meraki rules are a little different than the classic "open on top of a deny all" rule set. I usually use the following structure:   allow <protocol> <source subnet> <src port> <destination subnet> <dst port> deny any <source subnet> src port any destination <10.0.0.0/8,172.16.0.0/12,192.168.0.0/16> dest port any   be really careful with your default deny rule at the end ... View more

> Netflow traffic will only be coming from the MX per your network you have it setup for. But I understand what your saying 😃 Thank you, Nolan. I also found something which alluded to NETFLOW being sourced from the MX, only. Which is fine...for me...because that's the uplink I wanted to monitor, anyway. I'll also say...despite my apprehension to using NETFLOW...it's already turned out to be a much more useful source of information. As suspected, I discovered some bandwidth anomalies; and with NETFLOW, I was able to determine the source very quickly. ... View more

If a reboot doesn't do the trick, what firmware are you running? Some firmware revisions had an issue like the one you are describing. ... View more

You would have geofencing trigging adding a tag to a device, and then have a profile be triggered by the tag. That profile is what would configure the Per App VPN. I've never tried that, just a theory.   ... View more

@BlakeRichardson "Is it true that firmware updates of all types of devices can only be delayed a certain amount of time but not suppressed totally? I have an MX running 13.33 because it has issues with the ISP and drops its connection every 20 mins if I upgrade the firmware."   Mind if I ask what ISP that is? ... View more

Ah, yeah the network should revert back to the config it had right before it was bound to the template. ... View more

Thats correct! They are not trying to access your firewall, but dashboard which locates in the cloud 🙂  Im not sure there is any way of doing this. Only solution is, of course, to let him try, and use strong passwords, two factor authenticator, and/or to let specific IP range access the dashboard.    Still i am open for any discussion 🙂  Thanks all for stepping in!  ... View more

My main US data center has two MX400s with dual internet links for both and a heartbeat between the two. Running 13.33, zero issues. Its been this way for around 2 years? Most other head-ends/DCs are single internet (per MX) with heartbeat between the pairs. One important note though, each MX single threads to the upstream and downstream switches, they do not cross-connect at the distribution layer as shown in Meraki's updated drawings.   I already know what you are thinking and will say, so no worries. However, keep in mind the Meraki gear we have deployed is in parallel to our core Cisco infrastructure, but again, I know the routine 😉   ... View more

That's strange. I know their tool was broken for a while. But we just did a large org split last week after they fixed the tool.  ... View more

Thanks! @MacuserJim wrote: If you click into the client page you can change the policy to blocked and block it from your network.     ... View more

Policy - Deny Protocol - Any Destination - Local LAN Port - Any Comment - Wireless Clients accessing LAN   With the Firewall & traffic shaping rule (which is predefined above) and Meraki DHCP enabled on your WiFi wireless guests should not be able to ping or reach the LAN network.   All your other rules are not necessary.  Just to avoid confusion, wireless clients on your Guest are seen on the Network-Wide -> Clients page! But this does not mean they can see the LAN network.   Just put your computer on the guest and try to ping your local lan.   Kind Regards, Ben   ... View more

Recently   I had a client reporting he experienced this allready 4 times .. with different devices.   I'm going to check their configs and setup on prem (powergrid), just in case...   keep posting         ... View more

Spoke to Verizon.  Was informed that it must be something wrong on Apple's end.  Got on support with Apple, and transferred to a Senior Rep who worked with me and determined that Verizon must have imported the wrong orders to my account to have this issue occur (and informed me that it isn't the first time they've seen it).   Got back in touch with Verizon, and as of this post they are still trying to figure it out.  Certainly chewing up the days on my SM trial license... ... View more

thanks ... View more

@MFiruz   I don't think you can do what you want. As you mentioned in the document, the track by IP is only doable by the MX, and at the same time cannot be done if using combined network (which I honestly was not aware of, so this is good to know).   Just tried it in my lab (MX/MS/MR) and got this.   ... View more

Thank you.   I am waiting for Apple to speak to my boss, to confirm I am who I say. Once I have that they will issue me with a new password.  Then I can look in DEP and see what I can find/do   Deborah ... View more

Hahahahaha.  OMG. ... View more

@jdsilva I agree with that. I don't think it would be very reliable. It would be helpful if the "Traffic shaping rules" also had a SpeedBurst option like the "Global bandwidth limits" offered. ... View more

You should be able to drag them around the map to exactly where you want them.  ... View more

Thanks both.  I noticed low power mode ( https://documentation.meraki.com/MR/Monitoring_and_Reporting/Low_Power_Mode ) but does not apply to MR33   I've also noticed that my MR33's when plugged into a Cisco SG500 (supports both 802.3at and af) report in dashboard using 802.3af, and my MR32's report using 802.3at.  Any ideas why they are different and why the newer model is using the older PoE method? ... View more

@NolanHerring   I just now tested in my Lab the IPs you mentioned works well to allow only Office 365 and block everything else. I hope it won't create any problem when it goes live.    I like the way you mentioned every detail in the photos.   Thank you so much for your time and effort.   Regards. ... View more

How many access points are we talking about here? How many SSID's?   For stability it's best to have the SSID dedicated to either 2.4 or 5GHz. Don't use band steering etc. I would also recommend static power/channels. Sounds like you did a survey, so those results would help you decide what power level you should have the radio's operating at.   Data rates on 2.4 choose either 12 or 24.  5GHz either 6/12/24. If you have a crap ton of access points then I would lean towards 24. However using 6Mbps might possibly help with retries etc. Those three rates are mandatory per the 802.11-2012 (Section 18.2.2.3) standard. So some old devices (rare though) might act up if you use something like 18Mbps etc.   I would also do a sanity check on every single port that each AP is connected to. Make sure they are setup correctly, native vlans/allowed vlans etc. Make sure your SSID configs are correct on that aspect as well if your using bridge-mode.   If you CAN get everything on 5GHz it's usually preferred, and if a proper survey was completed, this shouldn't be an issue. With the static channels make sure you only use frequencies that your devices support. Those devices might only be able to use UNII1/3 for example, so DFS might not be an option.   If you have an access point in the break rooms/office areas for example, and production clients never really connect to it (warehouse ones that is), you could put those ones on UNII2 band so that any traffic on that AP isn't having any impact on the wireless out in the warehouse with people watching YouTube etc. Just make it vanish like magic  😃   Check the client devices wireless settings. if there are options to force it to only use 5ghz, then that might be the direction you want to go. look at driver version updates etc.   As long as your configuration is solid (sounds like it could use some tweaking), and a proper survey was done, then your at the will of the client gods lol. ... View more