Call in to support, verify that you've gone through their troubleshooting steps, request/be sent an RMA as long as it falls under warranty?  ... View more

Hi @DunJer622,    Interestingly enough, I had a somewhat similar issue with an older DC (my backup DC). I believe it came down to the Active Directory integration on the MX100 we have. Meraki uses WMI to read the security log and polls VERY frequently. I'm not 100% certain, but I think it tries to read the ENTIRE log each time. I ended up reducing the size of the log kept on the domain controller for those security events so that it wasn't trying to read as much data at each interval and that seemed to clear up our issue. It's been a while since I had to look into that, but it might be a good place to start?    See Active Directory Servers and Security Auditing in Meraki Documentation ... View more

Hi @Reactor,    1. Client VPN should show up when you navigate to Security appliance > Route table.    2 & 3. Personally, I create Group Policies that I apply to all VPN Connections to our Network. My default network policy is very restrictive for that subnet. Once the VPN Connection shows up in the dashboard, I will apply an appropriate policy depending on what they need access to. (I would love to hear how others are managing this if there's a better/easier way) ... View more

Hi @Gordon,    Where have you been entering in the address to put the block in place?    You should be able to use blacklists and whitelists on the Security Appliance > Content Filtering page.  You can also override or append these using group policies assigned to individual clients. See Network-wide > Group policies.   Whenever a client fetches a web page on the network, the requested URL is checked against the lists configured to determine if the request will be allowed or blocked. Pattern matching follows these steps:  Check if the full requested URL is on either list. e.g., http://www.foo.bar.com/qux/baz/lol?abc=123&true=false Cut off the protocol and leading "www" from the URL, and check if that is on either list: foo.bar.com/qux/baz/lol?abc=123&true=false Cut off any "GET parameters" (everything following a question mark) and check that: foo.bar.com/qux/baz/lol Cut off paths one by one, and check each: foo.bar.com/qux/baz, then foo.bar.com/qux, then foo.bar.com Cut off subdomains one by one and check those: bar.com, and then com Finally, check for the special catch-all wildcard, *, in either list. If any of the above produces a match, then the request will be allowed through if it is in the whitelist and blocked otherwise. (That is, the whitelist takes precedence over the blacklist.) If there is no match, the request is allowed, subject to the category filtering settings above. HTTPS requests can also be blocked. Because the URL in an HTTPS request is encrypted, only the domain checks will be performed (www.foo.bar.com, foo.bar.com, bar.com, com, and the special catch-all *). ... View more

At this point, I don't think I'm quite as worried about the "cloud-controller" meeting the compliance requirements. Most of the controls around that can be put into place easily enough.    I don't know, however, if the Meraki VPN (both client and site-to-site) holds up to the standards required. FIPS 140-2 Validated encryption, I believe. Hoping to hear some more input around that.  ... View more

Hi @C3SGInc,    They could use Port Isolation on the switches and have SSIDs setup with Wireless Client Isolation. This would minimize trying to keep up with different VLan setups and isolate all traffic. This would also isolate traffic between devices if a single tenant has multiple devices that do need to communicate, however.     Isolate Switch Ports     Isolate Wireless Clients ... View more

Hi @MGianni,    Did you try removing the existing assignment, saving, refreshing the page, and then adding the new one? Did you get that same error result?    I've also ran into interesting browser issues from time to time and have been able to use another browser when it wouldn't allow me to change configurations.  ... View more

Haha, @PhilipDAth...you have one of those laying around?  ... View more

@Adam, I do the same thing for our auditors that come in now. SSID expirations work, but only for a single scenario. I'd like to see a more wide-spread solution. I really think it would unlock the dashboard's true potential around using Tags. Maybe they could add a "Tag Control" section to "Network Wide."    Thanks for chiming in! ... View more

Thanks for the response, @Seppi!   While the API can and would undoubtedly work for this scenario, my point would be to integrate it into the heart and soul of the Meraki Dashboard for ease of use and much the reason that so many love Meraki products. I think that many could benefit during out-of-the-norm and one-off requests when they are able to schedule expiration dates/times and have that autonomous remediation to a temporary change. You can enable those that may not be as tech savvy or comfortable with using the API integration or simply do not have the training and knowledge to do so.    Easy Tag Control is the ultimate goal in my ideals here.  ... View more

@Eliudprom, correct. At this time, CMNO is the only User/Admin certification for Meraki products. However, I'd like to think they will have more or add-on certifications in the future.  ... View more

Hey @Jay1,    Check out this thread, should help you out.    https://community.meraki.com/t5/Getting-Started-with-the-Meraki/How-to-Limit-the-emails-the-community-sends-you/m-p/6452#M350 ... View more

Word. ... View more

I definitely want to see the after photos, @BruceW! ... View more

I guess I kind of considered this covered under "Off the Stack" already.  ... View more

I agree, @PhilipDAth.    @MerakiDave needs a shout out, for sure! ... View more

Welcome to the board, @jared_f, and thanks for your contributions! As always, congrats to everyone that contributed this month, not just the ones with the top kudos.  ... View more

Congrats guys!!! ... View more

Hi @justdaj007,    To get your Cisco 800 series connected through your MX, I believe the best way would be to use a 1:1 NAT under the Security appliance > Firewall > 1:1 NAT section. There you can plug in the public IP that you want to use to reach your device and that devices internal IP. Creating a VLAN for the appliance to use (and possibly your VPN clients connecting to it) may make it easier to control the traffic of your VPN clients once connected. I guess this would depend on configuration and the business need.     Configuring 1:1 NAT ... View more

@PhilipDAth, I use the same. Don't remember where I found it...maybe from you?  ... View more