Hopefully your vendor will go for it. We've got a number of tunnels between our ASAs and client's Meraki MX, where we're doing VPN NAT on the ASA side. MX doesn't care so long as you tell it the correct subnet. ... View more

@CHag32069 wrote: Need some ruby red slippers for that to work 😆 It's amazing what you can do with a pair of cheap shoes, glue, and enough glitter that 30 years from now... people will be finding red glitter everywhere you've ever been. ... View more

If only it were zip up! I have curly hair and am vain as heck, so I don't wear pullover hoodies.   I'd happy leave it open over my "Nines don't matter if users aren't happy" t-shirt though. 😄 ... View more

@BlakeRichardson wrote: @NolanHerring  Let it go, let it go!! But I want to turn away and slam the door, Blake. ... View more

@PhilipDAth wrote: An interesting option to consider is weather to make the MX67 your primary device.  Performance wise, the MX67 will beat the crap out of the much older MX80.  You'd have to test it out and see how it went. If it's available to you, I like this option. The 67s are pretty beefy compared to something old like an 80. ... View more

We have a client with a similar situation, with all APs setup from PoE switches. We've disabled the switchports on the APs that we wanted to silence, to ensure that they weren't sending any traffic.   It was less fussy for us. ... View more

@NolanHerring wrote: It's been my experience that when you enable/disable MESHING, it automatically reboots the AP each time. Tested this on several occasions. However I have ran into a few issues with AP's not responding as well, which is why I setup my weekly AP reboots. In code 24.X, disabling MESHING was a VERY bad idea lol. It wasn't until 25.X that they fixed it so that it wouldn't cause issues (however a few still sneek in every once in a while, but it also might just be general bug and not related, who can really tell these days). I had the APs reboot when I disabled meshing, but then a small handful wouldn't let devices associate. Had to reboot that handful a second time.  ... View more

@MattRedis wrote: Thanks but do you think I will need to create VLANs on my fortinet firewall and switches as well? What kind of Meraki switches are you getting? Do any of them have L3 capability?   If you'll have L3 from switches, you can terminate your vlans on a core switch with SVIs, then setup a stubby transport subnet/vlan combo between your Fortinet and the core switch. Then you don't have to worry about vlans on the Fortinet at all. ... View more

Strong recommend to reboot your APs again after you disable meshing. I disabled meshing across a couple hundred APs on a few dozen networks a few weeks ago, and about 2-3% (ish) woke up and wouldn't let devices associate reliably.   After rebooting the grumpy APs, they were fine. ... View more

@ww wrote: Yes. If  both  exist you can combine  them.   If you add new gear to a "wireless  only"  it gets a combined  network  to.   https://documentation.meraki.com/zGeneral_Administration/Organizations_and_Networks/Combined_Dashboard_Networks And if you ever need to rearrange wireless/switch/appliance networks once you have a combined network, you can split it out then recombine. ... View more

The generally accepted solution is to use an additional firewall to terminate the third party VPN connections, either inside another Meraki organization or using a different model of firewall entirely.   Your other option is to stand up tunnels between your spokes and your third party VPN.    It's currently working as intended when AutoVPN won't let you use third party tunnels. ... View more

@jamesoc wrote: Hi Nash, thanks for your response, some really good information to take on-board.    Regarding not using the switches for L3 traffic, we don't have that much internal traffic, most platforms that clients access are SaaS based, so internal traffic would be low on the switch level. I should have said , that the test networks left and right don't hit the office MX80 and are separated. Would that change your mind regarding the L3 switch in your opinion?   That makes sense regarding the MX100 - thank your for that. Definitely worth upgrading to the MX100 over the MX84 so.     I was leaving those test networks out of my thoughts, yeah. 🙂   I don't think a low amount of east/west traffic really changes my mind. If you can move that traffic elsewhere onto a device designed to route, it offloads some strain from the firewall.   But regardless, I'd still probably look into an MX100. An 84 is a big improvement on an 80, but you might as well consider both larger sizes. Especially on the WAN bandwidth front. ... View more

My biggest question is: If you have an L3 switch inside the network, why use the MX as your router?    Using an L3 switch would let you handle your east-west traffic without having to hit the firewall. Then you could setup link aggregation and increase throughput on a local level, assuming you have the ports.   Regarding MX as routers:  MX really aren't intended to be used as routers, even though they can do it some. It makes them unhappy and eats a lot of resources.   I'd probably do you an MX100. You could SD-WAN your two ISPs for ~300 Mbps. An 84's WANs only do 320 Mbps in ideal circumstances. A 100 will do up to ~650 Mbps. ... View more

What's your user count? What's your projected user growth in the next 2-3 years?   Are you asking the MX to route, or do you have an L3 switch and I'm misreading your diagram? ... View more

Cloud-based networking is becoming more and more of A Thing. Even Cisco has products designed to allow for it.   Very cool about your grandfather's plane! We often think people are going to replace things, and then they just can't because the old solution was actually very good for reasons.  ... View more

@PhilipDAth wrote: It is a real common problem after Windows 10 updates.  @Nash loves this issue. True that it's a common issue, untrue that I love it. I just got mad and sunk dozens of hours into fixing it.   Try the scripts in my signature. Make sure you don't save the user credential. Make sure you use rasphone.exe to connect to the VPN, not the network icon in your systems tray. If you setup the VPN manually, choose "optional" Encryption. Windows doesn't support PAP with "required" and will change your password protocol.   If you try this and still have problems, give us a shout and we'll work through it with you. ... View more

Okay, when I test that one out, I get back:   {     "errors": [         "Traffic Analysis with Hostname Visibility must be enabled on this network to retrieve traffic data."     ] }   Because, well, hostname visibility isn't... enabled... on my test network. 🙂 So you're not getting that, you're getting empty? What's the return code you see?    I tested it using the Launchpad API key and I get returns that way, and the above 200 OK status.   What happens when you use the Launchpad API key? ... View more

As @jdsilva says, we really need to see your sanitized code.   Sometimes things like this are due to typos that you can't see yourself or something else missing. I recently wasted 45 minutes on something because I didn't realize I was using requests.put instead of requests.post, for instance. 🙂 ... View more

Where are your end users connecting from? Do you see connection attempts from their public IP(s) hitting your firewall event log? Some networks block 500/4500 and then whoops no IPSEC for you. ... View more

To confirm: You're able to connect on these PCs with your credential? Or did you mean on a working device? ... View more

I miss doing photography! What do you like doing? I tend to go for landscape or still life in black and white, because they don't... move.   I am terrible at candid photos. Just so bad. ... View more

Does your PSK end in a special character? If so, make the last char alphanumeric.    Are your devices with 789 fully up to date on Windows updates?   What's your user's authentication? If Windows (AD or RADIUS), does it work correctly on another device?   If Meraki cloud, can you log in with that credential on account.meraki.com? ... View more

Windows 10 or Windows 7?   789 is classically bad PSK, but it can also pop up when you've got a bad credential OR when Windows has changed the password protocol on you.   If Windows 10, check out the scripts in my signature.    Regardless of version, set Encryption to "optional": Windows doesn't support PAP with 'required' encryption.   Tell your users: Do not save your credential.   ... View more

I think your only real choice here is to call support and ask. They work a lot of license tickets and they're the experts on it. ... View more