Welcome @Russ_B, this is a great source of information. Just post your questions and normally someone knows the answer. ... View more

@hmc25000 as everyone else has said, it comes down to what you need, there isn’t really a direct match. The MS210-48LP with stack, and the MS225-48LP will add 10Gbps uplinks to that, and they both support basic Layer 3, 16 connected and 16 static routes.   The MS120-48LP is Layer 2 only, as is the MS125-48LP but it does have 10Gbps uplinks, although there is no physical stacking with either of them.   I’d also be wary of the MS120 and MS125 if you want to use some of the newer features. They are great Layer 2 switches, but have limitations around ACLs, and can’t run SecureConnect and Group Policy ACLs as an example. ... View more

@DHAnderson the vMX runs as a virtual appliance within Azure, so it uses a standard Azure compute instance, most likely a 'Standard_F4s_V2' (but could be a 'Standard_D2_v2' or 'Standard_D2_v3' too). This means you are paying for Azure compute charges just as you would for any other server in Azure.   You can use the Azure pricing calculator here, https://azure.microsoft.com/en-au/pricing/calculator/, to determine a rough idea of what it will cost for the compute platform, it various between country and region. You can also use the calculator to estimate data transfer costs.   Whether you use an ExpressRoute or an AutoVPN to a Meraki vMX really comes down to the expected transfer of data out of Azure - it costs less when using ExpressRoute. When you start transferring more than about 1TB to 1.5TB per month out of Azure then you need to consider ExpressRoute (that's assuming the vMX can do the bandwidth you want). That's based on my calculations, but I'd advise doing them yourself for your region. ... View more

@Tore, MSTP (or RSTP) don't pass information about which VLANs are visible or not, it determines which paths to block to prevent Layer 2 loops in the network.   Within the MSTP region MSTP BPDUs are sent on the internal spanning tree (IST), this is instance 0. This is the only instance for which BPDUs are sent and received, they contain all the information for other instances within that BPDU. When the IST connects to another MSTP region, or a RSTP domain, then it is known as the common and internal spanning tree (CIST).    At the boundary between MSTP and RSTP, the RSTP BPDU is used to interoperate into the common spanning tree (CST) of RSTP. The RSTP BPDU is fundamentally the MSTP BPDU but without the instance information (i.e. its just the BPDU for instance 0, the CIST). At this point you lose the two separate spanning tree instances and all VLAN spanning trees converge based on the RSTP BPDUs, you can still use all VLANs, they just don't have two separate trees. So if you have two paths between the MSTP region and the RSTP domain then one should end up blocking for all VLANs and one will end up forwarding for all VLANs; what this implies is that at the boundary port, if it is forwarding for the CIST then it is also forwarding for all other instances within the MSTP region.   I hope that makes sense - sorry lots of acronyms and can be confusing. ... View more

@Tore the Meraki switches (since they run RSTP) will only interact with instance 0 of MSTP. Instance 0, the common and internal spanning tree (CIST), is used to carry the CST across the MSTP domain. ... View more

Welcome @TokyoKevin. Congratulations on passing your exam, and there are plenty of people here who can point you in the right direction if you’ve got questions. ... View more

Welcome @ssaunders, post away and everyone will try and help. ... View more

@RumorConsumer there are some minor differences between the two and technically the MR52 may perform marginally better. The MR52 is a 4x4 array and so can use an additional signal path for MRC. But most clients are only a 2x2 or 3x3 antenna array, and so any benefit in one direction may be lost on the other direction.   If there is a benefit its going to be minor, and if your current experience is that bad then you are better of putting in another access point, its going to be a much better solution.   Also, keep in mind that the MR42 and MR52 are end of sale at the end of July - or sooner if Meraki hits supply issues. So you may need to consider what your next move is. Again, a Wifi 6 access point (MR44, MR46, MR56) may perform slightly better (due to some of the technical advances) but any improvement will likely only be minor and again I'd be suggesting you're better off putting an additional AP in. ... View more

You'll need to have a look through the Windows server and see if you can ascertain what is going on from the windows event log or performance monitors. What is the memory utilisation doing? Is it running out of memory (as well as the CPU peaking)? Do you see the WMI provider take CPU or Memory (the MX scrapes the Security Log every 5 seconds). Is the Security Log large, open it and see how many records are there (are there any logs there at all?). ... View more

