You have to enrol the device in "Supervised" mode, and then the MDM can wipe the phone without it being an issue.   To get a phone into supervised mode you have to use Apple's DEP program (an Apple requirement).  It is painful.  You can read about it here: https://documentation.meraki.com/SM/Device_Enrollment/Using_Apple's_Device_Enrollment_Program_(DEP)_with_Systems_Manager   Actually, you can also use Apple Configurator (note that this is only available for Mac's - not Windows): https://documentation.meraki.com/SM/Device_Enrollment/Enrolling_and_Supervising_iOS_Devices_using_Apple_Configurator_2.0_or_Later ... View more

Negative.  You need two cables to create a ring. ... View more

I disagree with nearly everything you say.   I've written several password breaking tools for Cisco products: http://www.ifm.net.nz/cookbooks/cisco-ios-enable-secret-password-cracker.html http://www.ifm.net.nz/cookbooks/passwordcracker.html   The larger the source pool of characters that the password is drawn from the more time it requires to crack.  An 8 character password that consists of only letters (and where this is known) is considerably faster to crack than an 8 character password that consists of letters, numbers and special symbols.   Any modern password system does not store passwords in an easily reversible manner.  Having the crypted version of the password is just the starting point of breaking the password.  The more complex the password set of charcaters the more time it takes to break the crypted text.  A long strong password combined with a good algorithm can be impractical to crack because of the huge amounts of CPU time involved.  Pretty much if the algorithm requires more than 1000 years of computing time on high end distributed kit you are pretty safe.   I do agree that if the unencrypted passwords are captured by a key logger then you are screwed.  You need two factor authentication to mitigate that threat. ... View more

AutoVPN uses IPSec.  TLS is not used. ... View more

I think nearly all of the options mentioned would work.   Take a read of this document, and search for "Layer 3 roaming with a concentrator" and the section after that one. https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment   I suspect you will be wanting to use "Layer 3 roaming with a concentrator" mode. ... View more

There is a cert on the AP and that is used to authenticate with the cloud but I can't observe that portion of the communications as it is already encrypted. ... View more

I don't see any point in running all traffic through the ISR when the only thing it is processing is PRI voice traffic.  I would plug it into the Meraki switch using a single Ethernet interface.   You could even put the ISR and all the phones into a separate voice VLAN. ... View more

I just did a packet capture on an MR42 starting up.   It negotiated a TLS1.2 connection.  The server it was talking to had a SHA-256 signature on its certificate.  I couldn't verify the client certificate.   You can not replace the burned in certificates installed in Meraki kit.  If you did - then they would fail to authenticate and get their configs. ... View more

I can't think of any way to do that. ... View more

I don't know the answer.   In a Windows environment you have both user and machine credentials, and by default both are used.  First the machine one when the machine is first powered on, and then the user one when the user logs in.  That that user logs out and another user logs in then the user is 802.1x authenticated again.   In Windows you can also configure a policy to only do machine authentication.   It sounds to me you need an option like this for the Mac - machine only 802.1x authentication.   This forum post seems to be loosely related to your issue. https://discussions.apple.com/thread/4433348?start=0&tstart=0 ... View more

Change/remove the policy that causes the issue.  Then in the Meraki console ask the device to check in. ... View more

First put a tag on your ZI.  Go to: Secureity Appliance/Appliance Status Click on the pencil next to "tags" and give the Z1 a tag.,   Go to: Security Appliance/Site to Site VPN Scroll down to: Organization-wide settings Click on: Add a peer   Give it a name.  Put in the public IP address of the CSR1000V.  For the private subnet put in 172.9.0.2/32.  Note that you will need to change the destination encryption domain of your CSR1000V to include the entire subnet behind the Z1.    Under availability choose the tag of your Z1 that you created above.  Fill in your pre-shared key.  Leave the "IPSec Policies" on the default setting. ... View more

No, it wont work in that case. ... View more

I like the 802.1x idea!  It should not be that much of a discipline for users to log in and out of their machines.  You can set group policy to lock their machines if idle for (say) 5 minutes.  Then if someone forgets to logout the next user will be forced to log back in again as they wont have the credentials of the prior user. ... View more

I'm sorry to say but I do not believe this is possible.  The entire Meraki model is based around device enforcement.  Even when you authenticate it just associates this with the device and then enforces that device. ... View more

You would have to put each customer into their own subnet  so each customer had their own VRRP gateway.  Would you also need some kind of layer 2 circit between the two sites that trunked all the VLANs. ... View more

Maybe.  What features of ISE are you hoping to replacing, or what features have you been using?   If you also use the Systems Manager agent you can replicate a lot of the functionality of ISE using dynamic tags. ... View more

No Cisco ASR supports the same SD WAN system that Meraki uses. ... View more

I have seen this happen randomly on many phones.   Try going into the SM app on the phone and click the Afw account link, so it tries to sign up for an account again.  This usually fixes it. ... View more

When content filtering blocks something it gives a reason why.  What reason is it giving? ... View more

I haven't done this for quite a while.  You need to add an extra match in NPS to match the SSID.  I think you need to match on "Called-Station-ID".  Basically look in the event viewer to see what is being sent to you as well in the RADIUS request and add something for that.   This article same some related info. https://social.technet.microsoft.com/Forums/windowsserver/en-US/fa662135-3ddd-4699-a8eb-83f9f85b5674/nps-calledstationid-regex-pattern?forum=winserverNAP ... View more