You could try filtering on "AnyConnect VPN client connected", and then use the "Download" option on each page, and then join all the downloads together.     ... View more

in Cisco ISE, session reauthentication means that the user will need to enter their login credentials again, right? I did that, but it connects again without asking for a username or password ... View more

Depending on traffic types flows will be kept on the WAN it was initiated on. Load balancing doesn't implicitly mean all traffic will always be spread across both WAN ports.   This is mentioned in the following doc https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences  ... View more

You want to use the "Optimal Gateway Selection" feature in AnyConnect.  It causes it to connect to the fastest (which usually means closest) responding VPN head end. https://community.cisco.com/t5/security-knowledge-base/anyconnect-optimal-gateway-selection-operation/ta-p/3124296   ... View more

I agree with @KarstenI , 802.1x is the way to go.   If your company is relatively small, you can use local Meraki accounts.  This is super easy to deploy. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring__WPA2-Enterprise_with_Meraki_Authentication   Another option, not as good, but still easy is to use iPSK.  Give each individual user their own PSK.  No more PSK sharing. https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_without_RADIUS   ... View more

Agreed with @PhilipDAth , don't run web servers behind Meraki MX's with open ports and no other protection. Either place them behind an NGFW or dedicated appliance with WAF capabilities, or utilize a cloud service such as Cloudflare to filter inbound traffic. ... View more

Screenshot from MX   When i run the Wireshark on windows server i don't see any communication with 2044 port going to meraki however meraki is sending the net flow traffic if you see the above image   ip.addr == 10.100.xx.xx && udp.port == 2055 ... View more

For a lot of SMBs, I usually rely purely on contenting filtering and IPS and allow all traffic. For large companies I might only alow HTTP and HTTPS from everything internal, and then only named hosts (such as AD controllers) being allowed to send DNS queries.  I have some customers that are only allowed to access specific named web sites and nothing else. For manufacturing companies, there might be entire networks with zero access to the Internet.   You'll have to give consideration to your security posture and risk, and then decide what is apropriate. ... View more

I recommend Cloudlare as a WAF for its ease of use, security and cost effectiveness. Whether you go with Cloudflare or another SaaS-based WAF, you would setup your MX to only allow HTTPS ingress from the vendors IP ranges. Another option that might work in some cases, in conjunction with or in place of VPN-solutions, is to allowlist IP ranges from remote sites with static IPs on the MX. In this case, the traffic is still flowing directly over the internet but the data is encrypted and it can only originate from specific locations. ... View more

The logs that MX provides are very limited, the best no-cost option is to send the logs to a Syslog server.   https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API     ... View more

Hmm, what else has an IP on this VLAN? Do a packet capture on the ISP port and look for ARP packets. ... View more

Generally speaking: At least a /29 from each ISP. ... View more

Have you checked the documentation?   The MX can be configured to use both of its uplinks for load balancing. When load balancing is enabled under Security & SD-WAN > Configure > SD-WAN & Traffic shaping, traffic flows will be distributed between the two uplinks. The load distribution is based on the WAN 1 and WAN 2 throughput configured under Uplink configuration, such that the uplink with more throughput will distribute more flows.   In the example below, WAN 1 is configured to pass 50Mb/s, and WAN 2 is configured to pass 10Mb/s. Since the download speed ratio is 5/1, for every five flows sent over WAN 1, a single flow will be sent over WAN 2:   https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences   I suggest you to read the documentation. ... View more

There's no way to achieve this without an MDM solution (Eg Meraki SM, Microsoft Intune, etc.) or an enterprise domain management solution, such as group policy for windows machines. ... View more

Team,  I think There is a bandaid fix that I can apply to maybe boost performance on those access points. If we increase the minimum bitrate on those access points it should allow for those device to be able to accommodate more throughput ... View more

Go to the Switches/Switch ports view, click on all the ports you want to change and change them to access mode and a different VLAN as below:     ... View more