Still testing?  what's happening with this version? ... View more

Take a look at this access manager + cloud pki guide   https://www.hypershift.com/blog/meraki-intune-cloud-pki ... View more

Has anyone attempted to use this for multiple SSID's? There doesn't seem to be a way to scope users/groups to different SSID's with this method. ... View more

Ah, so that explains the odd behaviors I've been seeing on my Apple devices at home in my lab. ... View more

I dont look at wireless captures that often, it bascially only happens every 2 to 3 years that there is a client (or AP) that behaves so strangely that we need captures. ... View more

Woohoo !    https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Roaming_Technologies   Mandatory DHCP + Fast roaming (802.11r) This feature enhances client mobility by enabling support for Fast Roaming on SSIDs where Mandatory DHCP is enforced. Starting with firmware version MR 32.1.X, DHCP state information is now shared across APs, allowing seamless client transitions between APs without reinitiating DHCP requests. Prior to MR32, client roaming to a new AP was required to send new DHCP request before traffic would be allowed. Even if the client had successfully obtained a DHCP lease from the previous AP, the new AP would block traffic until it saw another DHCP exchange.     RFC compliant ! ... View more

Do you have any meraki support case open? typically, client likes to join 6GHz, if 6GHz broadcast higher connection speed. (e.g enable 80MHz or 160MHz Channel width) even when 6GHz RSSI is much lower. than 5GHz. one idea is reduce the Channel width of 6GHz, matching with 5GHz.  and you can apply higher TPC range (min-Max), so you can make sure 6GHz has similar SNR as 5GHz ... View more

Wouldn't hold out much hope, if your solution depends on having this feature then you need to look elsewhere. ... View more

Keep an eye out for VMX-XL ... you might be able to get your Meraki rep to give you a discount for the unused portion of your licence against these larger appliances coming out.  My guess, pure speculation, I think it might support around 5,000 client VPN users.  Most of its limits are about 10x more. You can get a feel for the XL here: https://documentation.meraki.com/MX/MX_Sizing_Information/MX_Sizing_Principles#vMX-Series_2     Tricky question about the SAML.  Basically this is how it works: User connects to MX.  MX redirects it to Entra with some session specific information. Entra ID sends the use a redirect back to the MX with session specific information. If you can guarantee the user will end up talking to the same MX both times during this flow, then you should be able to use a single app definition in Entra ID.  Note that this will also require you to buy 4 x SSL certificates (one for each MX).   A safe option would be to use the dynamic DNS name, add four apps in Entra ID, and configure "Optimal Gateway Selection" in the AnyConnect client, and let AnyConnect use whatever VPN is responding the fastest. https://community.cisco.com/t5/security-knowledge-base/anyconnect-optimal-gateway-selection-operation/ta-p/3124296   If it was me - I think I would prefer the safety of OGS. ... View more

Yes that is right. Since Meraki MX do not have a MGMT vlan / interface / vrf they rely on the now Highest Vlan ID to source all sort of trafic ( Syslog , RADIUS and more ). We also had to design our network with these specific requirements. ... View more

The IdP in Merak is currently limited in functionality. It is primarily intended for basic testing and demonstration. A disabled status typically means that authentication is not fully enabled or supported for that user in production scenarios. According to the documentation, there is no supported way to fully enable the IdP for use in production policies. If you want to avoid configuring Azure AD or Entra ID for testing, you can simulate some flows using username/password authentication, but this often leads to issues with MFA requirements or conditional access policies on the IdP side. For realistic testing or demonstration environments, Cisco recommends integrating with a suitable IdP, such as Azure AD, Okta, or Google Workspace.   Access Manager Configuration Guides - Cisco Meraki Documentation     ... View more

This is the problem, Meraki always was easy to deploy, reliable and often missing some features that you might want, but could get away without.  The move to being more fully featured is great, but it seems to have been at the expense of reliability and in the case of the Catalyst switches, ease of set up.   I remember with MS stacks it never really mattered if you powered them all up first, connected them first, stacked them physically or on the dashboard first, they usually just sorted themselves out.   Hopefully now that a lot of features have been added, the reliability and ease of use can be focused on again. ... View more

What I normally do for all 3rd. party VPN (because so many "features" are missing on the MX for this), is use another firewall, like a good old ASA, for the 3rd party VPN. Then I create a small route net between the HUB MX and the ASA and create a static route on the HUB MX for the VPN networks. The static route can be distributed into AutoVPN.   Of course, now it might now also be possible with the new MX19 software and eBGP over IPSEC. ... View more

When we downgraded back then, we downgraded back to 18.211.2.  Unfortunately, we're having huge issues with the 18.xxx firmware branch in regard to random reboots.  We're still working with support on the issues.  At the moment we've had to go all the way back to 15.xxx in order to gain stability.  We'll be upgrading to 18.211.5.2 soon to see if that has fixed anything. ... View more

Very useful, thanks a lot, solved same issue in minutes thanks to this post. regards. :))) ... View more

And he was never heard from again...... 😢 ... View more

That's what you should see.  If you have another non 6e/7 Asp in the same network the WPA3 client should connect to the 5GHz on that AP and when roaming should step up to 6GHz.  I've got this reliably working with CW9163E/CW9166I APs.  Before you say the 9163 is a 6GHz AP, it isn't in the UK, or pretty much any of the world other than the US... ... View more

So basically the cure was worse then the disease 🙂   ... View more

The switch was apparently not happy with my IPv6 config. "Router FE80::AA46:9DFF:FEB6:2137 on Vlan10 conflicting ND setting prefix somethinsomething::/64 valid lifetime, difference 2586600 seconds" I have no idea what this means 🙂 ... View more

We upgraded from 26.8.3 to 31.1.5 2 weeks ago and have been having issues ever since. Were you guys able to determine what the root problem is? ... View more

Regardless of the answer, have anyone ever done it using a couple of fx. Multimode 40g qsfp optics ? ... View more

I know, unfair to accept your own post as the solution. But until I know more, this was the easiest way to show others my experience. ... View more

I know this is an older thread, but I have a similar issue.  I have a sonitrol panel as well with a new Meraki 75 firewall.  I put in the port forwarding rule above.  However, I still have some issue as the Sonitrol panel does not connect outbound to the Sonitrol central site (I cannot arm the panel inside the business and disarms do not show up on the Sonitrol history).  I have a Polycom ATA between the Sonitrol alarm system and the Meraki - it gives the Sonitrol a telephone line since I can't get a POTS line anymore. I am wondering if I need anything else configured in the Meraki.  Also, wondering if any of you also use an ATA device connected to the Sonitrol.  If so, is yours different brand that I might try. ... View more

@Chris_Skees - Do you think we should add the 9172s to this document?   https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_Unified_Licensing_Wi-Fi_7_APs     ... View more

About time. 😉 ... View more