Apple devices are sending accurate information down to the IOS version.  We verified this by talking to users in person and comparing their device types to meraki dashboard.  So why can't Meraki at least make that work?  It's virtually completely non-working since many months ago, it used to work "just a little bit" and now not at all.     I literally manually block these by hand on a daily basis.   Let's not go down the path of talking about using 802.1.x auth and getting away from PSK SSID to prevent personal devices from getting onto a wireless network, we already talked about this above.  We have several reasons why we cannot change the password readily for our legacy PSK based SSID, that's why I went down this path hoping this feature would work.   Meraki should come out clean on why this doesn't work and kill this feature already.  I've opened at least 3 tickets on this over the years and it has gone nowhere.     ... View more

There are two major solutions that spring to mind.   Cisco ISE.  It's expensive.  It can do everything you ask.  You'll need a three-node cluster to get full HA.   Microsoft NPS.  It can do 80% of what you want.  It's crap at MAC bypass - so exclude that as an option.  Instead require all devices that connect to support EAP-TLS 802.1x  and use pure certificate authentication.  This will preclude you from buying certain vendor products moving forward because they wont be able to meet your security standard of requiring EAP-TLS 802.1x support.  You need to standard strong on your security policy.   If you use NPS then lean on Meraki features like "Smart Ports" to be able to auto-recognise certain devices and allow them to connect without needing 802.1x. https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/SmartPorts   ... View more

Hi   I thought the poster accepts answers and not Meraki staff 🙂  Sad that you don;t integrate with intune.. this is a major drawback for us.. not being able to apply conditional access policies based on the compliance of Meraki SM, will force us to have 2 systems.. frankly speaking.. we don;t see the value of Systems manager against intune or jamf in that scenario.. I will need to pull your partners pre sales to help here further ... View more

As per the Legacy products notice for version 18.107.11: This firmware version is only available for MX64(W), MX65(W), MX84, MX100, and vMX100 appliances. Any other devices configured to this firmware version will not upgrade. The devices we are using are not in this list.   Regards ... View more

Hi All The root cause of the issues were a conjunction of issues related to unreachable destinations from the ISP provider to the SASE provider, while all other traffic was ok, this led to the SASE clients to send tens of retries spiking the connections limits on the Firewalls and bringing everything down..    Unfortunately the MX firewalls have no mean to detect such spikes in connections, we had these highlighted on Firepower firewalls.. hopefully the MEraki team will implement such details along with much needed CPU, memory and storage usage on the devices.. ... View more

HI I would be interested to see if anyone applied anything practical..  ... View more

@nb12345 , could you DM me a link to your Dashboard or the serial number of the MX please, curious to see what's going on.   Many thanks! Giac ... View more

Yeah   We tested it now.. both will become masters simply..  ... View more

Well, at least it was Qwerty 🙂 ... View more

Update on this issue: After spending some time with Meraki support, they did indeed point out to the fact that the early access feature of the L3 inbound tules are the culprit, if no rules are configured, an explicit allow all kicks in..which you don't see in the inbound L3 rules as the default is deny, see previous post screenshot.. confusing..  ... View more

UPD: After reaching out to Meraki support, they mentionned this is a normal temporary behaviour after POST  ... View more

Thank you Meraki Community, you are Awesome! ... View more

Hi after connecting the new MX, the Core MS stack is not able to ping the mx on the 66 vlan, I suspect the issue of configuring the vlan on the MX as packets are tagged on both sides might be the culprit -- Disregard, I had to make sure the Native VLAN was correct now on the IF ... View more