As you mentioned previously, SSL certificate for authentication works. I had to deploy AnyConnect and automate user credentials via PowerShell to call the AnyConnect CLI. Management hasn't approved the paid version of AnyConnect as of yet. Thanks for your assistance! ... View more

I am seeing the same issue as of today with a Customer. Was there any resolve to this issue? They even have Ent Z3 in the environment today with no issues with ADV SEC MX's. Could be purely a Z4 thing, regardless of documentation. We do have a case in, though wanted to reach out as well. ... View more

Hi TEAM-ind   > > If you use SAML for authentication, it can be cached   > How can I turn on the caching of credentials?   This is what I was told: "This is a back-end Meraki setting that you will have no visibility of and need to ask Meraki support to set."   That doesn't sound very promising, but that's exactly what I did, requesting that configuration change via the Meraki support channel, and now it works perfectly. Connects every time, without needing to enter credentials.   I hope that helps.   Manaakitanga! Alan     ... View more

Hello @alemabrahao,   Thank you for providing this information. There are some DHCP option limitations regarding the MS390 and Catalyst 9300 models. Since this initial post, the unsupported DHCP options have been updated in the Setting Custom DHCP Options documentation under the section 'Unsupported DHCP options on MS390 and Meraki-managed C9300'.   Please let me know if this addition to the documentation is acceptable and helps to address the matter.   Best, Feli ... View more

agree , it really doesn't make much sense , please report this to your meraki reps so they fix in future releases. in the meantime , i will try to allow 53 / tcp for dns requests. before the deny all / allowed fqdns for layer3 rule in a group policy, to see if that helps. ... View more

Breaking SSL security to scan for malware about to enter at the edge of the network is a VERY GOOD thing.  A real SSL inspection service will allow trusted connections to bypass SSL encryption like data traversing to and from banks, or to trusted cloud services like Google Search, but can be selectively implemented on new or unknown services to help protect the user from downloading backdoors and trojans.  It doesn't have to be an on/off service, but how can you call ANY network secure without having some semblance of SSL inspection or deep packet inspection?  You can't.  Don't believe me?  Go to Eicar.org and test the efficacy of your edge security.  Without packet inspection you're not going to be able to stop viruses from entering your network.  If your local AV software is alerting about the download then that's your last line of defense and your security posture is crap. ... View more

it shows the below and cant access?   ... View more

Thanks mate! It works! These users were using 3rd party VPN to bypass the guest wireless authentication are now blocked. ... View more

I don't imagine that this is planned to be back ported to older hardware architectures like the MS250.  Which is a shame... ... View more

Hi, currently experiencing the same issue with (19) MS390-48UX2 and (2) MS390-24UX switches. All these switches are operating normally but consistantly display under Firmware (Up to date, Current Version: Not running the configured version). All switches were at firmware 16.8 so I updated the to version 16.9 in hopes of fixing this bug. Nothing has changed with the update. Switches rebooted and seem to running normally. I will be opening a ticket with support. ... View more

this is a couple years back, i thought i ask regarding your suggestion.  I have this setup, but using another device, so i can have a 3rd wan (5g).   all seems to be fine, my question is while the 250 wan2 is on dhcp i have a private ip, assuming this will be double nat, it does show the public static ip on wan2.   on my third party device with the secondary internet circuit, i setup port forwarding to the 250's private ip, disable all IPS on the 3rd party device etc.   i am using traffic shaping rules on the 250 on wan2 to prefer some subnets to use, like my guests, iot etc.   tested with load balancing, no issues at all - showing public static ip's ok.   i know some other models have the 3rd wan capability, be nice if they implemented on the 250.   is there anything else you would recommend?  thanks mate. ... View more

Check first if MX67 is online on your Dashboard, if it is online, then check first the settings under Security & SDWAN > Configure > Addressing and VLANs. Inside Addressing and VLANs under Routing, check at the Per-port VLAN Settings if those ports are enabled. if not you have to enable it to activate those ports on MX67.   ... View more

Hi mate, here you go Catalyst 9300X-M License Structure 12/24-Port 48-portAdvanced FeaturesEnterprise Features LIC-C9300-24A LIC-C9300-48A LIC-C9300-24E LIC-C9300-48E https://documentation.meraki.com/MS/MS_Overview_and_Specifications/Catalyst_9300X-M_Datasheet Catalyst 9300X-M Datasheet - Cisco Meraki Documentation ... View more

Hello,   We ended up upgrading our MX firmware to a different version and it resolved the issue. For that specific firmware that we had issues on...I had to restart the MX every two weeks to prevent the radius server from timing out with the MX. ... View more

Yes, it's possible to implement a device policy where new devices are blocked by default and then manually allowed or set to normal access. This is a common approach to ensure that only authorized devices have access to the network while maintaining control over policy exceptions. Here's how you can achieve this: Create a Default Policy: Set up a default policy that blocks all new devices. This policy should apply to all devices that connect to the network initially. Add Allow/Normal Policies: Create specific policies that allow or grant normal access to devices that are manually approved. These policies should be applied to the devices you want to grant access to. Apply and Monitor: Apply these policies and monitor the network to ensure that new devices are initially blocked and only the approved devices have the desired access. General Steps: Set Default Block Policy: Configure the default policy to block any device that connects to the wireless network. Manually Adjust Policies: Once a device is identified and verified, manually change its policy to allow or normal access. Verify: Ensure the policies are working as intended by testing with new devices and checking access permissions. This approach ensures that anySonic Happy Hour new device will not have network access until it is explicitly allowed. The exact configuration steps will depend on the wireless controller or network management system you are using, so consult your device's documentation for specific instructions.   ... View more

Looks like wiping the chromebooks worked for us. Ultimately getting the latest OS may be what it needed. ... View more

Hello, Open a ticket with support, they can extend the grace period until you receive the new codes. Eventually you can order licences with an other company. ... View more

Bouncing or restarting the Switch during an upgrade to the Firmware fixed the issue for me, I would recommend the restart of the switch but would only do it during an upgrade and planned maintenance, to avoid network interruptions, I found that even though it was showing a loop there was no impact to my environment, I hope this helps and I hope that a restart will get rid of that pesky Amber port indicator for you too. ... View more

thanks ... View more

The option to deploy custom CV module which we have currently built and capturing events via mqtt that are being processed by the model seems to eliminate false alarms that generates in the 100's per day when default motion is enabled...     The above sample event shows how the AI in the cloud thats running off the RTSP feed is performing vs the custom model deployed on the meraki camera and being captured via mqtt..  ... View more

I am also having Client VPN issues reaching my MX67. I haven't used VPN for a year on my Mac. I recently tried to connect to the MX67 network over VPN, no settings were changed and it didn't work.  I tried the following firmware, 18.211.2, 18.211.3 and 19.1.3 with no luck.   Last time the Client VPN worked was in 2023.  ... View more

UDP 4500 y UDP 500 son los puertos que utiliza Windows ... View more

18.107.11 replaces 18.107.10, so I'd try that. ... View more

We wanted 17x 9300s earlier this year and in the end got 355s as they were better for our core needs. ... View more

Go with VMx, It make your network simpler and no- dependent, for any site location if you have- to DC.   Its look like SD WAN connectivity after the deployment of the VMx on AWS. (either same or different vpc).   ... View more