>We currently use a Guest WiFi network with Meraki AP assigned (NAT mode).   If you change to using bridged mode you'll be able to use VLAN tagging. ... View more

My punt is that this spoke is sitting behind something else doing NAT.  Is that correct?   If you have a static public IP address then port something like udp/10000 (exact number not important) to the MX and then configure it to use manual NAT traversal again.   Otherwise try updating the firmware on the CPE in from of the MX that is doing NAT.   If the CPE has a firewall try turning it off.  Some CPEs have a mode like "DMZ" you can use to pass all traffic through. ... View more

Packet Capture would be another good tool for the "Troubleshooter" role that I mentioned. ... View more

No, I meant Secure Connect.   The invoice you have from AT&T does not make it clear to me what you have bought. ... View more

If the inter-vlan bandwidth requirements are low - move all layer 3 processing to the MX. If the inter-vlan bandwidth requirements are high, you'll need to do the routing on the C9300. ... View more

Now I know we are talking about a higher acceptable price bracket ...   I have seen these passive Ethernet fail-over devices.  They have an Ethernet in, and two Ethernet's out.  The phone would plug into the "in".  The out's plug into separate switches.  As long as the device gets a link from out1, it uses that otherwise it passively fails over to out2.   I have never used such gear myself, but a quick Google found this option: 1+1 Ethernet Failover / Ethernet AB Fallback Equipment | Valiant   Personally if it was me, I think I would be tempted to look at something like a Cisco Catalyst C9404R. Cisco Catalyst 9400 Series Switch Data Sheet - Cisco It has dual supervisors, dual everything.  If you have a supervisor fail, the port automatically fails over to the standby supervisor.  It supports doing hitless upgrades. ... View more

I have never tried it either, but I doubt it would work.   Would using a WiFi enabled device be an option?  Then it can failover between different APs on different switches. ... View more

Maybe a new category here (under "Client Monitor") called "Troubleshooter".     ... View more

I would like to be able to give some observers the ability to use the tools page on the device page.  This is for helpdesks that you don't want to be able to make changes but still be able to do basic troubleshooting.   For example, being able to give them the ability to reboot a Meraki device, blink LEDs, etc.   This is the page I want to be able to give some read-only users access to use:     ... View more

You seem to have a double negative.   If "Deny Local LAN" is enabled - WiFi clients cannot talk to anything on the local LAN. ... View more

>and then gradually move the servers, desktops, and phones to the new network   If you have two separate networks, with the same IP addressing - you won't be able to move things across gradually because there will be no connectivity between the networks.  You'll need to do a "big bang" cutover and move everything at once. ... View more

That approach used to work (I have used it many times).  The GUI has been stricter about requiring both WAN interfaces to have a VIP, or neither of them having it.   I would try it in this order: Configure only WAN1, and enable VIP. Now configure WAN2.   I expect that will bring it online, and everything will work fine, but you won't be able to go back and change the VIP configuration once WAN2 is configured. ... View more

Have you checked circuit utilisation?  Perhaps it is just getting maxed out.   Does other types of traffic, like ping or SMB continue to work?   What do your uplink statistics show?  Any growing packet loss? ... View more

Apart from the other great answers, I want to point out that MV cloud archive licences are different to all the other licences.  They don't interact with co-term licences.  They are completely standalone, with their own seperate end date.   https://documentation.meraki.com/MV/Initial_Configuration/MV_Cloud_Archive#What_happens_when_Cloud_Archive_licenses_expire.3F   You can simply renew the original cloud archive licence without it having any affect on the co-term licence. ... View more

Try claiming the serial number back.  Maybe you'll get lucky and they haven't added it to a dashboard.   Pretend to sell it to them, get their details, and then make a complaint of theft against them. ... View more

>and then configure the secondary with the same IP on both?   No.  Well, I guess you could as long as you only plug in one at a time.  But generally, no.   Lets take a step back - do you even need to use virtual IP mode.  Because if the answer is no, things get simpler. I probably use virtual IP mode on only 10% of deployments.   Virtual IP mode: * Can made AutoVPN fail over a little bit faster. * Makes client VPN failover a little bit faster. * Is a must for third party site to site VPN connections where you need HA. * It makes all outbound web browsing appear to always come from a single IP address, rather than two IP addresses.   Is any of the above "a must" for you? ... View more

I've tried again with 19.1.6 to AWS.  BGP portion still fails to come up.  Meraki thinks it is sending a BGP hello but doesn't get a response. ... View more

I can't speak for AT&T.   What I can tell you is that for my customers I sell them a "term" based AnyConnect subscription that matches their Meraki subscription.  These kinds of licences automatically include a support contract.  When I get the contract from Cisco I forward it onto my customer. My customers are then fully entitled to use AnyConnect and can download the latest software from Cisco directly.  They can also ask me to download it on their behalf.   SWG is a Cisco Umbrella. https://umbrella.cisco.com/products/secure-web-gateway Cisco Umbrella does also offer a remote access solution (which does not use the MX option), called Secure Connect.  SecureConnect includes an engine that can do client updates automatically. https://www.cisco.com/c/en/us/products/plus-as-a-service/secure-connect.html   It is not clear to me from your screenshot above which remote access solution you have been sold.  I would go back to AT&T and ask about how you get SRA configured (or even which solution it is that you have bought), and how you are meant to get software updates. ... View more

Check out this detailed post on multicast routing. https://community.meraki.com/t5/Switching/Multicast-Basic-s/m-p/25867/highlight/true#M2125   ... View more

I believe it is purely done by mac address. ... View more

I've seen this issue with firmware bugs as well.  Make sure you are on current stable or better firmware. ... View more

We've gone 100% work from home.  No more people using vehicles to go to work and back each day.  No more office. ... View more

Are you by chance using IKEv2 and have multiple subnets selected?  IKEv2 on Meraki only supports a single subnet combination.  You have to use IKEv1 if you need to support multiple subnet combinations.   I echo your sentiment that MX is weak in the third-party VPN area.   When I tend to do, when I need to link orgs, is put an MX from each org next to each other in one central site, add static routes between them, and reidstribute those static routes back into AutoVPN on each side. That works rock solid. ... View more