I had never really looked at or considered a HA vMX setup. Its a VPN Concentrator when you boil it down. Same reason we dont bother backing up the VM in Azure. It is actually easier and quicker to just redeploy it and let the config come back down!   Now the problem with the above is a lack of automation. It can mean downtime.   Something that would be really awesome is a monitoring method that would trigger a redeployment of the vMX through powershell scripts.   I have a good few vMX in the wild, and i have not had a blip on them. I wish they did more, but then, why would you buy an ASAv or CSR1000 for twice the price... ... View more

I would be almost certain that it doesn't remove the config and this leads to a small bug (feature?) on the dashboard. If you enable something, for example, Client VPN, and you then untick the Client VPN Box, the Config doesnt go away.   This can cause you some very interesting debug/troubleshooting as the information is not present having been hidden by some lovely CSS! 🙂   Watch out for it, and dont take the Dashboard as 100% honest, as the item causing you trouble could be hidden ... View more

One thing to watch out for here is the 15 SSID limit. Have run into the situation in hotels and shared offices where the expectation was that there is an infinite amount of SSID's that can be broadcast according to tagging. You are still limited to 15 SSID's per network. ... View more

I too implemented SAML/SSO with AzureAD for my company many moons ago in order to fulfil audit tracing of activities more that anything else. One of the bug bears i have is that I had to specify the Dashboard Node that my logins happen against, NXXX, and for whatever reason, that particular node is somewhat slow to update!   I would love if they would have another stab at SSO and SAML ... View more

Not to blow the Cisco horn here but linking Duo to your AzureAD might be another solution to this, and it may address other organizatinoal MFA items as well.   We have had issues with VPN and MFA when it was "pure" NPS on a windows server. Using Duo as the provider worked really well for Meraki VPN, and it liked nicely to the identities ... View more

It is likely to be some kind of firewalling. It would be a good opportunity to run and see the Packet Capture facility on your Meraki equipment and using it to diagnose in more detail   Are you doing any deeper security inspection? are you blocking any udp traffic? ... View more

Yeah, they dont play will with others, but when you are a service provider and this is your service i suppose i can understand pushing the solution that i know will work for me, and not really caring about others ... View more

AHA! Yeah, Wired connection is what i am expecting to be honest, and that is "grand". And with Social Distancing meaning im working from home, i might get a chance to run some ethernet... ... View more

Oh all of the above is well known to me.    So the long and short of it is if you have anything beyond a simple AP, forget about SkyQ! 🙂 ... View more

Hi Nolan SKY is a home TV Service, based on Satellite (??) Dishes. Their latest iteration is Sky Q, and they also provide broadband services. What they have tried to do with SkyQ is integrate a lot of technoogies into one box. Obviously its the set top box, it also has some apps on it (Netflix, Disney+ etc) but where the previous version depended on coax cables from the satellite dish, this one only has the signal being delivered to one main box. The other boxes then run of wireless from this. Sky is the UK/Ireland version of Fox So back to the box. In addition to being a set top box they made it integrate with their router, and provide a kind of mesh / repeater. I have an MR33 and to be honest, im having plenty of wifi issues on it right now. What my main issue with Sky Q was that it just hated Meraki. I mean it wouldnt talk to the internet, it wouldnt talk to the mini box, nothing. I could see from the Meraki dashboard that the SkyQ Boxes seemed to create some kind of virtual device with the MAC 38:a6:ce:29:6a:7e. There is a lot of items in this, im just wondering if anyone has it working on their Meraki. This question is likely only going to be answerred by UK/ireland people ... View more

789 is a different error again. Double check the encryption settings ... View more

Yeah, I replied about the Xbox networking services above. Clearly they are using some l2tp miniport as well.     Now this bit is controversial, but there is a Draytek SmartVPN client, and instructions on reddit to configure to work with meraki. I personally have not had it work, but my issue was down to xbox networking, and once I resolved that, I didn't need the Draytek client ... View more

There is a new element to the Client VPN not working in Windows 10 that i found recently. Xbox Networking Services. This appears to be running some l2tp tunnels. I have found with almost no other intervention that stopping the networking servers, even going so far as to Disable them, Meraki Client VPN starts working again.   There are loads of Powershell scripts out there for Meraki Client VPN in windows 10, but the best solution i have is that i have switched to launching the VPN with RASPHONE.EXE and not through the Windows 10 UI's   As for the internal settings for the VPN, i have yet to have the encryptiong move, but i do know that updates can cause this to happen ... View more

Hi Frank   I would not depend on the Meraki Dashboard for this information, i would instead look to setup a syslog server that you could more easily interrogate on an automated basis. It will very likely be easier to interrogate, and potentially a lot of syslog interrogators out there have the query ready for you.   That being said, the following https://api.meraki.com/api_docs/v0#list-the-clients-that-have-used-this-network-in-the-timespan could be used as a starting point. ... View more

I dont want to hijack this thread, but another option that I would like to try and bottom out is a BGP Route from Azure VPN Gateway.   Here in Ireland getting a circuit AS is not trivial, we typically have PPPoE WAN or similar.    However we recently took on some people from South Africa who were asking why we dont use BGP more, and I recalled that we looked at have redundant failover connectivity from an Azure VPN Gateway to an MX using BGP. We never proceeded, as the vMX was cheaper   I have been told that enabling BGB on Meraki is as simple as asking.   Has anyone ever performed this? ... View more

I would be careful with the "works fine" as i have seen stability on the tunnel being an issue, and you need to put Beta firmware on your MX, which can be a major issue for end users with Compliance requirements.   What services are on the server that you want to access? That is a key consideration of this.   1. The vMX is the most reliable method, but remember it is only a VPN concentrator, not a firewall 2. IKEv1 VPN Gateway in Azure, costs ~€120 per month. 3. Beta Mode, Support Request for IKEv2, and same VPN Gateway 4. Give the server a public IP in Azure, and lock down the NSG rules to your external ip? ... View more

I realise that this thread is very old and that there are loads of methods out there to resolve this, but yesterday on two machines i have i was having nothing but issues, all error 809.   Long story short, Disabled Xbox Live Networking Services, and 100% working without any other intervention.   If you search for generic Windows 10 809, and exclude "meraki" from your search, there are a few troubleshooting guides with the same level of items we have here (uninstalling WAN Miniports etc) but i demonstrated on my home PC and my work laptop that stopping the Xbox Live Networking Services had the immediate result of allowing my Meraki VPN to connect. ... View more

It should do that, but can you give more clarity as to why you would construct a user directory in such a fashion?  ... View more

The will not have access THROUGH the vMX, which is what a Full Tunnel is attempting to do. It is routing all of your traffic to the vMX and assuming the vMX knows how to handle this.   As the other replies have stated, you need to investigate creating Split Tunnel VPN's on your clients. This works by only sending specific traffic over the VPN (ie your subnet in AWS) and all other traffic should use your Gateway on your local network. ... View more

https://documentation.meraki.com/MR/MR_Splash_Page/RADIUS_Failover_and_Retry_Details   You can specify multiple RADIUS servers, and they will be challenged in sequence.   Can you be more specific in how the directories that your RADIUS servers are accessing are unique from each other?     ... View more

Hello   No, we had to do very very little at this point to be honest. Even to the point where we are not backing up the VMx appliance as it is quicker to redeploy it than to restore from a backup!   What errors are you receiving from the Azure Deployment? ... View more

This was my experience. I ended up adding a generalised account to all ORG's and at the same time enabling SAML authentication. Once SAML was in place, all my engineers could sign in with their own credentials ... View more