I strongly recommend that you contact support. They handle a large number of questions about licensing. ... View more

Unfortunately, it's four hours away, or else I'd absolutely have done the laptop thing. I'm also data gathering for my coworker who's technically managing this ticket, but keeps roping me in to act as the Meraki translator. 🙂   I'm checking to see if he's had someone on-site try with a laptop, to confirm that it's actually the MX. It's easy to latch onto testing with the device you can control when you're this far away...   I can tracert the problem GW successfully over WAN1, on another vendor, so I know it still exists. But it won't talk on WAN2. Hence, yeah, DHCP panic mode.   Thank you! ... View more

Change is a thing that exists, but I'm going to go out on a limb and note that no senior engineer I know would use a firewall to perform all routing for a network. That includes some folks who live at the bleeding edge of network development.   Vendors say a lot of things. Not all of them are good ideas. ... View more

@Brons2 wrote: Thanks Nash, that was the sort of feedback that I was looking for, although it makes me a bit sad. There's a hacky thing where you can briefly disable DHCP then re-enable it, but that then kills all active leases. I've usually had IP conflicts pop up when I've had to do that.   I have rapidly enabled Meraki DHCP when DCs have died, and it's gone well enough so long as my end users renew their leases. ("Please reboot your computer." x infinity at Windows.)   You can make a rapid swap less painful by maintaining a list of devices that have static IPs assigned or DHCP reservations, such as printers. ... View more

I don't enjoy Meraki as a DHCP server.   There is no simple way to cancel a single DHCP lease.   For me, that alone makes it a non-starter in any environment where I can feasibly have a different more fully featured DHCP server. ... View more

Oh, solidarity. I have several clients with, you know, hundreds of machines on 192.168.1.x or 192.168.0.x and they don't see why that ever needs to change.    Glad you're using AD creds on the VPN though. That makes life a lot easier, right? ... View more

How are you trying to access the drive? By fully qualified domain name, WINS (please no), IP address?   What kind of VPN credential are you using? If Meraki cloud credential, then Windows automatically tries to use that credential to authenticate to the remote server.   Assuming you created this as a single user connection, instead of in the Public phonebook, there's a simple fix.   Use PowerShell on the user's computer while logged in as her: # Set RASPhone.pbk so that the Windows credential is used to authenticate to servers. # Important when you use Meraki cloud credentials. $PbkPath = Join-Path $env:APPDATA 'Microsoft\Network\Connections\Pbk\rasphone.Pbk' (Get-Content -path $PbkPath -Raw) -Replace 'UseRasCredentials=1','UseRasCredentials=0' | Set-Content -pat $PbkPath   Otherwise change $PbkPath to the exact file path for her appdata, instead of using 'Join-Path $env:APPDATA' to append the environmental variable.   If it is Public, change it to $env:PROGRAMDATA. 🙂  ... View more

@MichaelStacks Love a Z series instead of client VPN for days.   If you need a reference, here's the document that addresses the licensing for Z vs MX: https://documentation.meraki.com/zGeneral_Administration/Licensing/Meraki_Licensing_FAQs   Scroll down to/search for "Is Advanced Security Licensing available for Z-Series devices?" ... View more

Did you try to delete and recreate the problem policy? That can be simpler than adjusting the settings after it's done. ... View more

If the LAN subnet is working fine, that sounds like you need to poke your vendor some more about setting your client VPN subnet up "just like my LAN subnet." 😕 ... View more

I forgot about tag-based failover! If you can swing it, that's what I'd do.   I've got clients where unfortunately that's not on the table. I'm jealous of those who can swing it. 🙂 ... View more

You may be right! Good luck. I usually have to provide the list of subnets that need access, then patiently poke until the changes all get made.   On your original working subnet, are you able to ping that target server? If not and you know what port you're using... In Windows, you can use Test-NetConnection to initiate a TCP handshake.   So if it's on port 443, for that IP, you'd do: Test-Netconnection -Comp 10.209.95.84 -port 443 -info detailed ... View more

Double-checked config at a client where we do this.   Your static route should be fine unless you've got a weird ACL thing going on somewhere.   So I'd bet money it's your vendor. I hope they get back to you soon. ... View more

You're welcome! Hope it helps.   I strongly recommend setting it up exactly as Meraki recommends on all policies. Get it working then see if the NAS port type is still an issue. I'm pretty sure it won't be. 🙂 ... View more

Oh gosh, I see. You're having trouble with the client VPN? I assumed wireless because it's in the wireless forum. @MeredithW I think this topic needs a move maybe?   Since client VPN, have you built out a fully separate setup using https://documentation.meraki.com/MX/Client_VPN/Configuring_RADIUS_Authentication_with_Client_VPN ? Do your settings for it match this exactly?   I've followed the above for NPS for client VPN on a couple dozen servers now, ranging from 2008r2 to 2016, and not seen the problem you are encountering. Including at clients that also use NPS for 802.1x. ... View more

Just to confirm, did you follow https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise to set this up? Have you validated your settings against it? ... View more

If there's two separate corporations with two separate authentication methods, why do you have them sharing the same vlan? I don't understand that design thinking.   20 questions time:   Are these SSIDs all broadcast on the same APs? Do you get the same result when associated with every AP?   Does the speed change at all, or is it always like this regardless of client mix? What minimum bitrates are you using?   Do you have group policies applied to some devices with bandwidth restrictions? ... View more

Thank you for this heads up. We use MS120-8 ports to split ISPs between multiple firewalls, at a couple clients who also have other Meraki equipment. ... View more

Key way you can tell you're using the wrong URL, based off the phrase   Page not found - Cisco Meraki Classic 404. 🙂   When you share the URL, please make sure you strip out your organization and network IDs for your own security. Thanks!     ... View more

You can only have a single IP address for any given third party tunnel. Unfortunately, there's no ability to do primary/secondary target IPs.   Based off conversations I've had with Meraki staff, I don't believe primary/secondary is on the horizon at this time. ... View more

PowerShell scripts for Windows 10 VPN? Sure, I do it all the time, across hundreds of endpoints now.    My script is a little different from the one in this thread. I modify the rasphone phonebook so the client VPN won't try to use the VPN credentials to access server resources.   I'm gonna go add that reboot reminder to mine now... ... View more

The content filtering is URL-based and doesn't care about packet contents.   I don't believe the MX will perform certificate inspection this way.   I certainly do not recommend using it for HTTPS inspection, since it makes your throughput go to pot as well as the MITM issue. ... View more

To confirm:   You need to maintain a large Meraki cloud credential user database. You want to use AD credentials to provide Meraki dashboard access for managing those.   Solution:   Setup SAML SSO: https://documentation.meraki.com/zGeneral_Administration/Managing_Dashboard_Access/Configuring_SAML_Single_Sign-on_for_Dashboard   The linked document includes instructions for setting it up with several supported methods. There's also Azure support.   If you want someone to only be able to manage users, create a role with the Guest Ambassador permission. You'll have to set this up on a per-network basis. ... View more