she says they are modern and sleek.  Maybe your wife doesn't care but I'm doubtful my wife would accept the look of Meraki APs on the ceiling.  She won't accept visible wires either, I had my builder put in the ceiling mounted drops and I'm glad I did.   I have fiber as well at my house but I don't pay the extra for the 1Gb service, I "settle" for 300/300 and I'm happy with the performance I get from the Ubiquiti gear.   Don't get me wrong, I love my Meraki stuff at work, but there's no way I would ever fork over that much more money on Meraki gear for the home.   For reference my house is a 2700 sq ft 1 story and I have one AP at the front and one at the back.  Coverage is amazing.   YMMV... ... View more

Dang, Krobert!  That's cheap!   My management paid quite a bit more for those.  Oh well wasn't my money, nor did I get to select the vendor. ... View more

While I don't use 100FX, I do use all 3rd party transceivers - AddOn brand.  https://addonnetworks.com/   They work fine and cost 1/3 of what the Meraki branded ones cost. ... View more

Redsector had a great answer.    However that said, I don't use any of these settings because the Meraki already has RSTP on by default.  I definitely don't configure them on Meraki-Meraki links because the expectation is to use RSTP.  In my mind you should only use these spanning tree options if the port is connected to a switch that doesn't support RSTP.   As for root guard - I set the priority on my core switches, a stack of MS425s, to 0, and that stopped the inter-vendor squabbling over who thinks it's root. ... View more

Getting back to this,   Some people are saying the beta 11.25 works better.  Has anyone who's had the MAC flap issue tried 11.25? ... View more

I'm with Philp.  This is 100% normal.  I have the 1.2k pings to 8.8.8.8 almost constantly and it doesn't even register in the top 20 of things going through my firewall in terms of throughput.   For what it's worth, I have a 100Mbps Internet connection at my site.  The connection doesn't start to get saturated until the firewall is transferring over 10GB every 15 minutes as measured on my firewall (not Meraki MX).   If 70MB is causing issues, you either have a really slow Internet connection, or you have other network issues. ... View more

I got my 6K Catalysts on the Meraki portal, by ripping them out and replacing them with MS425's. ... View more

I've been asked to do a lot of (stupid/impossible/whatever) things in my IT career, but I've never been asked to configure a VPN with no administrative access to the device on my end of the connection.  What.  A.  Nightmare.   You need console access, period.  Only then can a process be developed that might, I repeat might, be plug and play in other locations.  And it's wasted effort if it's not documented.   $0.02   As for running two firewalls, it's not necessarily a problem, it's one way to slowly turn up a NGFW, while keeping the traditional IPs and Ports firewall in place. ... View more

Markusg, what was the ultimate fix for you in the end?  Something later in the 11.2x branch?   I have a 425-16 stack acting as the core internal router in my network.  I can't be having these kinds of problems.   Any new features that come in the 11.x firmware probably wouldn't be applicable to us anyway, I have a number of MS42P switches that have a more limited feature set.   But in short, 10.45 works fine.  I'm sticking with it until I'm sure these issues in the 11.x have been ironed out. ... View more

The switch MAC is flapping, or the client MAC?  Which switch model(s)?   Yet another post that gives me pause about putting in 11.22. ... View more

I don't have any problem with the setting that you describe, Fozzy.  My native VLAN is also included in the allowed VLANs and it's also the managment VLAN.  Static IP set on all devices.  It works fine.   Exception being switches from vendor XYZ we have connected to Meraki switches - if you configure the connection as a trunk port, the other vendor switch will not accept having a native VLAN on the connection, so we don't configure a native VLAN on those.   (Vendor XYZ not being traditional Cisco Catalyst switches, if that helps anyone) ... View more

Yuck.  I can't be having packet drops.  Was it a particular VLAN or was it random?   I pushed my upgrade back again, to the first weekend in August.  I might push it back again after that.  11.22 is now shown as the stable version on that same page I posted above though. ... View more

