See I had seen this but had discounted it as I would expect the packet flow for non internet bound traffic (RFC 1918 IP's advertised by the hubs) to flow from spoke to HQ hub as it would have a more specific route than the 0.0.0.0/0 that gets installed for Umbrella.   And assuming that's the case I'm not too concerned about communication from the hubs to umbrella as they're deployed as VPN concentrators and at this point don't require tunnels to umbrella ... View more

I agree, I quite like the look. That said, it's very 'off brand' for Meraki. ... View more

I'm not sure of the expected behaviour on the Meraki side but I know having implemented IP-SEC tunnels between Azure and Sophos, the tunnel will drop when there's no traffic going across it for a period of time. The tunnel is rebuilt as soon as packets need to cross it.   Sophos XG to Azure VPN drops randomly - Discussions - Sophos Firewall - Sophos Community ... View more

Apart from the above, another thing to note is that when upgrading stacked Meraki switches, all switches in the stack upgrade and reboot at the same time. ... View more

As stated above, stacking is simple and will make your life easier. The downside of which is that during a firmware upgrade, the stack reboots as a whole resulting in a network outage for connected devices. If that's feasible for your business to manage then IMO, stacking would be the way to go. ... View more

Do check out the above provided link for more information on the warning. That said, I've had instances where this warning has shown when adding a newly installed or replacement AP and goes away after a few days. ... View more

There is no public bug or PSIRT for this vulnerability yet, given it's still pretty fresh. Raise a support ticket for more information as they may already be investigating internally. ... View more

An option that might work...  - Create a VLAN and assign a group policy to it that denies all traffic. Set this VLAN on the SSID.  - Once the device has connected, manually change the group policy of that device to one which allows network traffic. ... View more

Any unexpected downtime is typically posted on the Meraki status page (linked above). If you're seeing something regular, Meraki support is probably the best to answer this question. It could be scheduled maintenance on the node if there's a correlation with the customers seeing the issue and their associated node/shard. ... View more

You can see under Organization -> Inventory whether a device is added to a Network of not.     Checking under the "Network" column, if the device has a network listed, it is administratively setup to be in use. You would then need to navigate to the network to see if it's online and active.   For devices that have no network listed, they are not in use. ... View more

As @PhilipDAth advised, a dynamic username and password are generated when you enable the settings. You can then poll the dashboard with those credentials which will only allow extraction of data from your organisation. ... View more

As per the provided documentation, it's a relatively trivial process. Most of the configuration is pulled down to the new MX after replacement. Only things like port specific configuration and Site-to-site VPN config will have to be re-configured. ... View more

I would personally trust the datasheet over the Meraki Sizing tool. The datasheet is generally considered to be the source of truth while the sizing tool (despite being created by a Meraki employee) is somewhat unknown in terms of its accuracy and guarantees.   Best way to be sure though would be to raise a case and have Meraki support confirm. ... View more

SNMP in the org settings allows your to poll the dashboard via SNMP. This is not the local devices directly.   SNMP in the Network-Wide settings configures for devices to be polled directly via SNMP polling from within the network (VLAN IP's) or externally (WAN IP's).    Additional info can be found at the following reference guide   SNMP Overview and Configuration - Cisco Meraki Documentation ... View more

A few things to check:  - Is the network you're trying to make changes on bound to a template? If so, you will need to make the changes on the template instead (which will impact every network bound to it).  - Is your user an Administrator for the Org or for this Network?  - Is the MX deployed in routed mode or as a VPN concentrator? ... View more

Flow control is used to control the amount of frames that are sent over a link. It's used in scenarios where dropping a frame is a worse outcome than telling the sender to wait before sending. Most commonly it's seen in FCOE deployments and sometimes in iSCSI deployments because dropping storage packets can be problematic.   The 'desired' setting just means that the switch is open to the other side sending flow control packets but won't require it, nor send flow control packets unless the other side first initiates.   Meraki switches don't support flow control. You can check whether flow control is actually in use on the Catalyst interface by running "show interface x/y flow-control detail" (or a similar command) to see if pause frames are actually being seen. ... View more

Make sure you're aware of the limitations of running OSPF on Meraki MX's - especially in routed mode. Using OSPF to Advertise Remote VPN Subnets - Cisco Meraki Documentation   As for enabling and configuring it, you can use configuration templates but given you'll likely need to add local overrides anyway for router ID's and area ID's etc, you're probably best investing some time looking into the API. Assuming there are API configuration endpoints available for OSPF on the MX, this would make it much easier to do. ... View more

As mentioned above, one of the advantages of Meraki Auto-VPN is that it takes care of this automatically. No need for a static IP address. ... View more

This is correct. You need an AP that supports 6Ghz in the dashboard for it to show as an option. ... View more

I believe the MX95/105 models support 1Gbps & 2.5Gbps on the mGig WAN ports. That's basing it off the RJ-45 LED behavior here - https://documentation.meraki.com/MX/MX_Overviews_and_Specifications/WAN_behavior_on_MX75%2F%2F85%2F%2F95%2F%2F105#RJ45_LEDs   That said, I've never tested so can't be sure. ... View more

It's been released as an early access feature for firmware 31.1 and above. (Organisation -> Early Access) There's no documentation available for it yet but I imagine it won't be long before that it also provided. ... View more

It depends what information you need to get out of it. The Meraki dashboard is pretty good out of the box. If you need additional information (or more historical information), I suggest looking for tools that utilize the Meraki API. Note however there can be limitations depending on how many networks and devices you have as the API is rate limited. Lately I've been using Statseeker. It's got all of the standard SNMP/Ping based polling options but also has an additional module (licensed separately) that can pull information directly from the Meraki dashboard via API. ... View more

I've only worked with HA pairs as VPN Concentrators in the datacenter and have never had an issue with failovers there. One thing a lot of people overlook is that the timings for failover vary depending on the failure scenario. In the event of a soft failure (outbound HTTP and ICMP tests fail but the physical link remains up), the failover time can take around 5 minutes. In the event of a hard failure (the physical link goes down), the failover is pretty much immediate (<5 seconds). Some resources that explain the difference are below.  https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover#Connection_Monitoring_Test_Process Re: MX Circuit Failover timing - The Meraki Community ... View more