@jjlarsson yes, you’re correct. If you’re using the MA-ANT-20 then you need to order 2x that SKU, so you have 4 antennas. Two on the top, two on the bottom of the AP. ... View more

@Twitch How much work it is to combine organisations depends on how big they are. Moving devices is easy, moving licenses is easy to (although requires support’s help if you’re in co-termination licensing mode), the hard part is moving the configuration. Depending how many networks and how complex they are it could be easy or hard. ... View more

@Twitch I don’t believe there is a way to advertise the remote routes across each organisation’s AutoVPN without adding some additional hardware to the network.  One answer could be for the parent company to put a VPN concentrator (part of their Meraki organisation) as a spoke into your network. You can then create static routes from your MX to point to this, and advertise those static routes into your AutoVPN. They then create local subnets on the MX concentrator to match your network subnets, which then get advertised into their AutoVPN. ... View more

Glad it helped. With regards to the TX Power, this is just the maximum the AP can use for that MCS, it doesn’t mean it will (or has) to use it. If you have multiple APs in the environment the Meraki cloud will adjust their power levels to reduce the interference between APs while still maintaining good service to the clients.  ... View more

@suneq,  we often use the design that you show with private IP addresses between ISP devices and the MXs. This is because in Australia there are very few (if any) carriers that will provide a /29 as the link, they'll only provide a /31 or /30, sometimes it has to be PPPoE. (They'll provide a /29 over the top of the link, but not as the link IP addresses themselves).   So the public /31 or /30, or PPPoE termination, sits on the ISP device with a /29 private IP address range between the ISP devices and MXs exactly as you state. The ISP devices also do a NAT from the private IP addresses to the public as @Paul_H stated. The only downside of using private IP addresses is the NAT, it can make things a little more complicated (sometimes) and can impact the performance of the ISP device (depending on that device). ... View more

Welcome @VilasithP, if you keep on watching this community you'll see lots of what is happening in the world of Meraki. If you look at some of the recent posts you'll see there was just announced some new MX and MG models, and also a new MV and MT too. ... View more

@endrianusgohan, just to add to what @ww said, when you do set this up (assuming you are doing full tunnel) your content filtering, etc. will be performed by the full tunnel client (i.e. closest to where the client is). This is stated in https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings.    ... View more

@jpier I agree with you that Postman is one great way to make multiple updates with only a few quick changes. You can also take this one step further and use a scripting language like Python to access the APIs.   Another path you may want to consider is using the Policy Objects for the firewalls (yes, its beta, but its been around a while now, and there are great successes with it). You define organisation-wide Policy Groups which you can then use in your inbound and outbound firewall rules (they don't work on Group Policy, yet). Then if you need to make a change you just update the Policy Object and its applied everywhere that policy is used. ... View more

@Lock007 I'm assuming that your DNS server also runs your AD Domain Controller function, as its the DC function that the MX integrates with. The MX integration has two parts to it, it binds to the DC to gather group memberships via LDAP, and it scrapes the security logs for logon events using WMI to match users to IP addresses.   I'd check both the Windows server event logs and MX event logs for errors to see if there is something not working correctly. I'd also check the permissions of the user account you are using to connect to the AD DC - maybe temporarily use a domain admin account to see if there is a rights issue, and then switch is back to a more restricted account if it works with the domain admin account (the permissions that are needed are given in this document, https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances)   Also, check the memory usage on the server too. If this gets high and results in a  lot of swap file activity this may be driving the CPU usage up. ... View more

I've always been led to believe that they cover sub domains, so microsoft.com implies *.microsoft.com also (* being a wildcard). However, I can't find any documentation to support this with regards to the MX traffic shaping rules. I'd also expect that for it to work the MX has to see the DNS request go out and the response return to be able to match the hostname to the IP address. ... View more

Using the copyFromNetwordId parameter shouldn't be changing the length available to other parameters, and the reference says that any other provided parameters should override those from the copied network (so it shouldn't be creating a name like 'A copy of ...').   I suspect this is a bug and I'd raise a support ticket.  ... View more