Kinda stumped on this one and hoping someone can point out something obvious I'm missing. I've inherited a network setup and am relatively new to configuring Meraki devices.   The network: We have 13 physical locations connected by a layer 2 EPL circuit, with our HQ office acting as the hub and primary WAN uplink location, as well as the physical location of our in-house application servers and domain controllers. DCs are handling DHCP and DNS. Each location has an MX device performing routing, all connected by Auto-VPN. (Firewall is not handled by the MXs, we have a separate one that's partnered with a vendor that they control performing the external network security, so all of this is inside the security perimeter.) Each MX is connected to a MS120 switch (except the HQ, which has a 250), and each switch is supporting at least one MR AP. HQ is set as a VPN hub and each site is set as a spoke. HQ is set in passthrough deployment, the spoke sites are all set as routed.    Test site specifics: MX68, MS120, MR36. WAN is connected to MX which then connects to the MS. MR and all other devices are plugged into the MS, nothing else connects directly to the MX.   The problem: I'm attempting to create a new SSID VLAN for each site. I've created the VLAN on the MX at my test location and set it with VLAN tagging to the new SSID. The AP's port on the MS switch is set to Trunk, default to native VLAN, and is set to allow all VLANs while I'm testing. DHCP for the VLAN is being relayed to our DC, and it is successfully passing those requests, along with DNS. However, when I connect to the SSID, it gives me no internet connection. The AP cannot ping the connected device, and when I run a traceroute from the connected device to 8.8.8.8, it fails at the first hop (timeout) or gives me Error 1232. The MX itself is able to ping the connected device. So it seems like the traffic isn't getting routed correctly either at the MS or the MR, but I can't find any appropriate settings for this. I was of the understanding that both of those devices should just be passing the info back to the MX, as neither of them can perform real layer 3 routing? Is there something else I should be looking at?   Additional: only this new VLAN isn't working. All of our default traffic and other VLANs are working fine, so it's not any issue inherent to the network. I haven't found any settings where the new VLAN is significantly different from the operating ones, so I have a feeling this is more along the lines of me neglecting to create some kind of static route or similar setting. ... View more

Hey all, I'm hoping for some advice on how to handle getting bridged mode DHCP setup for a specific SSID. This will require some context:   A new requirement has just come from our security vendor to enable deep packet inspection on our external firewall. Any device that isn't reporting for the DPI by having their security certificate installed will be blocked from external internet traffic. This isn't a problem for our company devices, but we maintain a guest Wi-Fi at all locations for our customers and non-company devices of our employees. For this to keep working, I'll need to have an exception for the guest Wi-Fi's subnet made to the DPI policy. Up until this point, we've been using the Meraki AP assigned (NAT mode) function for DHCP for this SSID, but we cannot allow-list the whole 10.0.0.0/8. So I'm looking to switch this to bridged mode, create a VLAN for the guest SSID, and have our DHCP server handle it.  Here's where I'm starting to run into issues: I've started working at my company within the last year and inherited an existing setup. We've got a mid-teens number of different business offices, each one has MR APs that are connected to MS switches & MX security devices. All locations are connected by a layer 2 EPL circuit that points back to our HQ office.  On the Meraki dashboard, each geographic location is listed as its own network. However, instead of the MRs being assigned to those networks, they've all been added to a single "Wireless" network so the SSIDs could all be managed together. (The MS switches they're plugged into are all assigned to the geographic location networks.) After adjusting the DHCP server and creating/assigning the VLAN, the only APs that worked correctly were those at the HQ office - same location as the DHCP server. All other sites weren't able to reach it. I tried switching to Tunneled mode and using a wireless concentrator at the HQ office to the same effect. Connectivity test with that said the other APs couldn't reach the appliance at HQ. I confirmed they are able to ping it, at least.    Ultimately, I know I could break this wireless network up and put the APs back onto each geographical network, then create a VLAN and subnet for each site for this guest traffic. I'd prefer not to have to do that if possible. Does anyone have any thoughts on how I could use a single VLAN for this, passing the requests back to our HQ site? And if it is the tunneled concentrator option, anything I might be overlooking in the setup that's causing it to fail? ... View more