We use Sophos XGs for our enterprise edge and client VPN, it has an SSL version based on openVPN and an IPSEC version.  There are a couple of dedicated clients (one SSL only, the other for both) and it supports a mix of full tunnel and split tunnel with multiple profiles, 2FA and pretty much any OS including IOS devices, Raspberry PIs and many more.  However their SD-WAN solution isn't a patch on Meraki's! ... View more

So ... I'll just mark my own answer as the solution ... *DOH* ... View more

Ok -.... here's a hint to our problem - Content filtering - When the MX cant reach Brightcloud services (that is not described as required on the "firewall info" page).   I'll just leave this here, and then people can PM me if they want to know what I think about this, the strange way the MX apparently handle this, what you can see in the event log (on any log for that matter) *hint:Its nothing*, and what I think of Merakis support right now. ... View more

Apparently the CDP/LLDP issue with the MX250 and MX450 to them is a cosmetic issue and doesn’t have any real world impact, and won’t be worked on,  that’s just a great answer for a solution I spent a good amount of money.  Never again will I recommend a Meraki solution to a customer. ... View more

We have had a similar issue with a couple of misconfigured sites.  Turned out to be the mtu setting on the path to the site from radius.  The isp’s kit was configured to a figure below 1473. The first packet would be returned by the radius server but the remaining packets of 1500 size would fail. A quick check is a mtupath tool.  Next time it’s happening try this from either end to confirm if this could be the cause. ... View more

Finally!!!!   Absolutely amazing to have the MX100 replaced ... View more

Just to confirm:   at FCS it's definitely x2 active WAN uplinks, as other models, but you now have media flexibility.   I have requested that the datasheets be amended to bring clarity in this. ... View more

Well there is no upstream firewall. And if there was, should the Meraki dashboard then not tell me that there is something missing. Its just strange. ... View more

I think I'll just go "sniff" some packets 🙂 Then I'll know 🙂 ... View more

Found the problem (I think): Windows update : https://support.microsoft.com/en-us/topic/may-11-2021-kb5003173-os-builds-19041-985-19042-985-and-19043-985-2824ace2-eabe-4c3c-8a49-06e249f52527   Under "known issues":  "System and user certificates might be lost when updating a device from Windows 10, version 1809 or later to a later version of Windows 10."   That's most like the issue.   ... View more

But most customer would rather like it just to be there in the UI. I mean, all the data is there in the dashboard, its just an UI change. I really wish they would fix that (yes I call it a fix, because the current solution with only 30 lines is not good).   ... View more

Would just like to "bump" this. Because its really annoying for some customers, who do not have API knowledge, that they cannot just download "all" , or for a given time, only the 30 lines. I mean, all the data is there, its just an UI change that should be fairly easy for Meraki to do. So its kind of crappy atm. I wish .... I guess....  ... View more

Or here is another idea. Use "Insight" to automatically select the best WAN connection for a specific service at that specific time. That would be a "flipping awesome" feature, and would sell some more "Insight" licenses Im sure 🙂 ... View more

Yeah, sorry we cant do that in this network at the moment. Because its already also running a IpSec to Azure (that works just fine 🙂 ).   And lets say that worked, what should we do then ? I dont really see a workaround 😕, but perhaps Im missing something.   I have tried some packet capture, to see if I could troubleshoot the problem , but all I see is the 6 initial packets back and forth, and then just an information packet. Then it starts over.   /Thomas ... View more

Are they consistently occurring every six hours? Maybe it’s a VRRP timer of some sort kicking in, but you’re correct, there doesn’t seem to be any uplink state changes. The easiest was to solve it is like has been said, remove the HA configuration if you’re not using it. Otherwise you could log a support case and see if they come up with anything. ... View more

he he .. I will then 🙂 ... View more

I looked at the API, and I thought that one only worked for the MX (since its called WAN1 🙂 ) If this works, then its the way to go. Thanks.   PS: I have not tried it, because there where "only" 50+ APs and I just "grinded" my way through them.   ... View more

I've had it confirmed by TAC that you have to enable a DHCP server on the vlan, not just able to get it to act as a DHCP/BOOTP relay. So we can; a) Act as an ip helper / dhcp-relay and NOT a BOOTP forwarder, or b) Act as a DHCP server (i.e. not a dhcp relay), and act as a BOOTP forwarder   Seems a bit contradictory; a) Forward DHCP multicasts as unicasts, and DO NOT Forward BOOTP multicasts as unicasts; or b) Forward BOOTP multicasts as unicasts, and DO NOT Forward DHCP multicasts as unicasts ... View more

27.4 is now a stable release candidate! Well deserved IMO, the 27.3 and 27.4 releases have both been rock solid. Really a no brainer for WiFi 6 APs but even on my MR53 the performance has been more consistent.  ... View more

I would like to add some additional information to this:   When support initiates a change to your registry contact points, a migration period will occur, within which changes to your registry contact points cannot be performed. Any additional changes to these will require an additional waiting period while the migration finishes.   An additional port of 9351 has been added, which you will see is also listed under Help>Firewall Info>VPN registry. Upon issuing a registry IP change from our side, you will see the addresses on this page update automatically, so be sure to check this page after any registry IP change is made from the Meraki Support side, and update your upstream firewall/device rules with the new information accordingly. ... View more

@pjc26.x will continue to get security and functional fixes, just not new major features.  Hence the support up to 26.99 when we are only on 26.8.1 at the moment.  I think that if you configure a network that has a mix of devices with 27.x then the newer devices will get 27.x and the older ones will get the latest 26.x.  Obviously you cannot use new functional features that rely on 27.x.   We have been doing a bit of rationalising and have been replacing the 802.11ac Wave 1 APs at sites with only a few with Wave 2 APs from sites where most are Wave 1, thereby allowing us to use the new features in the now all Wave 2 sites if required. ... View more

Also available without radius: https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_Without_RADIUS   ... View more

Yep, that is also the only time I use products from Ubiquity. AirMax or AirFiber is the way to go.   Just watch that fresnel zone (the higher frequency of your link, the smaller the zone. Do some calculations, and watch that landscape for obstructions 🙂 ).   And please check your local regulations for allowed frequencies and transmit power, they are different around the worldm and from country to country.   ... View more

>I should select /28 in one template and /29 in another ? from the same lets say /20 pool ?   I don't think it will allow this.  It will see one pool has already been allocated so the second attempt to use the overlapping pool will fail.   If you really need two pools with overlapping address space you have to raise a case with support and get them to disable the address space checking - and then you have to make sure you only assign unique subnets ... View more