The MX's are running 18.211.6. For the Umbrella SIG integration we worked with support but couldn't produce reliable data to prove where the issue was (Local MX, Umbrella VMX instance, Umbrella backend etc). Hence why we gave up on it and put the client everywhere instead. I suspect the secure client version of the integration (without the VMX's) work far better but was not feasible for us to deploy (and has additional costs).   For the FQDN's, it appears to be an expected behaviour according to the docs, but just a frustrating outcome when Umbrella is involved.   "FQDN-based L3 firewall rules are implemented based on snooping DNS traffic. When a client device attempts to access a web resource, the MX will track the DNS requests and response to learn the IP of the web resource returned to the client device. "   "MX will not be able to snoop TCP-based or encrypted DNS traffic." MX Firewall Settings - Cisco Meraki Documentation   I'm quietly hoping someone else has found a way around this, or that there's a secret backend feature to enable the MX doing it's own lookups of the FQDN's. 😅 ... View more

Congratulations to the top 12 and to @PierreCharles, @outram. Keep up the good work! Thanks @Ryan_Miles for always being willing to jump into threads to help out.   And thanks to the community as a whole! It only exists because of everyone's great contributions 🙂 ... View more

If it's unicast is all that's needs from VLAN 1 to VLAN 20, just use Layer 3 firewall rules on your firewall. Eg.  - A rule to restrict VLAN 20 connecting to any other subnets or Internet locations.  - A rule allowing VLAN 1 to communicate with VLAN 20.   If you need multicast, as said above bonjour forwarding might achieve what you're looking for. ... View more

It's possible the MS150 was in the works at the same time as the strategy of Catalyst switches in Meraki dashboard and rather than scrapping the project they continued it to fruition. I feel it's likely we'll see less and less of the MS line over the next 5-10 years assuming successful onboarding of the full Catalyst 9K lineup along with more integrated features.   ^ This is purely based on vibes. ... View more

LIC-MX95-SDW-3Y is the SD-WAN Plus license.   You can contact support to upgrade the advanced security license to an SD-WAN Plus license. The upgrade will remove some of the time on the license to compensate for the feature change. ... View more

If possible, absolutely have the customer upgrade MySQL. As said above, that version is ancient.   If that's not feasible, it's likely whitelisting will be your only option. And while not ideal, it's a risk that your customer will need to accept. ... View more

We've got around 200 Lenovo's and 50 or so Surface laptops on Windows 11 24H2 and so far we haven't seen any notable issues.   Are you doing any specific DHCP options? Are your network drivers up to date? Does it happen regularly enough that you can capture it with a rolling packet capture? ... View more

100% Agreed. A much better design/layout ... View more

From my understanding it's not possible unless you use NAT Exemptions and L3 firewall rules with CIDR's you want to block.   https://community.meraki.com/t5/Security-SD-WAN/MX67W-blocking-country-IP-blocks-when-a-1-1-NAT-is-involved/m-p/275543 ... View more

Congratulations all. Thanks for the work you put in (on top of your day jobs). Great to have so many committed Merakians(?) helping make the community a better and more helpful place. ... View more

Ensure you're not blocking any of the required Teams IP's/Ports. I suggest also setting up a firewall rule for the optimizations. https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#microsoft-teams   Other than that, is the issue only seen when behind the MX84? ... View more

What you have described is a relatively complex networking issue which most likely require a deeper investigation than the back and forth of posts in the community board.   What Meraki support have described isn't inaccurate. TCP retransmits can definitely lead to performance degradation. However, it is a symptom of the issue, not the cause. If you know the issue is specifically when the MS425 is involved, I suggest following the path of a specific test and capture at all points. It should become pretty clear that there is either:  - Packets missing from one of the captures (Eg. dropped packets)  - Large delays in packets seen in one of the captures   Based on that, you should be able to trace the point of where the issue is. The next step would be to investigate whether it's congestion/oversubscription, faulty hardware, MTU mismatch etc.   Additionally, you've identified a lot of MAC flapping. I suggest investigating which ports MAC's are flapping between and the cause of that. ... View more

Still not liking these ones... 😶   Ms225 known issues MS225 switches may infrequently stop forwarding client traffic until the switch is rebooted In rare circumstances, switches in stack configurations may experience a software crash that results in a reboot ... View more

As has been said above, Bridge mode is the only way to do it. As much as Meraki NAT is great, as soon as you have any additional requirements it becomes a bit of a hassle. I typically use bridge mode and configure L3 firewall rules on the SSID to block access to RFC 1918 IP addresses, allowing only the shared resource clients need to access (Eg. printer/print server) and internet locations. ... View more

Templates are great for very standardized cookie-cutter networks.   For existing networks, you need to be aware of what configuration will be overwritten in the network when you bind your network to the template. It will almost certainly require some downtime to reconfigure some specifics (Eg. VLAN's, IP's, Site-to-site VPN settings). If you are uncertain, you can always create a new test network and bind it to the template to see what is impacted.   However, if your networks have a current or future requirement to differ from one another, I instead suggest keeping them separate and using the API to push bulk updates to multiple networks. It has a slightly higher learning curve but is much more useful/powerful. ... View more

As per the installation guide, the modules are hot swappable. "Note: The C9300/X uplink modules are hot-swappable and can be inserted/removed while powered." Catalyst 9300/X/L-M Series Installation Guide - Cisco Meraki Documentation   Therefore, you can install it any time. That said, if you have it before booting up and installing the switch, I suggest inserting it beforehand. ... View more

Whilst what is shown in your network diagram isn't particularly complex, it's not something which the community can guide you through from start to finish.   If you have specific questions, feel free to ask and community members can provide advice. Otherwise as suggested above, engage a local partner to assist you. ... View more

Big congratulations to your both! Very well deserved. ... View more

Provided your infrastructural networking is setup correctly (Eg. network configuration and firewall rules), it's generally a simple process. The links @alemabrahao posted above has all of the required information in detail. ... View more

Wow, interesting and quite convoluted! Good you were able to find a workaround. ... View more

^ These are some great takes.   I personally haven't played too much with 6Ghz. But I will say that disabling 2.4Ghz will mostly depend on the control you have over the clients.   If the clients are all relatively recent devices which you deploy and manage, then disabling 2.4Ghz makes sense. If however, you have public, BYOD, industrial or other uncontrolled devices connecting to the Wi-Fi, you're better off keeping 2.4Ghz in at least some areas to make your life a bit easier.   ... View more

Oohh, I WANT IT!     ... View more

Love it. A much more modern look. ... View more

Agreed on the above with checking with support. I've had 2 or 3 times with AutoVPN routing where a backend configuration was in place and caused unexpected routing ... View more