In this case, to be specific, what you want to do is forward ports. And unfortunately you cannot forward the same port to multiple internal IP's at the same time. You have two choices:   You can forward different external ports to your internal camera on port 9000. So 9000 goes to cam1 port 9000, port 9001 goest to cam2 port 9000, port 9002 goes to cam3 port 9000, and so on. You do this in the "Port Forwarding" section on the Firewall rules page. You can use multiple external IP's to forward port 9000 to multiple cameras. So 1.1.1.1 port 9000 is forwarded to cam1 port 9000, 1.1.1.2 port 9000 is forwarded to cam2 port 9000, and so on. This is done using either 1:1 NAT or 1:Many NAT on the Firewall rules page. ... View more

I'm not aware of any reason not to trunk, other than, as you stated, throughput.    Most networks I've built in the past would have an L3 aggregation switch terminating the user/server subnets, and then route on to a FW or router as required, but in smaller networks as you're mentioning I would have no problem just trunking that up to an L3 device. A lot of what I'm doing in my current role is using that design.      ... View more

@mklein wrote:   is there any possibility to copy GROUP POLICIES from one network to another?   Nope. Not possible 😞 ... View more

I'm back in the office after a week in San Francisco. First order of business is assembling some ML! Thanks again @CarolineS! So awesome 🙂       ... View more

I'm pretty sure the MX L2 ports are full speed non-blocking.  ... View more

First off you should realize that it doesn't matter what you mark your traffic when you are sending it in a VPN over the Internet. The Internet doesn't respect your markings. It laughs at your markings. It spits on the ground in front of your markings. It farts in the general direction of your markings.    😉   But, for inside your own network, what @NolanHerring says is bang on. Well... Almost bang on, depending on what version of firmware you're running. As of version 14.5:   And then tweaked just a touch in version 14.6:     In our testing this has worked exactly as described. So at the end of the day, for Voice payload, as long as your end points are marking their traffic correctly and your switches trust those markings (or if you're marking on switch port ingress) you don't actually need to do anything on the MX. It's already doing it.    Video is obviously not covered here as it shouldn't be marked EF, so normal rules apply.  ... View more

@NolanHerring almost caught you this month @PhilipDAth... If you're slacking off this month he's liable to get ya 😉   I'm travelling this week, and a bit for xmas coming up, so It's not likely to be me that overtakes top spot. ... View more

I just ran into this last week and that account MUST be an admin. It didn't work until my customer elevated the user from user to admin.    Something's different in the setups... ... View more

Thanks Caroline!  Welcome to the club @NolanHerring! Nice work as always @PhilipDAth and @MacuserJim!     ... View more

@jdsilva wrote: What version of STP are the F10's running?   ... View more

No. You need these to all be statics to work correctly. If your provider is giving you dynamics then you won't be able to set up a VIP on the WAN. ... View more

What version of STP are the F10's running? Are all ports configured as trunks? Are native VLANs consistent?   Edit: Oh, some of that is in there.. Just upside down. Can you fix the picture? ... View more

@Adoos This is what failed means:    https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover     ... View more

Ahh, ok maybe you're looking for something more like this diagram. I put this together when I was working on a project where the customer wanted to use a third party analytic company to do an Excap in conjunction with the Scanning API data to do targeted marketing and other nonsense.    Disclaimier, this was just me poking around with WireShark and trying to decipher the OAuth and OpenID specifications... This is not a Meraki doc, and I would be real money I don't have this 100% correct, but I do think it is a good overview of doing this with an Excap.    ... View more

@NolanHerring wrote: Out of curiosity, the client that is VPN into your network. What is their local subnet setup for? Is it also 192.168.1.0/24 ? Hah! Nice catch. I looked at that and it didn't even register.  ... View more

https://meraki.cisco.com/lib/pdf/meraki_whitepaper_captive_portal.pdf   Is that the kind of detail you're looking for? ... View more

You don't have any oddball firewall rules that are blocking this by chance?   And when you say they can't connect, what do you mean by that? What are you trying to do exactly that's not working? ... View more

Nope, there's no way. ... View more

@NolanHerring Wireless logs aren't available from an MX. You must be looking at a combined network 🙂 ... View more

IMO I wouldn't filter the Syslog form the MX. All that flow data can be ingested by a SIEM as well. If it was me I'd send everything available.  ... View more

@PhilipDAth I took this to mean that @Mju is looking for a device to terminate the *PON fibre, likely onto the Internet side of an MX.    This is only my opinion, but I doubt that's ever going to happen. I don't see how it would make sense for Meraki to get into that business.   ... View more

Haha now I want the MV72 Bathtub Cam to be a thing 🙂   Or maybe, for privacy reasons, it should be an Aquarium Cam... ... View more

Nope 😞 ... View more

These features aren't related. You wouldn't use one over the other as they do completely different things.     ... View more

Haha! I've had that before too. You know what it is? If you stick it into a file, and give it an .html suffix, and open it in your browser, you get this:   ... View more