Take a look at this.   https://www.gartner.com/reviews/market/network-firewalls/compare/product/fortigate-next-generation-firewall-ngfw-vs-meraki-mx-appliances   https://community.meraki.com/t5/Security-SD-WAN/MX-vs-Fortigate/td-p/42724     ... View more

I just have two more questions, how many users do you have on average simultaneously on your network and is it possible to test by temporarily disabling AMP? ... View more

And the traffic shaping rules? do you also have Threat protection and content filtering enabled? ... View more

By the way, do you also have Threat protection and content filtering enabled? ... View more

How are your uplink settings? And the traffic shaping rules?   ... View more

Take a look at this discussion. Maybe this can help you.   Solved: Service Graph connector app for ServiceNow error - API KEy - The Meraki Community ... View more

Meraki currently does not provide a built-in way to automatically terminate all AnyConnect VPN sessions on a scheduled basis via the Dashboard or API. In this case, I suggest you make a feature request. ... View more

You can also set up alerts for access points via the dashboard.   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network_Alerts_and_Notifications#Wireless_Alerts   ... View more

There is actually no API for this function, so what I see as a possibility would be to configure Meraki alerts for AP disconnections or VPN tunnel failures and send them to a webhook or monitoring system. ... View more

Intune supports Apple Classroom and can configure shared devices, so, you can push network restrictions, but not toggle them live from a teacher’s device. Apple Shared Device Mode and Guest Temporary Sessions - Cisco Meraki Documentation ... View more

First of all, I apologize for not being smarter than you. Maybe you are right, maybe I didn't understand your point, I think because I am not a native English speaker. The point is that if you really need to do this with Meraki, you will not achieve your goal. ... View more

Group Policies in Meraki can include firewall rules, traffic shaping, content filtering, VLAN tagging, etc. When you see "srcCidr": "OBJ(...)" or "destCidr": "GRP(...)", these are references to policy objects or groups, not raw IPs or CIDRs. The Meraki API currently does not support using object/group references like OBJ(...) or GRP(...) directly in firewall rules via the API. It expects valid CIDR notation or VLAN IDs. ... View more

I still insist that you don't need 2 L3s for each ISP on the switch. You can create a transit VLAN between the MX and the switch and create a default route pointing to the IP that you assign to the MX. In the diagram below I used VLAN 99 as an example with the network 172.16.99.0/30, so if the MX is 172.16.99.2 you just need to point this IP as the next hop of the default route. And you would configure the ISP's /29 networks only on the WAN interfaces of the MXes, without needing to create the SVI on the switch. I believe that is clear now, right?     ... View more

It was just an example, you can have each 1 connection on each MX without any problem.       ... View more

Something like this:     You don't need a L3 VLAN.   ... View more

I believe you are complicating your topology, why don't you simply configure a VLAN in L2 for each of your ISPs on the MS and then set the Switch port in access mode to the WAN of each MX in their respective VLANs? ... View more

Welcome to the community. ... View more

This article explains how to troubleshooting this.   https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Troubleshooting_Guide ... View more

If your headquarters can get a static public IP then that simplifies things, but if that's not possible then my thinking is that you need to use DDNS on both ends, consider a cloud-based sync script or an API-based DDNS updater. ... View more

No, it does not actively try all VLANs. There is no VLAN scanning or probing behavior in factory default mode. The switch simply sends untagged DHCP Discover on its native VLAN e accepts the first valid DHCP Offer it receives, regardless of the VLAN it came from. This is what Meraki sometimes refers to as “alternate VLAN” behavior, not that it probes VLANs, but that it may accept an IP from a VLAN other than the intended one if the network allows it.     ... View more

This behavior is not compatible with VLANs, as you would expect from a fully configured switch. The switch does not "know" which VLANs are tagged or not, so it just listens for DHCP offers and accepts the first one that works.   The respective section in Behavior during Connection Loss to Cisco Meraki Cloud - Cisco Meraki says... If the configuration is not safe MS will try to obtain an IP address on an alternate VLAN and then connect to the cloud through that alternate connection As suggested, temporarily isolate the switches during provisioning. ... View more

I guess, If you specify a domain like example.com, it will match both example.com and any subdomains, like mail.example.com, api.example.com, etc. So you don't need to use the "*" wildcard.   VPN Full-Tunnel Exclusion (Application and IP/URL Based Local Internet Breakout) - Cisco Meraki Documentation     ... View more

When you remove a switch from a Meraki network in the dashboard, it reverts to factory default settings. When the switches are reset to factory default settings and reconnected in a redundant topology, they still do not have the configuration to prevent loops (e.g. no loop protection, no port aggregation). Since they cannot access the Meraki cloud due to the broadcast storm, they never receive the intended configuration and the loop persists. My suggestion in this case is before removing the Meraki portal site, physically isolate the switches from each other or from the redundant links and keep only the aggregation stack connected to the WAN and the Meraki cloud.     ... View more