As everyone has said, unless you have an asymmetric internet connection it’s not normal. Are the bandwidths configured correctly on the MX (SD-WAN page), is the Firepower doing any shaping as the speedtest hits the internet, what about your SP do they do shaping? ... View more

It is is not a bug or vurnability so bugcrowd won't do nothing about this.  But your right that it is save enough but it is more that you can upload private floorplans that are reachble from the internet without a login. ... View more

One caveat though. You cannot implement cert-based auth alone. You have to use cert + user creds on Meraki. ... View more

@Hernan wrote: Good day! Just want to share this method its applicable on W10 user's i just recently apply this to one of our client. On your VPN network settings check allow these protocols and check Unencrypted Password (PAP) On the Windows 10 machine, open the registry and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent, make a new DWORD 32 bit value, call it AssumeUDPEncapsulationContextOnSendRule, give it a value of 2, then reboot the Windows 10 machine.  It should connect just fine. This one works for me Spent some hefty time on this, could get Android to work but not Win10 Machine.....Thank you ... View more

No problem @Maccaa31 I am sure this would work for you, as worked for me Answering your question, the MPLS should go to the internet port(1 or 2) on both MX devices (look at the diagram).The MX devices will treat it as an internet link, as long as you are allowing the Meraki cloud IPs from the MPLS. Technically you would be cheating the MX devices to think this is an internet link. Do not forget to allow ICMPs to Google 8.8.8.8 ... View more

>MX100 HA pair with dual WAN and IPSec VPN to AWS with BGP failover yet?   There are no changes in this area.   >Or is a much more expensive vMX dual pair in AWS still required?   There are now multiple sizes of VMX.  You can use a much smaller (and cheaper) VMX-S now. https://meraki.cisco.com/product/security-sd-wan/virtual-appliances/vmx-small/  ... View more

Have you got Deny Local Lan" disabled on the private SSID? https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall  ... View more

If you are not getting a link light from the management port open a case with support and RMA it.  That's a hardware fault. ... View more

Just in case someone else runs into this, when your troubleshooting disable this in the firewall   IP Source Address spoofing protection   change to LOG if you have a dup subnet that worked in the past, the MX might think it's spoofing a subnet on the MX.   ... View more

@yung : If that is the case, then sure this is connection problem by which device is not reachable to the cloud ! ... View more

You would need a RADIUS server (or service) that supports Google push notifications.  Possibly you could use something that let the user enter their password and a code. I'm not aware of any that do either of these.   Cisco Duo is popular for this solution, but you need a backend Active Directory or RADIUS. ... View more

>how can I share this via social?   If you right-click on the video you can select "Copy this video address".   UPDATE: Scratch that.  Just tested and it copies the wrong address. ... View more

There are two cases here.   You can request an RMA due to hardware failure.  In this case, you get a replacement device and your licence is unaffected.   You can request an RMA for return (not replacement).  This can occur in some cases with trials, with a cancelled order within a specific time frame, etc.  This cancels the licence as well.  You don't end up with a device.   You get another special category is when you have an older device and it gets RMA'd with a newer device, and the licence has to get changed from the old device to the new.  e,g. MX64 ends up getting replaced with an MX67 under RMA.     If you requested an RMA for hardware replacement - then it sounds like the wrong type of RMA was keyed.  You should not have gotten a replacement device though.  It may be a case of checking the type of RMA requested with support.   Otherwise - the licence was correctly cancelled. ... View more

The lack of records in the event viewer is usually related to the Windows audit policy on that machine.  Audit policy needs to be enabled to see the records. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-network-policy-server    ... View more

Thanks @PhilipDAth -   That all makes sense. The one caveat is that we are running layer 3 switching on our switch stack, so I would assume I am going to add the static route to the other org there so it can be propagated via OSPF to our other sites that are currently on the VPLS? Our MX would then have a static route that points to the MX in concentrator mode for the other org so all traffic destined for the other org would be passed up from the switch stack and then routed over to the concentrator MX.   We are currently running a mix of Auto-VPN and VPLS. The Auto-VPN will be going away (except for one frustrating site that can't connect to the VPLS), and we will be routing via OSPF between all sites. So, Auto-VPN will handle connectivity via some sites, and OSPF for others, but regardless of the method, I can see how this will work.     ... View more

Just to confirm:   at FCS it's definitely x2 active WAN uplinks, as other models, but you now have media flexibility.   I have requested that the datasheets be amended to bring clarity in this. ... View more

@PhilipDAth  🤣😂 ... View more

The only other thing I can think of is the AP firmware version.  We are using fairly recent firmware.  Maybe give that a change. ... View more

>Country Code - Site ID/Code/ - switch Number   I tren to use something similar to @DarrenOC .  Sometimes I used the nearest international airport code as well (depends on how many sites they have in different areas). https://www.ccra.com/airport-codes/  ... View more

I haven't done a routed mode configuration, so this is my guesses.   The LAN IP of the VMX must match the address assigned by Amazon.  This would be compulsory.   Your VPC would need a return route pointing to the VMX LAN IP. If the VMX needs to communicate to subnets outside of the current VPC subnet it is in, you would need to add a static route on the VMX pointing to the VPC default gateway for that subnet.  An easy way to do this is to check another EC2 instance in the same subnet and see what it is using for its default gateway. ... View more

I would use the method you are describing. ... View more

Hello    any news if LTE Active wan is supported in 16.7 and when will be available ?  Many thanks ... View more

I hate to say this, but I put this in as a "wish" about 4 years ago.  I still want this option and that's what it should be - an option.  In the 802.1x policy there should be a drop down or radio buttons or something that lets the network admin pick what they want to happen if the ISE server is offline. ... View more