With regard to Amazon AWS - you would be better off using the Cisco Meraki vMX100.  The advantage with this is it allows all sites to automatically build a connection to Amazon and your HQ.  This does not use the Amazon VPC VPN system so you don't need to pay per connection. https://meraki.cisco.com/products/appliances/vmx100   You don't mention how many users are in the satellite offices.  I don't like using the built in WiFi unless the site is very small.  The standalone access points have considerably more functionality than the built in access points.  In offices I most typically use MR42's.  The MR42 is a 3x3 MIMO radio (versus the MR33 which is 2x2).  The MR52 requires you either have an MGig port or channel two ports together to get maximum performance. I particularly like using the MX65 because it has a pair of PoE ports - perfect for powering a couple of access points.   What you you want to avoid doing is using an MX with a built in access point and a standalone access point.  The configs are completely different.  Avoid this config.  Using exclusively one or the other. ... View more

It would be great if you could mark my answer as the solution to your original question.   Every app has an ID. For example, the ID for the "standard" camera app is "com.android.camera".  This guide gives one way to get the bundle ID. https://documentation.meraki.com/SM/Tags_and_Policies/App_white%2F%2Fblacklisting_in_security_policies   It appears you can do wildcards as well (never done it myself.  So you should be able to do: com.samsung.*   I haven't done it for a while, but I recall doing a settings.applications/about option somewhere to get the ID. ... View more

You can't apply a group policy to an [MS] switch VLAN interface.  Can you be more specific how you applied this limit please, and the type of device. ... View more

ps. We actually use Systems Manager ... ... View more

You can selectively licence whatever you want.  You basically need a licence for every device that you will install the agent on. ... View more

You need both ISPs to connect to the same MX (or the same pair if you want to run HA) if you want to do load balancing (as opposed to failover).   Assuming you have some kind of fibre ISP circuit, you can trunk the ISP circuit across your dark fibre in a VLAN.   Ideally you want an ISP circuit which is using normal Ethernet encapsulation with static IP addresses rather than PPPoE. ... View more

The MS350-24X has both SFP+ and MGig ports.  Both are 10G capable.   For a server you should really use the SFP+ ports.  You would need an SFP+ NIC in your server.  If the server and switch are less than 5m apart you can use copper TwinAx cables (which come in 1, 3 and 5m lengths - a sample part code is MA-CBL-TA-3M).  SFP+ ports have considerably lower latency than 10GBaseT ports (which is why you normally use them with servers and storage).   MGig ports can auto-netogiate speeds of 1Gb/s, 2.5Gb/s, 5Gb/s and 10Gb/s.  Because of this you can plug in a 10GBaseT NIC to these ports.  Note that these ports do not support 10Mb/s or 100Mb/s, ... View more

Block the category "Software & anti-virus updates".  For the sub-category choose "software updates". ... View more

This is not a great solution.  Go to Organization/Overview.  Click on the "Devices" tab.  Click on the + on the right hand side and add the column "Uplink IP (Port 1)".   If the device is "up" and it has no primary IP address then the primary WAN/Internet interface is down.  Click on the column name to sort the column.  Sort it so that the sites with no primary WAN IP address are at the top.  Now you have a quick and easy way to see sites on 3G. ... View more

There are many solutions.   You could create a new SSID for the desktops (and attach the desktops to that specific SSID) and then limit the bandwidth of the other SSID.   You you use tags, and put the "general" SSID on all AP's except the one in question, and put the "desktop" SSID on the AP in question.   Assuming that an AP is near the desktops; you could increase the minimum allowed connection speed on the APs.  This would encourage other users to more aggresively roam to a closer AP and away from the AP near the desktops.   You could attach a schedule to the "general" SSID turning it off at a specific time of the day and leave the "desktop" SSID on. ... View more

The Cisco Meraki throughput test is from the Cisco Meraki device to the Meraki test server.  This will will go via your ISP, their transit links, and finally to Meraki.  You can consider it a measure of the quality of the bandwidth you are getting.  Their is also no guarantee that the Meraki test servers can sustain any particular level of throughput.   On the other hand, if you are connected via a reasonably large ISP, then more than likely the local "speedtest" node will actually be inside of the ISP network, so you are only measuring the performance of your link to your ISP and no further. ... View more

I normally turn 2.4Ghz off all together for corporate networks.   I tend to use band steering on guest networks, and I haven't had any customers report any issues back to me. ... View more

I've only ever added it using Google Authenticator,   It comes up as: <email address>/Meraki ... View more

I have tried to do what you have mentioned - but I think the API is more designed around provisioning devices rather than extracting information. ... View more

I'm in a different country to you and don't use Verizon, but we have used 4G and haven't had any issues with volume reporting., ... View more

When it says "AD" it is really LDAPs.  I don't see why you couldn't point it at any LDAPs server. ... View more

A Z1 can't do advanced security - but you can use it in an Organisation that has advanced security licences. ... View more

When you setup the client VPN option using Active Directory it does use LDAPS. https://documentation.meraki.com/MX-Z/Client_VPN/Integrating_Active_Directory_with_Client_VPN   I don't think you can apply dynamic group policy to users VPNing in.   I have never attempted it - but you may be able to do something for users that have an MDM agent installed onto their machine, and using a dynamic tag to assign policy. ... View more

We have had problems when content filtering is set to use the "full" list.  We changed to using the "fast" method and it worked much better.   We have since changed to using Beta firmware and both options work properly again. ... View more

If you have "just bought" the licences go to Organisation/Licence Info.  The licence will show up with a "undo" button that lets you remove the licences.  Make a note of the licence number, and then you can add them to your new organisation. Note they have to have been added recently for this to work.   The undo button goes away once the licences have been there a while. ... View more