I would consider upgrading the IoT sensors to resolve the problem they are causing ... ... View more

Random question: does changing the Traffic Anaytic settings under Network-Wide/General alter the problem in any way?       ... View more

Does changing the Traffic Analytics settings (under Network-Wide/General) make any difference to the issue?         ... View more

Going sideways, if you use SAML authentication, you can't be locked out. https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_Single_Sign-on_for_Dashboard   ... View more

Enabling DHCP does not enable layer 3 routing.  What is your default gateway for your network?  If it is not the MS250 - you don't have an issue.   This document talks about enabling layer 3 routing. https://documentation.meraki.com/MS/Layer_3_Switching/MS_Layer_3_Switching_and_Routing   @Mloraditch has posted a good guide about multicast. >Now I am getting reports that our paging system is ringing when an employee tries to page.   Wouldn't this be expected behaviour? ... View more

I have no experience with Forescout.  Typically with RADIUS servers you can add a subnet (e,g. 10.0.0.0/8) and provide a configuration for every device in that subnet.   You shouldn't need to say what kind of device it is.  The RADIUS request says what kind of authentication the device requires (such as wired or WiFi 802.1x). ... View more

Also - do you have any non-Meraki switches in your environment (even Cisco Catalyst running native IOS-XE)?  If so, make sure they are configured to use "mst" spanning tree.   On a Cisco Catalyst you use this command: spanning-tree mode mst ... View more

My initial guess is something to do with a protective measure shutting down the port, like spanning tree.   When you say the stack goes offline; what precisely goes offline?  Does it continue switching locally, but goes offline is just the dashboard?  Or does it go offline in some other way?   The fibre cable you pull out, is that the uplink?  What does it go to?  Does the device it goes to have anything interesting in its event log?   Whatever is the "core" switch/switch stack in the company, make sure it is configured as the spanning tree root (such as giving it a priority of 0). https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_Spanning_Tree_on_Meraki_Switches_(MS)#Set_Bridge_Priority   ... View more

Personally, when I setup clients I typically don't fill out the sign-out URL (I leave it blank).   The issue is if you are signed into (say) 5 Entra ID authenticated apps (say Admin centre, Webmail, Salesforce, etc), and you trigger a signout (such as from the Meraki Dashboard, Salesforce, etc) - it signs you out of EVERY app that you are logged into.   Most people don't want this behaviour.  If you remove the sign out URL, and you sign out of one app (such as the Meraki Dashboard) you get signed out of just that one app (it destroys the session token). ... View more

>I think I made a post in 2023-2024 about a behavior like this with DNS records with low TTL.   I *think* the issue you had was when two different domains resolved to the same IP addresses (such as two different web sites using the same CDN, landing on the same CDN node).  I think the issue is the database is keyed by IP address rather than DNS name.   You can see how this works.  Packet comes into MX.  It looks up IP address to find out if their is a match to a DNS entry in cache.  Check firewall rules for that DNS entry. If you didn't have a database uniquely keyed on IP address, which of the firewall rules do you match? ... View more

Typically, you wouldn't see transmit power levels over 100mW (if it was cranking).   Your hands generate more heat than this.  ... View more

Web sites often use lots of other components from other web sites.  You have to allow all of these for it to work.   In Chome, hit F12, and click on the sources tab.  Now load the web site.  For me, this is the ist of things it loads:       You need to allow all of these for the web site to function properly. ... View more

First, it doesn't sound like you need AutoVPN turned on.  Do you have any site to site VPNs or anything like that?  If you turn it off it won't try and talk between the hubs.       If you need it turned on, do a ping between the MXs.  Is the WAN actually faster?  This might be a non-issue.   If you buy some AnyConnect licences (and I strongly recommend you do because it is much better than Microsoft VPN), you can define a backup server (MX) in case the primary is down.  Users don't need to do anything.  It'll just connect to the backup. https://community.cisco.com/t5/vpn/anyconnect-profile-editor-server-list-and-backup-servers/td-p/4154167   The other option with AnyConnect is to just have a drop down box with both VPNs and let the users choose. https://ifm.net.nz/cookbooks/online-anyconnect-profile-editor.html ... View more

Could we take one step backwards, as we might be devoting too much time to the solution rather than the problem.   What problem are you trying to solve by preventing the Canada and US hubs from talking to each other?     Apart from the suggestion others have given, there are also AutoVPN firewall rules that can be used for security segregation. https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior   But we need an understanding of the core problem/issue first. ... View more

Painfull!   Maybe it is a bandwidth squeeze.   Try configuring the WAN uplink bandwidth (on your MX) to match what it actually is.   Then then create a QoS rule to make the RADIUS traffic high priority.   More general information: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/SD-WAN_and_Traffic_Shaping ... View more

PDL is being terminated as a program ... ... View more

>If I'm not mistaken, the public hub will create a tunnel with the private hub.   I would take this a step further, and create a public org for the public services. Then there is no-chance of a fat-fingering AutoVPN connection between them by accident.  It also makes it easier to seperate admin access, if that becomes a requirement. ... View more

Has the trial hardware been returned?   If so, I would reach out to support and ask them to cancel the trial for you. ... View more

Even if DNS is failing, it should still check into the dashboard but in a warning state.   Go to "Firewall Info" in the dashboard, and make sure you are allowing the outbound traffic that is required.     Thinking about this further - you have MXs reporting they are offline, but they are actually working?  Do they have Internet circuits plugged into them directly, or something else (like MPLS)? ... View more

It may be the settings are cloned but not visible via the API until you add a device to the network. ... View more

Are the APs management interfaces in the same VLAN (they broadcast data about roaming movements to each other)?   Another thing you can try - disable MAC address randomisation on the client and see if that makes any difference. ... View more

I'll take a punt - it might be mac address randomisation.   If you disable this, so clients always use the same MAC address - does it solve the problem? ... View more

Smells like an MTU squeeze.   On the server with the issue, find out the name of the Ethernet adaptor: netsh interface ipv4 show subinterface    Then try temporarily changing the MTU with: netsh interface ipv4 set subinterface “Ethernet” mtu=1300 Where Ethernet is the name of the adaptor displayed in step 1.   If it works, make the change permanent with: netsh interface ipv4 set subinterface “Ethernet” mtu=1300 store=persistent  ... View more

Google found a lot of people having the same issue, but I did not see any consistent set of answers on how to address it. ... View more

WiFi devices have two main modes of operation: CAM - Constantly Awake Mode.  The WiFi NIC is permanently powered up.  It has the highest throughput and the lowest latency. PSP - Power Save Polling.  The WiFi NIC turns on and off regularly (say every 100ms).  The AP buffers all the WiFi clients traffic in this mode, and only delivers it when the WiFi NIC polls for the traffic.  Muhc lowe throughput, latency jumps all over the place, but the battery life is much better.   Your iPads will be operating in PSP mode. ... View more