Hi I've linked a GP to default VLAN that block some subnets used in auto-vpn. all seems configured in the right way but I'm still able to access to the resources I want to block ... any suggestions ?   Thanks   ... View more

Hello @potat    Most of our hardware supports the IPv6 stack, such as GS and GR. The GX however does not yet route IPv6 traffic. This is definitely on our road map to be supported in the future but we do not currently have any form of ETA. ... View more

This is the Meraki MX sizing guide (so you can come to your own conclusions). https://meraki.cisco.com/product-collateral/mx-sizing-guide/?file    The MX needs to track the state of every device flowing through, and this requires a bit of RAM and CPU grunt.   Only get an MX68 if you like having crashes, intermittent outages, lots of grief and no support from Meraki because you haven't followed the sizing guide. ... View more

Use certificate-based authentication, and create an AD group of who is allowed access, and configure NPS to restrict access to that group. ... View more

If you don't need routing in your setup, the 8 port layer 2 switch is a solid switch. ... View more

I *think* if they are all part of a template that authorising in one might authorise in all.  Not sure.   Otherwise you'll need to use the API and have it create the guest user while walking across all your networks. ... View more

@ranjankumarsgh, there are only two settings for IPv6 on the MR, that’s auto and static - assuming you are using a firmware version that supports IPv6 (which you obviously are). And I’m not aware of a way of disabling it, but it shouldn’t cause you any problems.   When an access point comes up it will create a link local IPv6, check for uniqueness, and then send a router solicitation to determine its global configuration details. I would suggest that for the access point that is getting an IPv6 address assigned it is communicating with an IPv6 enabled router (i.e. it’s responding with a router advertisement). Incidentally it’s responding with a site-local address (fec0::/10), a standard that has been deprecated in favour of Unique Local Addressing.   I think if you find the router that’s issuing IPv6 RAs and disable IPv6 on that, then you’ll find that the MR will no longer auto configure an IPv6 address. ... View more

Yes, the per-port VLAN settings are the settings on each port on the MX105. As you can see all the MX ports are set as trunks (so they carry multiple VLANs), with a Native VLAN of 1, and all VLANs allowed. To get you up and running these are the same settings that you should use on all the connections between MX and MS, MS and MS, and MS and MR. ... View more

I'm guessing EE have got IPv6 to IPv4 working properly then, which is good 👍 ... View more

@Bruce    Thank you.  I just opened a support case for that!.   -Dave ... View more

@Marc_Abaya  as Dave mentioned above credentials are cached on the device, our users authenticate once and it just works.  ... View more

@bento23    You could still use RADIUS for the WiFi, without a JumpCloud agent on a Chromebook or phone.  You will need the users defined in JumpCloud, and optionally added to a group (Say, WiFi users).  Then configure a RADIUS setup and assign the group to it.  For extra security, you can setup RADIUS with 2FA.           ... View more

I second the motion for JumpCloud.  The have 2FA Push notifications for signing into JumpCloud and RADIUS and LDAP, and coming soon are  push notifications for RADIUS.       ... View more

@charles07    If you have an Active Directory server, you can set the VPN up for RADIUS authentication. If you don't have AD, you could use a service such as JumpCloud for their Radius server.   If you want to find out more about JumpCloud, pm me.   - Dave ... View more

It has come back up for me now.  It must be transient issues and it has happened a couple of times now. ... View more

Hi PhilipDAth   Your cookbook and online configurator is indeed a good tool and nice programming ... View more

@DHAnderson the vMX runs as a virtual appliance within Azure, so it uses a standard Azure compute instance, most likely a 'Standard_F4s_V2' (but could be a 'Standard_D2_v2' or 'Standard_D2_v3' too). This means you are paying for Azure compute charges just as you would for any other server in Azure.   You can use the Azure pricing calculator here, https://azure.microsoft.com/en-au/pricing/calculator/, to determine a rough idea of what it will cost for the compute platform, it various between country and region. You can also use the calculator to estimate data transfer costs.   Whether you use an ExpressRoute or an AutoVPN to a Meraki vMX really comes down to the expected transfer of data out of Azure - it costs less when using ExpressRoute. When you start transferring more than about 1TB to 1.5TB per month out of Azure then you need to consider ExpressRoute (that's assuming the vMX can do the bandwidth you want). That's based on my calculations, but I'd advise doing them yourself for your region. ... View more

I have a MG21 connected to a MS120-24P.  The switch is powering the MG21. The port the MG21 is plugged into is set up as Access (not Trunked) and a VLAN is specified.  There is another port on the switch set as Access and the same VLAN.  The cable plugged into that port runs into Wan2 on MX65.   This setup started working once I had the correct APN specified in the MG21 ... View more

Hmm, you are probably referring to the MX VPN functionality? This is MR beta 🙂 ... View more

Has anyone taken a look at the Meraki.com page today?   https://meraki.cisco.com/product-category/security-sd-wan/ ... View more

Did you ever get this working? I've been struggling with the same issue, conducting my own troubleshooting, and then came across this thread.   Any insight that you can provide would be greatly appreciated. ... View more

I have a client in a similar position.   We agreed to put their router on front of the Meraki and keep their equipment completely off our network.  Sine they get into their equipment from.a fixed ip address over SSH, I like the idea of there being two different networks. ... View more

As others have said, the dashboard is the key.   Visibility into your complete network stack, no matter where you are, no matter where equipment is, cannot be understated.   Some switch specific benefits(no matter where the switches are physically):   See all switches in a network in one view. See all ports in a network in one view. Drive down into a particular be port in a network quickly. Test a cable without being onsite.       ... View more