Are you trying to do something like AutoVPN as well as MPLS?   If so, Meraki has a document here on how to configure a failover situation. Please note that it does not discuss load balancing across the two links, as they are not both WAN.   Please also note that it clearly shows the MPLS connected as a LAN connection, as opposed to WAN. You might also find this article useful. ... View more

Does all your traffic hit the MX before being able to go to that IP's subnet?   If it is, you probably really need a switch (with L3 if you've got multiple subnets). MXes aren't routers.   If not, then the outbound rules on the firewall won't help you here. If your traffic is on the same subnet, or if routing between subnets is handled by a proper L3 device, then it won't hit your MX's rules.   You'll need to setup an ACL on the appropriate switch(es) in order to a) first allow your wanted traffic then b) issue a blanket deny to that IP. ... View more

Count me as another vote to use the dynamic DNS provided by Meraki when configuring profiles on your end user's computers. It's especially good practice if you have multiple WAN links.   Easiest place to grab it is from the Client VPN page - it's the second line down, starts with Hostname.   If you don't want to be using wharrrrgarrbbll.dynamic-m.com, you can setup a CNAME record for vpn.yourdomain.com or whatever, on your public DNS. ... View more

I honestly like it, but I need assistance with keeping my eye on a single line. I'd kill for some light-dark highlighting, really. ... View more

Haha, yeah, it is. I just have to talk others into using them when "that's not how we've always done it." ... View more

Thank you for the insight, @MerakiDave. My company's default had been to create a single wireless network for organizations with multiple sites, but I'm now thinking that we shouldn't oughta do that. Especially not for sites that have multiple types of Meraki equipment. (Most commonly - MX and APs.)   Our thinking had been that it makes it easier to broadcast the same SSIDs across multiple sites. But how hard is it to setup the same SSID, really? Especially when the clients don't want PSKs changed regularly.   We don't have a lot of large deployments right now, but we will in the near future. I'm going to start a team discussion about creating a new standard to put us in a better position for when that happens. ... View more

Power cable bags are good for random cables in your go-bag. (Cisco console cable, micro-USB, power cable for my laptop charger.)   Not good for hand-embroidery, as the weave is very very fine and you're going to drive yourself nuts trying to cover any amount of surface. It's also very firm and you will stab yourself due to needing a sharp needle and forgetting your thimble. I did try though. I wanted to label with pretty colors vs. bad sharpie handwriting.   I suspect they'd take ink stamping very well, so long as you put something absorbent in the bag to prevent bleed-through.   Stacking cable bags hold small knitting projects. I've thought about using one to hold my common screwdrivers, with a couple of paperclips slipped through a few warp threads.   Power-injector bags are good for dice bags.   Who's guessed I work for a VAR and have a heap of these things? ... View more

This situation is why we need a test setup specifically for the client VPN, if that's even possible.   I don't think using the 802.1x test off your wireless would necessarily be too helpful here, since that'd be testing off your APs instead of the fw. Did you copy your 802.1x config over to the new NPS server, with your APs as valid clients?   If you're using that test button and not getting a valid test when you should, you probably should check to make sure that packets are actually leaving your device and being received by your NPS server. You can do a pcap off your Meraki device, and then check your NPS logs on your server.  ... View more

Have you tried a factory reset on the device? If you've done that, and it's still exhibiting this behavior, I'm also Team RMA. ... View more

I'd be down, even though I desperately try to stick to being the nerd in the corner and not care about salesing. 🙂 ... View more

Obvious question is obvious, but are you certain that the dashboard API is enabled on the organization(s) that you are attempting to work with? ... View more

The port forwarding endpoint is so good. Saved me quite a bit of time this morning.   I'm really interested in being able to manage L7 rules via API though. I know it's been on the roadmap for a while, from what a Meraki SE told me last summer. We had a large project we had to pass on because the L7 rules aren't in the API yet... ... View more

