Makes sense - thanks Philip. ... View more

@PhilipDAth wrote: For clients using dual VMXs - I think this will be my new preferred way of making them HA inside of Amazon AWS as well. Out of curiosity - why would you prefer this over dual vMX's? ... View more

I think the last time I looked at this (years ago) we didn't quality for access to the API. I will have another look and see if that has changed. Thank you! ... View more

Talking to myself here (again)... but for anyone else wondering it already appears to be in the API, just undocumented on this endpoint: Get Organization Inventory Devices - Meraki Dashboard API v1 - Cisco Meraki Developer Hub   Some examples I have found from different devices that have different eoxStatus:   "eoxStatus": "endOfSale", "endOfSaleAt": "2025-03-28T00:00:00.000000Z", "endOfSupportAt": "2030-03-28T00:00:00.000000Z" "eoxStatus": "nearEndOfSupport", "endOfSaleAt": "2022-07-14T00:00:00.000000Z", "endOfSupportAt": "2026-07-21T00:00:00.000000Z" "eoxStatus": "endOfSupport", "endOfSaleAt": "2015-10-24T00:00:00.000000Z", "endOfSupportAt": "2022-10-31T00:00:00.000000Z"   ... View more

Found the problem - our Orgs are classed as MSP because we have data in the MSP Identification field under Org>Settings, if we remove this value then the EoS/EoL columns become visible.   Does anyone know if this data is surfaced in the API? ... View more

Fair enough - my apologies 😊 ... View more

Solved: Port Forwarding to Device on Site via Site-to-Site VPN - The Meraki Community   Is this any different to the time you asked previously? ... View more

Interesting - perhaps not the same then. Presume you are allowing Windows latest in your posture config? ... View more

You can thank AWS for that one: Cloud Security Service Status Status - Impact to some services for Secure Connect Customers globally.   Should be fixed now - is for us anyway. ... View more

Tried a few different Orgs (co-term) and I don't have the columns available on the cog on the new inventory page 😭     ... View more

I've enlisted our AI overlords to give us a handy limerick on the subject:   If it's inbound Geo-IP blocking you seek, A different firewall vendor you need—so to speak. For Meraki’s design Draws a simpler line, And that feature’s a bit too boutique! ... View more

They are channelling their inner Apple ... View more

Just to add to the documentation the other chaps have provided - YouTube is definitely there for you to select under Video & Music 😊     ... View more

You will want to also allow UDP 443 for DTLS on your AnyConnect ... View more

You can load balance two WAN connections on a single MX.   As of it stands today, high-availability is still only active-passive and not active-active. ... View more

I agree - @RaphaelL is this a service you can provide on release notes going forward please 🤣🤣🤣 ... View more

Because you'd want to isolate clients on the same SSID so they cannot access each other???? ... View more

Has the VPN policies created this problem or did you never have connectivity to the Hub servers in the first place? ... View more

I believe you've created those firewall policies under the Layer 3 section rather than the site-to-site VPN section. ... View more

Never changed it... ... View more

99.9% of the time we are simply enabling 'Trust incoming DSCP' and that's it.   ... View more

Have a look at the layer 2 isolation and outbound rules section on the SSID Firewall & traffic shaping page.    Wireless Client Isolation - Cisco Meraki Documentation ... View more

Your understanding is exactly what I was thinking.   As you say - client VPNs on other spokes will be different source subnets so not subject to your policies. As with anything, make sure you test after implementation to ensure it is working as desired. ... View more

In this case, as it is all VPN users, I believe you could use the VPN site-to-site outbound firewall policies to restrict your Spoke<>Hub traffic by using the appropriate source/destination IPs.   For example your policy could be source of VPN subnet, destination of the list of specific servers, you would then need a deny policy below this (if you don't already have a default deny all).   Site-to-site VPN Firewall Rule Behavior - Cisco Meraki Documentation ... View more