Not an issue in any of my orgs. Does it persist if you try another browser? ... View more

Ok, but then i dont understand why you need the LAN ports on your MX pair connected to the WAN switches.    Normally you would just connect your internet interfaces towards WAN. Say WAN switch 1 connects ISP1. Then internet 1 on both MX units should connect to WAN switch 1. Create two ports on WAN switch in the same layer two domain. On the WAN switch create a /29 network. 1 IP for the WAN switch SVI, 1 for each MX internet 1 interface and 1 Virtual IP shared between MX on internet 1.   Repeat same steps for Internet 2 interfaces and WAN 2 Switch.   There should not be any layer 2 connectivity directly between the WAN switches.   This way if isp 1 goes down the MX pair will fail over to ISP 2. ... View more

A lot of stuff to go through here. Need more information.    First, remove the direct connections between your MX250 if that is what the lines between them is. That is not a supported configuration.   Second, why do you need the WAN switches?   Third, what are you trying to achieve with LAN and Internet interfaces connected to the WAN switches?   The MX does not partisipate in STP, but it does forwards BPDUs.   This article also might help you out 🙂 https://documentation.meraki.com/MX/Networks_and_Routing/MX_Layer_2_Functionality    ... View more

Without more info its hard to say. But, since your NPS recieves the access-request but does not return the access-challenge something might be wrong with radius clients on your NPS. Verify that the client config contains the switches management ip and verify the shared secret.   It could also be certificates missing from trusted root and the personal store on the server, but it sounds like you already checked that.   Read this article and see if you missed something. It might give you some pointers as to whats missing. Its for access points and uses PEAP, but much of it still appliens to EAP-TLS. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise  ... View more

The Area number, type and timers must be the same between OSPF peers.   Meraki only supports the broadcast type peer. If someone has configured your peers OSPF interface as a point to point interface it must be changed to broadcast.   Otherwise just make sure that there is layer 2 and 3 reachability between the peers. Start by pinging the other side and see where that gets you. ... View more

That is an architectural decision you need to make. None of the answers are wrong. Find what suits your setup best.  ... View more

How exactly how Meraki handles tunnels is unknown to me sadly. But i read somewhere that the MX only does policy based VPN. ... View more

if you plan on doing it without BGP you would need to do something like this. Tag-Based IPsec VPN Failover - Cisco Meraki Documentation   When you configure two static tunnels towards the same network segment the traffic will flow across both tunnels at random i think.   A better solution would be to do site to site with BGP peering. It's available from MX19.1 and up, so quite fresh. But it could be worth looking into. ... View more

Yes. Also, use the unique client identifier options when selecting client tracking.   https://documentation.meraki.com/MX/Monitoring_and_Reporting/Client-Tracking_Options  ... View more

Yes this is perfectly valid. In most cases of a network this size i would add a warm spare MX, create a stacked distribution and dual home both stack members to the MX.   https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair    Assign 2 bridge priorities if you run a stacked distribution. Low priority for your distribution switch and default for the rest. If you opt out of stacking and connect multiple switches to the MX just assign lowest and second lowest priority to the two switches closest to the MX.   The MX has multiple LAN ports for reasons you outline in your drawing. Multiple switches connecting, routed connections coming in on the LAN side, a third wan interface etc etc.     ... View more

Sure. Here and here.    https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration    https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview  ... View more

Maybe full tunnel vpn exclusion could work for you? https://documentation.meraki.com/MX/Site-to-site_VPN/VPN_Full-Tunnel_Exclusion_(Application_and_IP%2F%2FURL_Based_Local_Internet_Breakout)  ... View more

You would need some sort of device compliancy check. Not possible to do nativly in the dashboard. What you could do is configure a radius service, ISE for example to get compliancy status as part of the authz sequense and grant acces based on that.   You could also do SAML to for example Entra ID. There you can controll access by defining policy in Conditional access.   Either way MAC filtering would not be a good solution even if it could be done. ... View more

You would need to do some sort of split tunneling since VLAN 5 is not a "local LAN" for your clients. If Secure Client is configured on a vMX you can go to the client VPN tab on your VPN headend, select anyconnect and scroll down to Client Routing. There you can add the network to traffic exceptions for example. ... View more

1. If the hubs are in the same organization and you use Auto-VPN the hubs will automatically build AutoVPN tunnels between them self. This is the default hub behavior.   If you want the connectivity between cloud providers to be handled in Azure and AWS i would do VPN tunnels with the VPN gateways. This would be more complicated then the above option, but might save on cost or capacity depending on your vMX size and billing.   2. Yes, but i would use hub and spoke. Full mesh means that all hubs and spokes form direct tunnels with each other. This is hard to scale unless you have a low amount of MX appliances in your org. I would do hub and spoke. Add both the AWS and Azure vMX appliances as hubs in your topology. Your spoke site will then create auto vpn tunnels to both. ... View more

You can have both in the same org. Also, i would suggest that you take a look at the subscription licensing model. It might suit your org well. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Subscription_Licensing_Overview    ... View more

I dont think you can do that. The secondary radius server in the list will only be used if the primary goes down. If i were you i would pick a site or talk to your Cisco rep to get a vMX trial license that you can use to test the new radius server. Simply create a new network, add the client vpn config and create a new anyconnect profile you can install on test clients. When you are happy with the result you simply change the radius server on your production network. ... View more

Did you add the Client VPN subnet to a routing table in Azure? I dont know how your vPC is set up, but if you dont run any dynamic routing you need to attach a Route Table to your subnets that tells azure that if you want to reach 10.253.1.0/24 you need to go to next hop Virtual appliance with your vMX private IP as the destination. ... View more

Sounds like you are looking for RX-SOP? https://documentation.meraki.com/MR/Radio_Settings/Receive_Start_of_Packet_(RX-SOP)  ... View more

Ebay, Amazon. Take your pick. But you might get issues with support in case that device brakes.   If second hand market is not an option i would purchase new MX105 or MX95 depending on your requirements. ... View more