I think your diagram is pretty good.  I think it is 2195 and 2196 (2196 is APN feedback service). ... View more

Another person reported an issue like this and it turned out to be the MX trying to repeatedly do a firmware upgrade and failing. Traffic to and from the MX to the Meraki cloud does not show up in the portal. If you are still experiencing issues with traffic usage have support check your unit is not attempt to upgrade itself and failing. ... View more

Is there any chance you have another access point advertising the same SSID? ... View more

On the whole - if you aren't experiencing a problem I probably wouldn't put in place specific limits. ... View more

It will default back to using DHCP if it can not contact the cloud using the statically assigned IP address.   In the Meraki world - I can't think of a reason why you would want the management IP to be statically assigned assuming that DHCP is available ... ... View more

If there is no NAT configuration then the ASA must be routing your subnet block behind the ASA, and the upstream must be NATing that for you.   Regretfully, it seems that you wont be able to simply transfer the IP address from the ASA to the MX and have it work, since that IP address has no access to the Internet.  You will need your service provider to provide you with a subnet that can be applied to the outside of the MX that they will NAT for you, or a directl public IP address.   Sorry I couldn't resolve this one for you. ... View more

Look for lines in the ASA config that have the word "nat" in them.   I think if you ask the service provider that there will also be a line on the 2900 routing a public IP (or maybe even a block of public IPs) via the Gigabit interface in the router facing towards you, or via the IP address assigned to the ASA.  I think that the ASA will be NATing your outbound web browsing to this IP address. ... View more

My understanding is that it does - provided that the communications are not encrypted. ... View more

Was long as the device can still talk to the Internet, you still be able to manage it, ... View more

Yes - I have used this config a lot with Internet Circuit + MPLS.  You can use it for pure failover - or both circuits at the same time.   Clients I have deployed it at tend to use cheap high speed Internet circuits - so tend to get me to configure it to send this bulk traffic over the Internet AutoVPN and use the MPLS AutoVPN for everything else. ... View more

If the clients are in a different AD you need to export your CA root public certificate.  Then create a group policy in the AD that the clients belong to and add your CA public certificate to their trusted root authority certificate list. ... View more

Note the network mask you are using on your ASA is wrong as well.  It should be 255.255.255.252 to match the router.   However, this is not the cause of your issues with the MX not working. ... View more

I think I know what is going on. Can you supply your Nat configuration from the ASA please obfuscating the second and third octets. I think your outbound requests are getting nat'd to address space outside of the link subnet. ... View more

From the ASA can you do a ping to 8.8.8.8 and does that work? Does the upstream firewall have any restrictions on what the ASA IP address can access? ... View more

@lpopejoy wrote: Oh, btw, did you know the packet capture excludes traffic to Meraki management IP's?    I didn't realise that.  It must only do traffic passing through the appliance. ... View more

The layer 7 firewall blocks outbound requests, not inbound requests due to NATed ports. ... View more

There is no network wide summary report ...  there is a network wide clients report, but that is not the same as the Organisation summary report. ... View more

To form an AutoVPN over an MPLS network it is a requirement all the end points all go out the same end point and all be NATed to the same public IP address.   So when using AutoVPN over MPLS you must have a default route in the MPLS network pointing to one site, and that site must connect the MPLS network to the Internet.   Now you have the situation where "sitea" connects over the MPLS network to the Meraki cloud and is NATed to (say)1.2.3.4. "siteb" connects over the MPLS network to the Meraki cloud and is NATed to 1.2.3.4 Because sitea and siteb are NATed to the same public IP address they can now form an AutoVPN connection over the MPLS cloud.   https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS ... View more

To only allow specific IPs to get to your IMAP service go: Security Appliance/Firewall/Forwarding rules     Locate your IMAP forwarding rule.  Scroll across to the "Allowed remote IPs" columns.  Change "Any" to just the list of allowed remote IPs.  All others will be blocked. ... View more

Have you got an advanced security licence?  If so, go: Security Appliance/Threat Protection/ AMP Mode=Enabled Intrusion detection and prevention mode=Prevention Ruleset=Security   Secuity Appliance/Content Filtering Add: Bot Nets, Illegal, Malware Sites, Proxy Avoidance and Anonymlisers   Do the above till will gain you substantial protection - using dynamic lists rather than something manually configured. ... View more

I have not seen that - but I think I would factory reset the MX unit and let it pull a fresh config from the cloud. https://documentation.meraki.com/zGeneral_Administration/Support/Resetting_Cisco_Meraki_Devices_to_Factory_Defaults   Is it running stable firmware?     ... View more

This is very useful. Did you configure the Meraki WAN port to only use 1000/full (this is on the Ethernet tab of the local status page)?  This speed and duplex configured must exactly match what is configured on the 2900. As the ASA is working, lets assume for the moment it has the correct configuration.   We know the Meraki is reporting a basic Ethernet connectivity issue - so the issue is something close to this area.   I don't think a cross over cable will fix it - but I know we are facing some kind of basic Ethernet connectivity issue so I thought it was worth a try. ... View more

Don't be surprised if they experience lots of random drop outs and variable intermittent unstable throughput. ... View more

And can you get a copy of the routers interface with the IP address 10.x.x.17 (also with the second and third octet obfuscated)? ... View more