Hi,   We recently decommissioned our MX64 and upgraded to a MX75, running firmware 19.1.11. The new MX75 runs the Advanced Security license, i have verified this through Organization > License info. I have enabled AMP in Security & SD-WAN > Threat Protection and also enabled Intrusion detection and prevention > Mode: detection, Ruleset: Balanced. Further more I made sure that Network-wide > Configure > General > Traffic analysis > is set to Detailed: collect destination hostnames.   Whenever I download the malware testfile at https://www.eicar.org/download-anti-malware-testfile/ AMP doesn't block it and nothing is logged in Security & SD-WAN > Security center. Doesn't matter if I download the .txt, .com or .zip file. Note that the download is successful (i actually have the file on disk) and local AV is temporarily disabled. Also, whenever I perform a successful Nmap portscan to a working IP address in another VLAN, nothing is logged in Security & SD-WAN > Security center.    Last, we don't have any other gateway or WAN link, so everything is running through MX75.   Anyone any idea why AMP doesn't block EICAR, why the portscans don't get logged in Security & SD-WAN > Security center and why nothing in general is logged in Security & SD-WAN > Security center? Security center screenshot: https://imgur.com/01lWCN1 ... View more

(fixed, see edit) We currently use Meraki MX64 client VPN in combination with a local Windows NPS server (radius) so that users can authenticate with their Windows credentials. This works fine but I want to protect the connections with MFA, so I installed the 'NPS Extension for Azure MFA' on the NPS server. Unfortunately I cannot get that to work in combination with our client-VPN. When having it enabled, users cannot establish a VPN connection anymore. They are able to enter their user/pass when the Windows VPN client asks for it but after that it just times out without the user being prompted for MFA: The NPS server logs the following on these connection attempts: "NPS Extension for Azure MFA: NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User testuser1@exampledomain.com with response state Discard, ignoring request." "NPS Extension for Azure MFA: NPS AuthN extension bypassed for User testuser1@exampledomain.com with response state Discard" I have ran the Azure MFA NPS health check script and that shows no issues. The testuser also has a valid Entra ID P1 subscription. Further more, the users are able to use MFA on Microsoft services. The settings I'm using on the NPS server are the working settings that were already in place for the non-MFA client-VPN as described in this article: https://documentation.meraki.com/MX/Client_VPN/Configuring_RADIUS_Authentication_with_Client_VPN_IPsec I also have set the radius timeout in the Meraki dashboard to 180 but that doesn't make a difference. I'm having the feeling that it might just be a simple setting in my NPS server that can fix the problems. Can anyone that also uses that NPS Extension for Azure MFA on their NPS server share their settings? Or does anyone have any advice on how I could possibly fix my issues? note: I know Anyconnect can do MFA flawlessly with SAML but Anyconnect is not an option for us. Thanks in advance EDIT: Nvm, i fixed it. Turns out I erroneously swapped around two registry key values earlier when I was troubleshooting the early stages 😑 Hitting myself with a hammer in the head. Btw, now that it's working, I can confirm that using the starter radius settings from the Meraki article from above, are enough to get it working in combination with the extra NPS extension (this is something I was wondering about a lot during my earlier troubleshooting). ... View more

We have a MX64 configured with L2TP client VPN.   In MX64 > Network-wide > Eventlog > VPN client connected, you can see when a VPN client connected to the MX64. Amongst other things, you'll see a MAC address in the column "Client". All these addresses start with "03:" in my MX64. What MAC address is this? It's not the MAC address of the remote client computer and also not of the remote client's computer router/modem. My best guess is that it might belong to the remote client's VPN adapter/WAN miniport but I'm not really sure. I couldn't retrieve the MAC address of the VPN adapter/WAN miniport by trying standard methods on the remote client PC (ipconfig /all, powershell, wmi).   I'm kinda disappointed the eventlog doesn't appear to show the remote client's MAC address and thus making identification of physical remote devices impossible, unless I am overlooking something? Does anyone know what these MAC addresses are? ... View more