Meraki

PhilipDAth

This might be related to the end-of-life announcement. https://community.meraki.com/t5/Meraki-Go/Meraki-Go-End-of-Sale-April-2025/m-p/234154

PhilipDAth

You could consider using self-registration with a splash page. https://documentation.meraki.com/Wireless/Operate_and_Maintain/How_Tos/Splash_Page/Self-registration_for_Splash_User_Accounts You can either have these automatically given access or require them to be approved by an admin.

PhilipDAth

Is your MX behind a device that does NAT? If so, are you allowing BOTH TCP and UDP 446?

PhilipDAth

When you create a 1:1 NAT it defaults to blocking all inbound access - it effectively acts solely as an outbound NAT.

PhilipDAth

This behaviour *only* happens if the switch is unable to access the Meraki cloud. An easy fix is to configure it to use an internal VLAN for its management access. https://documentation.meraki.com/Switching/MS_-_Switches/Design_and_Configure/Deployment_Guides/Advanced_MS_Setup_Guide#Management_VLAN Another option is to set its management configuration to static (IP address, VLAN, etc). You can do this on the local status page.

PhilipDAth

Sometimes it is good to take a step back and ask questions like this.

PhilipDAth

Configure the certificate selection criteria here: Often, matching the certificate issuer is sufficient. Also, check the session log in Access Manager to see if it is giving any hints. Have you uploaded your certificate issuer certificate (aka, your root CA) into Access Manager?

PhilipDAth

When people give me a description like yours, wanting high-performance WiFi and the ability to support lots of video conferencing, I tend to use a ratio of 1 AP for 10 people. I haven't seen your floor plan - but I would tend to lean towards 5 APs on the floor with 50 people. If you can, I would try to get some switches with some MGig ports, like the MS130-24X-HW (which has 6 x MGig ports) or the MS150-24MP-4X (which also supports 60W PoE for high-performance WiFi7 APs as well as 8 x MGig ports - and can do hardware stacking like the MS210). https://documentation.meraki.com/Switching/MS_-_Switches/Product_Information/Overviews_and_Datasheets/MS130_Datasheet https://documentation.meraki.com/Switching/MS_-_Switches/Product_Information/Overviews_and_Datasheets/MS150_Datasheet You have already had other good answers about AP models.

PhilipDAth

Note that per-device licensing mode has gone end of life. The most direct replacement is subscription licencing. https://documentation.meraki.com/Platform_Management/Product_Information/Licensing/Subscription_-_Licensing_Overview

PhilipDAth

You should definitely be able to select more than one certificate. If this is a manual setup, I would untick "Verify the server's identity", and then get that working. Once you have that base working, come back and add certificate validation. Also note that I can only use "Simple certificate selection" without additional config maybe 50% of the time. If you only have one certificate in your user store - then no problems. Otherwise, you might need to add certificate selection criteria to make it choose the correct certificate.

PhilipDAth

Is the remote org advertising 10.0.0.0/8 via BGP to you? It doesn't sound like it is.

PhilipDAth

If you define a 1:1 NAT for inbound access - the MX also uses that same 1:1 NAT for all outbound access as well. It is a "special exception". I'm not sure it is even documented.

PhilipDAth

A 1:1 static NAT mapping will achieve this. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX#1:1_NAT

PhilipDAth

>Confirm Data Storage Location Alignment I want to re-state this one by @RWelch - it is critical.

PhilipDAth

What a pain!!!

PhilipDAth

There are several ways of solving this. I think I would use the AnyConnect default group policy option, and put in there any firewall rules to control what just the AnyConnect users can access. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/AnyConnect_on_the_MX_Appliance#Default_Group_Policy If you use this approach, you can later extend it to support per-user group policy to control what different groups of users can access.

PhilipDAth

Splash Access have an entire portfolio of solutions for precisely this issue. https://www.splashaccess.com/portfolio/education/

PhilipDAth

I have not been able to get username/password authentication to work in any Entra tenant that Microsoft has migrated their authentication methods (and this is a compulsory migration for all tenants). As a result, I only use certificate-based authentication now. I like use Microsoft Cloud PKI for my issuing CA, and use Intune to do the certificte deployment. https://learn.microsoft.com/en-us/intune/intune-service/protect/microsoft-cloud-pki-overview

PhilipDAth

I agree with @Mloraditch - it is up to the SAML provider if you are required to log in again or not.

PhilipDAth

What I tend to do is create a SAML role naming context like this: <Company Acronym>-Meraki-Administrator <Company Acronym>-Meraki-Observer (would have caused this "Read-Only" previously e,g. IFM-Meraki-Administrator And then create those in every org you manage.

PhilipDAth

A general tip, go to "RF Profiles": https://documentation.meraki.com/Wireless/Operate_and_Maintain/User_Guides/Radio_Settings/RF_Profiles Create a new profile. The most common one I use is "Open Office Profile". This uses sensible settings. Apply this profile to all your APs. On the RRM tab enable "AI channel planning" and "Busy hour".

PhilipDAth

This is the secret. You copy the thumbprint to every org where you want your SAML provider used. And copy the SAML group mapping you wish to use. Entra only requires a single setup. You don't touch the Entra config as you add more organisations.

PhilipDAth

When you use the search in the top right-hand corner, it searches the entire organisation.

PhilipDAth

Green to 3 through pi.

PhilipDAth

Try turning off CDP and enabling LLDP on the C1000 (if it supports this).

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges