You can access Cisco Dcloud and search for Meraki, there you can access some labs.   To do this you need to have an account created with Cisco.   https://dcloud2-sjc.cisco.com/content/catalogue?search=meraki&screenCommand=openSearchScreen ... View more

Yes, correct. ... View more

Any private address that is not in use on your network, when configuring the VPN client, will automatically be added as a route to the MX routing table.   Configuring MX for Client VPN To enable client VPN, choose Enabled from the Client VPN server drop-down menu on the Security & SD-WAN > Configure > Client VPN page. The following client VPN options can be configured: Hostname: This is the hostname of the MX that client VPN users will use to connect This hostname is a Dynamic DNS (DDNS) host record correlating to the public IP address of the MX For more information on managing the hostname, see Dynamic DNS (DDNS) Client VPN subnet: The subnet that will be used for client VPN connections This should be a private subnet that is not in use anywhere else in the network The MX will be the default gateway on this subnet and will route traffic to and from this subnet The MX utilizes LCP (Link Control Protocol) to assign IPs to clients, thus DHCP and Static Assignment are not supported   https://documentation.meraki.com/MX/Client_VPN/Client_VPN_Overview ... View more

I believe you are using HA N+1 correctly? The best option would be to use SSO. Other than that, what you are experiencing makes perfect sense with HA N+1. ... View more

Try disabling the mac randomization on device. ... View more

AnyConnect on the MX does not support multiple VLANs or address pools for Client VPN users. However, the MX supports the application and enforcement of policies to AnyConnect users on authentication. It is also important to note that, from a Client VPN standpoint on the MX, having users on the same subnet does not mean they are in the same VLAN. Users are assigned a /32 address (one address) from the pool configured on dashboard. Group Policies can then be used to limit users on the same AnyConnect subnet from talking to each other or other resources on the network.   https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Group_Policies_with_RADIUS_Filter-ID ... View more

Maybe it will help you.   https://www.youtube.com/watch?v=Iput9nLnldA ... View more

This is a bit complicated as client identification may not be accurate.   Note: Some clients may misidentify themselves when specifying the User-Agent string field of an HTTP GET request. Device type policy enforcement is done on a best-effort basis, dependent upon the information that the client provides. When needing to enforce security-focused policies based on device type, please leverage solutions such as Meraki Systems Manager, or Cisco ISE.    https://documentation.meraki.com/MR/Group_Policies_and_Block_Lists/Applying_Policies_by_Device_Type   ... View more

In fact, it is a two-way process, the device itself is the one sending the information to Meraki. So it depends more on the device than on Meraki itself. ... View more

Unfortunately, this is a feature that doesn't work well precisely because it depends on the device sending the correct information. ISE or MDM are the key. ... View more

Sorry, I'm not a native speaker. ... View more

Unfortunately there is no API for it. ... View more

It's probably a bug, so the best option is open a support case. ... View more

Have you tried factory resetting the MX? ... View more

Don't you know how to create a L3 security rule?   https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings#Outbound_rules ... View more

Create a security rule denying any and above of this rule create rules for what you want to allow. ... View more

You can add a custom URL, but not specific App. ... View more

Check the documentation.   https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/URL_Block_List_and_Allow_List_Patterns ... View more

I highly advise you to do this instead of leaving your server exposed to the internet. ... View more

You have to use your radius private IP instead of the public IP. ... View more

I suggest you open a support case. ... View more

Nope, it's not possible on non-meraki peer VPN. ... View more

Nothing other than changing the subnet. Why they can't configure NAT in their side? ... View more