How can you be sure that someone nefarious won't log into the computer itself using a local account?  It's already on the network, so if a bad actor was able to gain access, they could then start searching for other assets to compromise.   This could be mitigated somewhat by having the hard drive encrypted and a bios password set.  If those aren't done though, gaining access to a local account is fairly trivial for anyone who has physical access, with readily available hacking tools. ... View more

That's ok I'll just replumb it behind the non-cisco NGFW.  I just thought maybe I could get a quick win in the interface but it's probably just as well, I can put a lot more controls on the traffic if I put in through NGFW, it's just going to be a larger investment of time to create new network and security zones, policy and so forth.  But thinking about it more it's the better way to do it anyway. ... View more

I don't have the content filtering feature shown in your screenshot and in fact looking at this documentation: https://n38.meraki.com/THECB-Meraki-Net/n/ezZOJcM/manage/support?kb_article=4170 an "Advanced Security Edition" license is required to use it.  I assume this might require the MX platform as well, which we do not have.  We have the MS and MR platforms, but not the MX.   Maybe I wasn't clear enough in my post.  I am looking to block this traffic with the Layer 3/Layer 7 functionality built into the "Firewall and Traffic Shaping" part of the Wireless management category in the portal.  These are the categories that I have available:   not shown: 1 more category, "advertising"   ... View more

Maybe it's just me, but allowing AD machine accounts to connect to WiFi without authentication sounds like a bad idea from a security standpoint.  I would not allow this in my network.   Maybe only for something like a print server, and then only if interactive logins from non-domain admins was disabled.   But anyway.  Good luck. ... View more

https://www.1stop.com/meraki-10-gbe-twinax-cable-with-sfp-modules-1-meter.html?language=en&currency=USD&msclkid=bf05157772691428342f4863c8843272&utm_source=bing&utm_medium=cpc&utm_campaign=**LP%20Shop%20-%20Meraki&utm_term=4576510996935544&utm_content=16110_us%20%7C%20MA-CBL-TA-1M%20Meraki%2010%20GbE%20Twinax%20Cable%20with%20SFP%2B%20Modules,%201%20Meter%20%7C%20%2462.64   $62.64   good idea...the brown portion in the connectivity bar usually means "high proportion of CRC errors" ... View more

Yea stable is still listed as 10.45.  11.22 was shown on as being released on June 14th.  I'm going to let it stew in the wild a bit longer I think.  The other thing is that we are closed on Thursday/Friday for Independence Day.  My upgrade is scheduled for 7/7 at 00:04 (am).  I'd rather not have to think about this on my 4 day weekend.  If I push it back two weeks and there's no further version upgrade it will have been in the wild for 5 weeks roughly.  I'm pretty comfortable with that.     ... View more

That would be a tough sell in my mind, they will use that amount of bandwidth so infrequently, and what is on the other end that supports it?  Just personally speaking I don't have any servers that support 10G, so there's nothing to connect to anyway. ... View more

You need to configure both ports on the uplink for VLAN 903, if you want the MX, or any Meraki device, to use an IP on VLAN 903.  It's not going to be able to use a management IP on VLAN 903 if you don't have any ports configured for it.  It found an IP with internet access on VLAN1, (which is the default VLAN, or the same as no VLAN) so it used that.   This error is actually new(er/ish) in later versions of the Meraki software - it will try to find an IP if your settings don't work.  Which is what it's done here.  Before, in the older versions of the software, you just wouldn't get any traffic at all if it wasn't configured correctly. ... View more

[edit]  I really think this is related to the MAP flap issue, or the MAC flap issue is related to this.  I'm not convinced these STP messages aren't a product of the port just going down for whatever reason, and not the actual cause. ... View more

Mine notified me at 11.22 that it was upgrading in roughly 2 weeks.  Anyone else running 11.22, is it stable? ... View more