Two last things, @cwal21.    Have you run the Network Reset utility in Win10? If you have and it's still broken...   Have you uninstalled and reinstalled the WAN miniadapters? Usually, it's sufficient to only do the L2TP one.   Here's the instructions I gave my help desk:       1. As administrator, open Device Manager.       2. Under View, select Show Hidden Devices:       3. Under Network Adapters, find WAN Miniport (L2TP)       4. Right click and select Uninstall Device. If it asks to uninstall the DRIVERS, click no.         5. Reboot the computer. Windows should automatically reinstall the device.       6. Test the VPN again. ... View more

So you don't find any error codes in Event Viewer. It just dies off?   The "overlay" between the standard Windows 10 method (click on network connector by clock, click VPN, login) is pretty wonky and will not always pass correctly to rasphone. Rasphone's what's doing the dialing at the end of the day.   Suggestions:   Windows-R, run rasphone.exe. Find your saved VPN there. Try to connect with rasphone and see if it goes through.   If it does, you can make a rasphone.exe shortcut. Create a shortcut on your desktop, and set the target to: C:\WINDOWS\system32\rasphone.exe -d "VPN NAME"   If it doesn't connect, delete and re-create the VPN connection. I like the scripts I put above, especially if you want a split tunnel connection. Read the script comments before you run - it does more than create a saved VPN connection. By default, it'll make a rasphone shortcut on the desktop. ... View more

How did you deny internet access to vlan 3? Is it a set of permit statements for the associated subnet followed by a blanket deny for said subnet?    If so, then you'll need to add permit statements between the subnet for vlan 3 and your client VPN subnet. ... View more

So to confirm, your only source of AD is Azure AD? You do not have an on-premises AD that syncs to Azure? ... View more

What version of firmware are you running on the MX? There's a thread from earlier this year that discusses a way to work with support to get 15.x to support IKEv2. Most of the changes to it, it looks like you're going to have to work with Support. ... View more

Windows 10 is a problem that can be dealt with. I've got some PowerShell scripts that create a split tunnel by default, so long as you feed them the appropriate subnets. ... View more

I work at a VAR/MSP combo. We have dozens of clients with Meraki equipment.   Do you know how much time it saves us to not have to manually update software...? I'm getting ready to do Cisco equipment at a client, and it's taken me a couple hours just to verify existing firmware, get the new recommended firmware, transfer it to the client's network, and book an outage.   Meanwhile, updating all the MX to 14.x was about an hour of checking firmware and scheduling updates for 3am. ... View more

Sure can: https://dashboard.meraki.com/api_docs#reboot-a-device   I'd probably:   IF you have multiple orgs, pull a list of orgs Pull a list of networks for your org Pull a list of devices Check if a device is an MX If MX, add serial to list For device in list, send reboot command. 🙂   I've got some Python code snippets I can throw into a github if you're not sure how to execute this.   Edit: Or @BrechtSchamp can beat me to the punch after help desk interrupts me! ... View more

I've had success in the past with having support disable nat-t. It was between an ASA and an MX65, but I had a tunnel that just kept... dropping. Up and happy for a while, then boom splat unhappy remote site with no DNS.   After support disabled NAT-T, it has stayed up successfully for almost two months. I hope you get the same result! ... View more

Make sure you set the SSID firewall so that the guest wifi doesn't have access to your normal network. It can be easy to miss, even if you're following that doc. ... View more

@Cmiller No, I thought I'd just mention the scripts exist and not share...   I threw them up in a github repo: https://github.com/gammacapricorni/happy-meraki-client-vpn   They're mostly based on snippets I've found on the forums here, all mushed together to pro-actively avoid common problems that my help desk has run into. I taught myself PowerShell for these so... they may not be super well written, but they mostly work.   AddMerakiVPN.ps1 is designed for you to pre-populate it with VPN name, address, PSK, and any routes for a split tunnel. I believe it should be possible to apply via GPO, but I haven't been able to try that. The server folks are not as interested in VPNs as I am.   AddMerakiVPN_Prompts.ps1 is designed for my help desk to use when someone from any client calls in. They pull the VPN details from our documentation, answer the prompts, then delete the script when they're done. Allows us to update the info in one place, rather than maintaining scripts for dozens of clients. ... View more

I took a quick look at the NPS logs for a client of mine. Their requests also originate from a 6.0.0.0/8 IP address. I'd be willing to bet that this is due to communication with the Meraki cloud but I have no proof. ... View more

I can confirm as well. I'm getting:   Lat lng address serial mac lanIP tags name model No network ID.   Perhaps @DexterLaBora can shed some light on this? ... View more

I've seen it clear within a couple of hours on its own, but I was using a two hour time window. Double check your time window. It can be up to a month.   LLDP and CDP info is sent to the dashboard every ten minutes.   N.B. I do primarily interact with CDP via the API, because I'm often needing it for all devices in a network including the MX. You have to explicitly declare a range in seconds of less than one month there.   You can do a quick test of what the API endpoint sees in Postman. You'll need to: 1. "List organizations that the user has privileges on", 2. Make an "organizationId" variable and populate it with the org id. 3. "List the networks in an organization. 4. Make a "networkId" variable and populate it. 5. Make a "serial" variable and put your device's serial number into it. 6. Then use Device/"List LLDP and CDP information for a device". ... View more

I feel like the real take-away message here is that many of us would be very happy to pay Meraki for swag. I mean, it is usually much cuter than the Cisco denim shirt I see a coworker running around in. ... View more

If you're using the MX as a DHCP server, I've run into problems with Sonos when the DHCP is using the upstream DNS. Or rather - the Sonos speaker magically began working after we statically assigned the DNS, rather than using the upstream DNS function. ... View more

1. iNetTools Pro (ping, trace route, DNS lookup, port scan, whois... super useful little bundle) 2. Ookla Speedtest 3. Google Authenticator, because of course 4. IT Glue for accessing things like, say, the wifi password when I'm on site. Otherwise website 5ever. 5. Chrome. I spend a lot of time researching stuff quickly on my phone while teaching my help desk how to do something. 6. Do the camera and flashlight count as an app? ... View more

Do you mean you're not able to figure out how set DHCP options? If so: https://documentation.meraki.com/MS/Layer_3_Switching/Setting_Custom_DHCP_Options   Or are you looking for help to translate that into Meraki's DHCP options? ... View more

No, sadly, we can't do that for third-party tunnels. You get one IP and if it changes welp, you get to manually change it.   I wish we could do primary/secondary a la ASAs. ... View more

1. Turn on API for all organizations, manually. 2. Generate API key. 3. Get list of orgs that your API key has access to. 4. Build list that correlates org names and org numbers. I like objects in Python for this. 5. Write each org name and each org's results of "Return license state for organization" to a file. 6. Celebrate! ... View more

Meraki equipment gets its time from the dashboard, and can't serve time to other devices on your network. ... View more

If I understand correctly, your MX will route between the client VPN subnet and whatever subnet(s) or routes the MX knows exist.    You can use the firewall on the MX to restrict what internal access: https://documentation.meraki.com/MX/Client_VPN/Restricting_Client_VPN_access_using_Layer_3_firewall_rules ... View more

Do you only have a single account as full admin on your organizations? Meraki best practice is to have more than one full administrator on an organization, for situations such as this. If you don't have a second person you want to add, you can always create a second email address for explicitly this purpose. ... View more