To do this you'd have to put the ACL in the Group Policy, and then assign the GP. You cannot directly assign an ACL via RADIUS.      ... View more

SNUGGIES!!!   ... View more

Do you mean PPSK? If so PPSK is an Aerohive thing. You don't have that option on Meraki.   For simultaneous logins, you can control that via NPS with RADIUS Accounting.  I'll see if I can find an example... ... View more

No. If you split the appliance network out of the combined network there's no impact.   If you're just doing an upgrade though I would remove the existing MX100 and then add the MX450 instead of messing around with two networks. You'll have to adjust the physical ports configs, and deal with cabling, but I think it's easier than trying to clone the network.  ... View more

Jeez... You can *almost* do this with Priority... but In the end it'd be a bit of a kludgey set up. You'd have to trick the MX into thinking it had a bigger pipe than it does, and get creative on the Traffic Shaping policies...     I'm not sure it would work exactly as you want either 😞   ... View more

  @NolanHerring wrote:     As for your client-VPN, if ISP 1 goes down, even using the vIP, then I would imagine you lose your client-VPN even though ISP 2 is alive. Maybe @jdsilva knows if that DDNS he mentioned earlier solves this? Yup, it will follow.    Meraki went and changed how you configure DDNS in the last week or so... It used to tell you which name was which, but now it's just lists the 3 DDNS names you get without explaining what does what.     If you use the DDNS name I circled you will always point to the IP of the "current primary uplink", doesn't matter which uplink port, or which MX that is. It'll even change to the cellular IP if you have a USB cellular modem connected.  ... View more

Hey @BrandonS   Nope, it is not good. Don't do it. Bad things can happen. Traffic may be blackholed, or other general instabilities (I had interesting STP TC's being generated leading to an unconverged network) Nope. You can use one switch. But then you have redundant MXes and a single MS... You have to decide how far you want to take redundancy.  Use the Virtual IP feature on the WAN for this. Then clients always connect to the VIP which is on the active MX. Or, if you cannot use a VIP then use the DDNS built into the MXes. The current active primary DDNS name will always point to the active MX. That's correct. User's are NAT'ed to the VIP(s), so that's what need to be whitelisted by a *aaS provider.       @BrandonS wrote: Can someone help me clear up some doubts about how to configure this?  I have read https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair and also https://www.willette.works/mx-warm-spare/   1. Is it not good to connect the MX's directly to each other anymore?  Do I need to care why? 2. Do I need 2 switches also?  I prefer to have one switch only and only have HA for if one internet goes down or one MX fails.  For this instance I am not concerned about 'core' switch failure. 3. How do I handle client VPN if one internet fails?  Users need to know two different IP's to connect to potentially? 4. This customer uses public IP whitelisting to access some cloud services.  I am not clear on the VIP configuration.  I will have one VIP from each ISP that would need to be whitelisted by the service providers I guess?   Thanks for any help.  I have been working with Meraki for some time, but not yet configured HA.       ... View more

@CarolineS I LOVE THE SWAG!   I'll refrain from posting a picture until everyone has received theirs and sees what it is 🙂 ... View more

Really? I didn't think there was CoS bits in the PPPoE header... That's new to me. I'll have to Google that...   There's no way to set that in the MX. You can't set CoS at all on the MX as near as I can figure (DSCP only). If it's really CoS they want you might need to add a VLAN tag on the WAN side since that's where those bits are.   Unless someone else here has another suggestion I'd call support and see if they have some way to set this for you. ... View more

Oh... Hah! I forgot that was hidden behind an NFO. We have it enabled on all our Orgs so I always just see it. Nice catch. ... View more

You can set the SNMP server to receive Traps on the Network-wide > Alerts page. This is not a mandatory setting; you only set the server if you wish to receive traps. You can still poll the Cloud or your devices just fine as long as the other SNMP settings are set up correctly under Network-wide > General. ... View more

Try this:   https://documentation.meraki.com/MX/Deployment_Guides/MPLS_Failover_to_Meraki_Auto_VPN ... View more

Yeh definitely not. You must use different ranges for the LAN and Client VPN. And WINS is ancient... Unless you have really old clients still using netbios you also don't need that.   So are you using the private IP on the RDP then? How is that working right now? ... View more

If you're connected via Client VPN you shouldn't need a port forward. In that case you should just be able to hit the private IP of the server directly, assuming no other firewall rules are blocking and routing is correct.    Are you using VPN for the file sharing?  ... View more

Oct was a fast month! Which is weird as this is the first month since April I haven't been out of town travelling for some reason or another.    Thanks as always to @CarolineS and the rest of the folks at Meraki minding the Community. And welcome to the MOTM @MacuserJim! It's well deserved as you've been putting out great posts.   Haha thanks @PhilipDAth!      ... View more

Correct.   ... View more

LoopGuard is to protect against uni-directional links. So yes, even if there's only one uplink it can be useful.    However, my personal preference is to use UDLD over LoopGuard.  ... View more

I'm assuming you're taking about Meraki Insight?   https://documentation.meraki.com/MI/Meraki_Insight   For custom applications you simple specify the URL and Insight does the rest.   An couple important things to note with Insight is for custom applications it can only track HTTP/HTTPS over ports 80 and 445 respectively, and to get any data at all traffic must go through an MX appliance. So if you have internal applications you have to route that traffic through an MX somehow.    I don't have a lot of experience with it, but in the little I have used it it seems to do a good job. There's a good amount of metrics and data in there. ... View more

Sorry, I didn't mean to spout cryptic jargon at you 🙂   I was referring to the version of firmware on the MX. The firmware for the MX is referred to as "Wired" whereas the switches are "Switch" and the AP's are "Wireless" You can see this in the Organization Overview page in the Dahboard (you may need to use the little + in the top right to add the column to the page).    The most recent versions are version 14.x, with 14.34 being the absolute latest (beta).   I agree that it might be a hard sell to point to the ISP, but something is "stuck" somewhere. What does the Dashboard say about the MX when there's zero upload? Is it still showing online?    I'm not sure what you can do to troubleshoot unless you can somehow tap the link between the MX and the ISP CPE device and do a packet capture. If the MX is online then you can do a packet capture from the Dashboard... But if you can do that then MX can talk to the Dashboard over the Internet via your ISP... So then the problem might be on the LAN?         ... View more