If you need netflow, buy traditional Cisco gear, simple as that.  I don't run the MX platform myself but there's no reason to denigrate it as "garbage" just because it doesn't have some advanced feature that you think it should.  The Meraki platform was meant to be simpler to manage, under the assumption that not everyone needs a Catalyst or similar advanced switch/feature set.. ... View more

@Brons2 wrote: I had problems with 11.22 also, see my thread "11.22 killed my call center".   I rolled back to 10.45 though instead of going forward to 11.28.  It sounds like I need to stay on 10.45 if I can't use port mirroring on 11.28.  I have mirror ports going to a security device, looking for lateral movement of malware.  I have no intention of disabling this.     That is a safe way to go for sure, so I respect that.   That being said, I am curious though if it was only because port-mirroring was enabling 'during' the upgrade process that it broke stuff.   I wonder if you turn it off 100%, perform the upgrade, and then re-enable post upgrade if it would still cause issues or not. Obviously I don't expect you to find out with your production environment of course lol, but just food for thought. ... View more

Just to close the loop, the issue stems from Sonos building their own Mesh network. If two units are hardwired and they're in close proximity to each other to build a mesh it causes a network loop that sometimes STP doesn't deal with. Sonos does not give you the ability to turn this "feature" off. Hopefully anyone else who lands here searching for a solution to this problem find this helpful. ... View more

For me the Meraki DHCP is great, easy to use, and pretty fail safe from my experience.  However, no P2P means some Apple functions (and others I'm sure) will not work. ... View more

>Or if you really want their email you could setup an excap.   I looked at doing that with my first customer that asked, then found SplashAccess could provide the service for less than I could get it built. ... View more

That is a crap experience!  I'd be pretty upset to.   None of this helps you, but just some of my personal experience. I used to use staged upgrades all of the time.  Now I don't use them at all.  Everything seems to work fine upgrading all of the switches at once. I had a customer with an MS125 and they were on 11.22.  We had just one of their MS125's (they have 7) reboot every 4 hours (closer to 4 hours and 10 minutes).  I don't know why.  Support didn't know why.  I was on the verge of doing an RMA but decided to try 11.28.  In my case, there have been no more reboots since then.   You've had a bad experience with 11.22.  So I have I.  I "down vote" 11.22 as a stable image.  I think it has serious issues. ... View more

Your topology is doing exactly what RSTP and classic STP does. So switch 1 is the RB so that one will have both links in designated state and forwarding. And all other switches will have equal cost on both links towards that RB.  But since sending port 48 is numbered higher, port 47 will be the Root Port FWD and port 48 will be ALT BLK on the other switches. So to fix your problem you have to make sure switch 1 port 47 goes towards the primary MX. I myself however prefer not connecting the uplinks of access layer switches directly to an MX but going through a CORE switch stack which allows for better east west traffic.  If both MX'es are in the same room you can also connect your MX directly to your CORE stack and then only two links i total would be blocked. ... View more

That sucks!   I bet it has something to do either with using IP protocol 89 (rather than being TCP or UDP based) or if it is OSPFv3 with it using IPv6 link local addressing. ... View more

I hear you but when we had a problem with location I got my usual case closed reply.  Mist surveyed the site plan, advised where they would place AP's to achieve location below 2.0m and replaced the Meraki for mist.  On 4 occasions we have had issues with the location. Our AP's where located as per the meraki standard and we aren't even within 20m in the raw data. Sent reports with data from our data scientists and they still responded with case closed.  Mist can achieve it and its only an integration so you can offer customers both depending on needs. Could honestly say have had no support or engagement in almost three years of building and selling a retail platform built on Meraki ... View more

@Asavoy wrote: @BrechtSchamp - A Catalyst 9200L is way more switch than needed for an offline scenario, not to mention cost prohibitive and 24port is the smallest (I believe).   @Tomek I would recommend a SG300-10MP or SG350-10MP switch if you need a managed swtich with some POE ports. Newer and much better than a 2960! Good point, I had disregarded the 8-port part. I was thinking of the regular 2960X. ... View more

I have a stack of MS425s with a /30 out to an external network, it works fine so long as you assign it to the SVI and not the physical member switches.  Set the /30 on a VLAN interface that is different from all your switch interconnects, and put in a static route for 0.0.0.0 to the router on the other side of the /30 external link.   If your Internet connection devices are set active/passive it will work on a single IP on the other side too, at least, with my firewall vendor it does.   For the internal switch interconnects, the SVI should act as the internal router/gateway.  Getting to the next level is then taken care of by the 0.0.0.0 static route to the device on the other side of the /30. ... View more

