I'm not sure specifically about App updates, this I have used this before to block iOS updates: Security Appliance/Firewall/[scroll down to]Layer 7 Software & Antivirus Updates/Software Updates   ... View more

That's not true.  If you only want 10 licences you can buy just 10 licences.   If you go: Systems Manager/General/<scroll down to>User authentication settings Have you selected to have users authenticated against Active Directory? ... View more

With regard to support; you need to have paid for something in your Organisation to use support.  You can't really expect Meraki to offer support for a free giveaway - otherwise why would people pay for the product to get support?   ps. The free licences are no longer available to new customers.   With regard to ActiveSync; have you configured the MDM to require the device to be authenticated when you are provisioning it?  Typically you would authenticate against either Active Directory or Office 365, depending on where you email is located. ... View more

I think (not sure) that they show up under Network Wide/Clients - but they look the same as all other clients. ... View more

I agree with @Adam, you are not going to see "dumb" devices show up in the topology diagram. ... View more

This is the firmware release process: https://documentation.meraki.com/zGeneral_Administration/Firmware_Upgrades/Meraki_Firmware_Release_Process   This is the bit you would be interested in: Stable  A stable release candidate matures into a stable version over time as it is slowly rolled out to devices globally. After 20%+ of devices are running the stable release candidate, a final formal review is conducted on the firmware. Again the same KPIs are analyzed as used in the stable release candidate review. Upon completion of these processes the firmware can be promoted to "Stable". After promotion, stable versions can be applied by any customer via the firmware upgrade tool on dashboard. The latest stable version is also the version that is used for all newly created dashboard networks for a particular device.      I'm not saying I agree, so don't shoot the messenger, but that is the process. ... View more

I can't see anything wrong.   I guess lets check the obvious.  Does the MX appliance status say the configuration is up to date?   Try making the config simpler.  Try removing the two DHCP exlusions.  If that works try adding back one in at a time.  I kinda recall in the back of my mind some bug around DHCP that was resolved in the beta firmware. ... View more

Have you tried updating the WiFi NIC drivers on the machine?   You mention you are doing machine based certificate authentication.  Have you configured group policy so that the machines only do machine based authentication (otherwise they will also attempt user based authentication - which will cause a disconnection). ... View more

The access points and the syslog server are in the same subnet - so you wont see that traffic going through the firewall. ... View more

I can't see that being true.   Take a Cisco ASA.  You can configure it to do a VPN using either/or of IKEv1 and IKEv2.  If you configure both then it tries to build the VPN using IKEv2 first and if that fails it tries IKEv1. ... View more

Please please please don't try and put 200 clients on a single AP.  The experience for the end user will be terrible.   My personal favourite for corporate environments is the MR42. https://meraki.cisco.com/products/wireless/mr42   My personal favourite for guest WiFi [only] is the MR33. https://meraki.cisco.com/products/wireless/mr33   10 users to 1 AP gives high bandwidth.  Between 20 to 50 users per AP provides an average experience with average bandwidth.  More than 50 and it provides a terrible experience.   I don't normally use a ratio of more than 25 users per AP.  Others will have their personal preferences. ... View more

What about the port on the Meraki pointing to the device?  Is it still auto/auto and is the machine plugging into it set the same? ... View more

When you are logged in go "Help" in the top right hand corner, and then "API Docs" to get more info. ... View more

I'm going to guess a duplex mis-match.  What does each end report the duplex as?   How is the port configured on the HP switch?   1000/full, auto/auto? ... View more

I don't know the answer.   The only thing I can think of is to use the Dashboard API to walk across the devices and rename them.   HTTP REQUEST PUT /networks/[network_id]/sm/device/fields PARAMETERS wifiMac The wifiMac of the device to be modified. id The id of the device to be modified. serial The serial of the device to be modified. deviceFields The new fields of the device. Passed in as a JSON object. The list of available fields are: name, notes SAMPLE REQUEST curl -L -H 'X-Cisco-Meraki-API-KEY: <key>' -X PUT -H 'Content-Type: application/json' --data-binary '{"id":"123456", "deviceFields":"{"name":"<name>"}"}' 'https://dashboard.meraki.com/api/v0/networks/[networkId]/sm/device/fields' ... View more

There are two styles of hardware token.   One uses PKI (certificates).  You typically have to enter a pin code (something you know) to unlock the hardware token (something you have).  The VPN then uses the certificate on the token to authenticate you.   The other style uses OTP.  Typically you log in using your username (something you know) and a number that comes up on the token (something you have).  You enter the number in the password field. ... View more

I have not used the products mentioned specifically with Cisco Meaki VPN; but I can tell you how the Duo one works.   You log in using your AD username and password.  Then the DUO service talks to an app on your phone and it asks you to allow or deny the connection.  You normally click allow, and then your VPN proceeds.   So it does satisfy the requirements for 2FA, something you know and something you have. ... View more

I agree with @WadeAlsup.  Meraki ties the user to a machine.  If you have a machine that can be used by more than 1 person this approach will not work for you. ... View more

We can probably solve this now we know the IDS is triggering.   Go: Security Appliance/Threat Protection/Intrusion detection and prevention Under "Whitelisted Rules" click "Whitelist an IDS rule".  Select the rule that is firing above the in the log.   ... View more

I think you might be affected by the IP Reputation/URL filtering issue.  This was resolved in 13.3.  I think you should upgrade to the beta firmware.   You can read about the issue here: https://documentation.meraki.com/MX-Z/Content_Filtering_and_Threat_Protection/Content_Filtering/Content_Filtering_Troubleshooting "Sometimes, sites will be blocked even though their URL category is not blocked. Usually this happens when the IP has a bad reputation but the URL reputation is good. This happens commonly with very large domains like Google that own many IP addresses and sometimes purchase new IP addresses that have not yet been re-categorized to take their new owner into consideration. In situations like this, these IPs sometimes have a category of 'Phishing and Other Frauds,' or various other categories that may actually be blocked:" ... View more

And you are saying that if you disable AMP it starts working?  If there is nothing in that log then it should mean that AMP is not blocking your traffic.   The beta firmware is pretty good.  You are unlikely to find any issues if you upgrade to it. ... View more

If you go: Security Appliance/Security Centre/Events Does anything come up? ... View more

If you look in the event log for the network - what is the exact reason it gives for the blocking the traffic? ... View more

Try removing the L7 rules and see if that fixes it.  If not put them back.  Repeat with the contenting filtering rules.   One of those items should get it working again. Tell us which one it was. ... View more

The device was originally in your organisation and you have the licence.  You unclaimed the MX64 hardware and moved that hardware to a new organisation.  That device is now sitting in your customers organisation without a licence.   You could try transferring one of your licences to your customer and back again - but I wouldn't do that.  A compromise if you want to continue down this path is to create an extra network in your organisation and put the MX their.  Then grant your customer access to that network.  That will solve the licence issue and let the customer try out the MX.   But this is hard because you aren't using the approach that Meraki is recommending for trials.  What you can do is use the Meraki Try and Buy program for your customer.  Then everything will be easy for you and your customer. https://meraki.cisco.com/form/trial ... View more