I'd honestly recommend swapping to RADIUS, but if you have to use Meraki cloud...   Assuming a Windows computer, you can modify the rasphone.pbk file such that it won't try to use the VPN credential to authenticate to the server. It's fairly simple to do in PowerShell, so I've grabbed snippets from a larger client VPN install script of mine.   You will need to run this again every time you add a new VPN connection to the Windows client, if I understand correctly.    This only works if the rasphone.pbk file exists where it's expecting it to. So make sure you have a VPN connection setup and make sure rasphone.pbk exists.   Single user connection:   $pbkpath = $env:APPDATA 'Microsoft\Network\Connections\Pbk\rasphone.pbk' (Get-Content -path $pbkpath -Raw) -Replace 'UseRasCredentials=1','UseRasCredentials=0' | Set-Content -path $pbkpath   All user connection - launch PowerShell as admin:   $pbkpath = Join-Path $env:PROGRAMDATA "Microsoft\Network\Connections\Pbk\rasphone.pbk" (Get-Content -path $pbkpath -Raw) -Replace 'UseRasCredentials=1','UseRasCredentials=0' | Set-Content -path $pbkpath ... View more

What's your goal here? Is this theoretical, or do you have a specific reason to want to avoid using an actual switch on these APs?  ... View more

@Bonifas Is the end user saving their credential? This can also cause Win10 to change the password protocol away from PAP. Since my help desk has told end users to no longer save credentials, but to enter it every time, it's reduced the incidence of this behavior.   Assuming an AD environment where all client VPN users have an AD account... It's easier on the end user if you can integrate the VPN with their AD account, either via RADIUS or the straight up AD integration. We typically use RADIUS, since not all customers are willing to get a valid certificate for their AD server.   You can also try changing the encryption level to Optional. Windows 10 does not actually support Required encryption for PAP. It will assume the encryption level is correct and then helpfully change the password protocol to one that supports required encryption. ... View more

Bonifas - that's 789, right?    Assuming this is a one PC error and you know the PSK/all settings are right: I have had luck before with uninstalling the WAN Miniport L2TP device under Device Manager, then have DM scan for new hardware. Sometimes I'm lazy and just reboot instead, because I have bad habits.   If you don't see the WAN Miniports, click View and select Show Hidden Devices. Make sure you don't uninstall the drivers themselves,  ... View more

Having to do it for every shard makes sense. Propagation can be fussy. I hope you all get it resolved soon - if it's frustrating for me, it must be worse for the support staff at Meraki who are trying to fix. ... View more

I just ran into this a few minutes ago, after having to change an account's password. It'll let me in if I paste the password into the prompt, sometimes after 2-3 tries, but it's incredibly annoying.   edit: Wow, escalate that to unacceptable, because now I've had trouble logging into my normal admin account. Test pulls on my API key can't agree on how many organizations I have access to between pulls, and I keep seeing a stomach-dropping 5 orgs on my organization list. I should have 60+. The MSP portal page is correct, but uh... this is not okay. Ticket time. ... View more

For this problem, the best solution is to install the 14.x beta firmware. It prevents AMP from getting "indigestion" and blocking downloads based on false positives.   My procedure is:   Restart AMP: disable it, save, wait for MX to update its config, then re-enable it.   Enable beta firmware under Network wide->General and schedule an update for maintenance window via Organization->Firmware Updates. ... View more

Agreed. It's been beta for ages, but I've installed 14.x on more than a dozen devices now without any problems. It fixes so many tiny issues that it's absurd. ... View more

I picked this up on this forum somewhere. Best thing I've found is to create the saved VPN entry using Powershell:   Add-VpnConnection -Name $ConnectionName -ServerAddress $ServerAddress -AllUserConnection -TunnelType L2tp -L2tpPsk $PresharedKey -AuthenticationMethod Pap -EncryptionLevel Optional -Force   Run this in powershell as administrator and it will add the entry to all users on that device. Replace the $variables as appropriate. Windows 10 doesn't support required encryption for PAP - you can see for yourself if you change this to "-EncryptionLevel Required'.   Tell your users to enter the user name and password each time. Do not set it to remember.   We prefer to setup clients with RADIUS authentication with NPS, so having them manually enter the password saves my help desk grief. If the credential is saved, we get a ton of "my VPN doesn't work" tickets because the end user's changed their Windows password. ... View more