I have an MX with a LAN setting of "VLANs" (as opposed to Single LAN) with only one VLAN configured, VLAN 1. All ports on the MX are configured as Trunk with native VLAN set to VLAN 1.    I'd like to introduce a Voice VLAN to this network which I will add as VLAN 65 and leave the MX ports configured as they currently are.   The VoIP phones are all connected to a Meraki switch and the Meraki switch is connected to the MX. The phones all have a PC attached to them. The plan is to configure the ports on the Meraki switch as access ports and set the data and voice VLAN appropriately.   The rest of the network consists of unmanaged switches connected directly to the MX. So this network is currently flat with no VLAN tagging.   My question is about what happens when I set the data VLAN to VLAN 1 on the Meraki switch ports used by the phones. I know the switch will tag the phone traffic as VLAN 65 when it forwards phone traffic to the MX, but will it actually "tag" the data (PC) traffic as VLAN 1 when it forwards to the MX or does the switch know that VLAN 1 is the native (untagged) VLAN and leave it untagged?   Essentially trying to figure out if a Voice VLAN can be added without affecting the untagged nature of the current flat data network.   ... View more

Most of our sites using MX67C with MX 17.6 firmware have been running without any issue, in fact MX 17.6 resolved a number of issues (mostly related to cellular).   But some sites seem to experience minor interruptions to their connectivity a few times a week. I get notified of this by a series of email alerts that usually come in the following order:   "VPN connectivity changed" email stating site-to-site VPN to that site went down. "Uplink status changed" email stating site has switched to cellular as its uplink. "VPN connectivity changed" email stating site-to-site VPN to that site came back up. "Uplink status changed" email stating site has switched back to Internet 1 (wired WAN) as its uplink. "VPN connectivity changed" email stating site-to-site VPN to that site went down. "VPN connectivity changed" email stating site-to-site VPN to that site came back up. "Cellular came up" email stating the site has connected to a cellular network.   From the first email to the last email is usually 2 minutes or so.   The other day, I happened to notice I get a similar sequence of emails in the same time period if I manually reboot or power cycle a MX67C running MX 17.6. In the past I have noticed that an MX67C running MX 17.6 connects to the dashboard via cellular first for about 30 seconds or so before switching to wired WAN when booting up, which I believe triggers the emails regarding cellular failover.   Unfortunately (and one of my pet peeves with Meraki) is that there is no "device boot" event in the event log. The Connectivity bar on the Summary page does show around 2 minutes of no connectivity but no way for me to know if there was a true WAN outage or if the device rebooted.    I will dig into this deeper with Meraki support in the hopes they can identify reboot events, but wondered if anyone else was seeing anything similar? ... View more

For client VPN, I believe the following to be true:   1. If account type is Guest, client VPN password is set by a dashboard admin via the dashboard. 2. If account type is Administrator, client VPN password is the users dashboard password.   Are both of these assumptions true? And for #1, can the users reset their password themselves?   And do the options in Organization -> Settings -> Security Settings apply to both client VPN users and dashboard admins? If it doesn't apply to dashboard admins, is it possible to force 2FA for admins some other way?     ... View more

Is sorting by Usage on the Network-wide -> Clients page not working properly for anyone else?   I've tried a few different time periods on multiple networks and multiple organizations, and in every situation, sorting clients by Usage results in a list that is not sorted by usage (haven't figured out what its actually sorting by). ... View more

Hi all, two questions regarding site-to-site VPN firewall:   Question 1: I have 30 networks in the same dashboard organization with site-to-site VPN (Auto VPN) enabled in hub (mesh) mode at all locations. One location is "headquarters" and the other 29 are smaller remote locations.   We'd like to change things so the remote locations cannot talk to each other and only talk with headquarters. To do that, I believe I have to change all the remote locations to Spoke mode instead of hub, and then implement outbound firewall rules to block traffic between the remote sites.    Is there someway to write the rules so that hundreds of rules aren't required? Some sites are 192.168.x.x/24 and others are 10.x.x.x/24.   Question 2: If IPv4 translation is enabled under VPN settings, should the above mentioned firewall rules be written using the translated subnets?   Thanks!     ... View more

Hi all,   The dashboard tells me MG 1.9 is the latest stable firmware for MG21, released Dec 2019. That seems pretty old in the Meraki world. I see there is MG 1.11 beta available, released in Jun 17 2021, and that seems for a long time for firmware to be in beta.   Does anyone have any experience with MG 1.9 firmware vs MG 1.11 firmware on the MG21? Wondering if that lack of a more recent beta version means that MG 1.11 is fairly stable and might go to stable RC at some point.   We've had a few issues with MG units falling offline and/or not connecting (same cellular carrier used for all of our MG units), so I am considering trying MG 1.11, curious how others have made out with MG 1.11 firmware.   ... View more