Thank you. I will try that. ... View more

I was thinking about this too.. Incorrect certificate.not sure though if from NPS side or client..   please correct me if I am wrong.. -- the cert stays on the NPS side locally - and simply validates if the local machine has them   About the local PC. - working fine when connects to corporate SSID [old NPS] - I deleted the existing cert.. and imported the new cert provided to me..   question: - do I need to delete the existing cert and manually import the new cert?     in 2016 NPS I noticed the ff: In Secure Wireless Connections: constraints/authentication method/ Microsoft : PEAP BY default we have our corporate wlan cert in there.. it didn't work..   When selected,  Windows machine does the ff:   Connects to test SSID Windows will provide option to “Connect automatically”  - this does not work and won’t connect Another option is to “Use my Windows account” – this also does not work and won’t connect Another option is to manually enter the username and password without the domain name. But still does not work. so I selected the Windows Azure CRP Certificate Generator certificate. background: we recently moved our machines to Azure..   When selected,  Windows machine does the ff:   Connects to test SSID Windows will provide option to “Connect automatically”  - this does not work and won’t connect Another option is to “Use my Windows account” – this also does not work and won’t connect   Another option is  to manually enter the username and password without the domain name.   This worked and showed an option to Show certificate details.  I checked the certificate and clicked OK. I am able to connect to test SSID. though I am not sure if the thumbprint shown in the cert is the correct one..   questions: - do you guys think this is a cert issue? in my opinion, it could be.. so i will get back to our systems team and verify which one is the correct cert since one worked.. - why do I have to manually enter the username/password? -does anyone have a documentation for server 2016?   many thanks!   Dip ... View more

Better is a relative term.   Meraki is easy, and it's Cisco.  Nobody ever got fired for buying Cisco.  Otherwise, they're wireless APs, what do you want them to do? ... View more

I disabled my local status pages.  Because auditors. ... View more

In my experience it takes a while for the web pages to update when you change the IP from DHCP to static on a new switch or AP.  I just wait. ... View more

Yes, the 2x 1GSFP is why I referenced needing to aggregate the uplinks as well.  However, if you don't have something that supports 10G on the other end I guess the point is moot. ... View more

@RobertoBonilla thanks for the update, I had the same issue so ended up using another device for my L3 routing. Not sure why they have this limitation but there must be some reason behind it.  ... View more

nice roof, beautiful location. ... View more

Options in DHCP are defined in RFC 2132, 3046 and 3495.  From the screenshot you took of your Microsoft DHCP, it appears the configuration you are trying to copy is non-standard.  You need to adhere to the RFC's and not assign your DHCP options according to your preference.  Vendor specific options start at 43.   iana.org has a good guide as to the expected option configuration per normal standards. https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml ... View more

> Right now, I don't have any devices in my house that use PoE.    Meraki Access Points can use PoE to power them ...   That's why an MX68 is quite attractive.  It is two PoE LAN ports. ... View more

>Are there any best practices here for uplink port configuration at either side? STP vs RSTP? Loop/rootguard etc.   Stick with RSTP.  It is better in everyway compared to STP.  You only have a single link between the sites, so the situation is simple.   I would lower the spanning tree priority on your core switch to make sure it is the root of the spanning tree.   ... View more

Is this something that is on the roadmap or chosen not to be? Is it possible to enable with software update later? ... View more

I'm with Philp.  This is 100% normal.  I have the 1.2k pings to 8.8.8.8 almost constantly and it doesn't even register in the top 20 of things going through my firewall in terms of throughput.   For what it's worth, I have a 100Mbps Internet connection at my site.  The connection doesn't start to get saturated until the firewall is transferring over 10GB every 15 minutes as measured on my firewall (not Meraki MX).   If 70MB is causing issues, you either have a really slow Internet connection, or you have other network issues. ... View more

Thanks for feeling my pain. My plan is to try to configure a port, which I don't know how to do, on our juniper to allow direct access to the internet in a secure way. Once it connects it should be plug and play. I talked more with those who are managing the device to get a better understanding of what they needed and what we were configured to do which is different from other location where they plugged the device into the ISP's router which gave them direct access to the internet. Hopefully I can find a juniper mx5 guru that knows how to do the port config I am talking about ... View more