We have a MX64 configured with L2TP client VPN.   In MX64 > Network-wide > Eventlog > VPN client connected, you can see when a VPN client connected to the MX64. Amongst other things, you'll see a MAC address in the column "Client". All these addresses start with "03:" in my MX64. What MAC address is this? It's not the MAC address of the remote client computer and also not of the remote client's computer router/modem. My best guess is that it might belong to the remote client's VPN adapter/WAN miniport but I'm not really sure. I couldn't retrieve the MAC address of the VPN adapter/WAN miniport by trying standard methods on the remote client PC (ipconfig /all, powershell, wmi).   I'm kinda disappointed the eventlog doesn't appear to show the remote client's MAC address and thus making identification of physical remote devices impossible, unless I am overlooking something? Does anyone know what these MAC addresses are? ... View more

Hardware: MX64   I'm working on a project to restrict access with help of a splash page and I'm still in the testing phase. Therefor I have configured a splash page on a specific VLAN in: Security & SD-WAN > Access control > Sign-on with my RADIUS server and this seems to work so far but I need to take it further and for testing purposes I need to undo access given to a account/IP address that signed in through the splash page. How do I this? I've tried disabling/re-enabling the splash page for that VLAN but that doesn't make a difference because when I access that particular VLAN now, I'm always granted access now because I successfully signed in earlier.   edit: According to the official documentation, revocation should be available on Network-wide > Monitor > Clients but my setup is a bit different than most of the documentation I read. I'm requesting a web page from a PC on the internet from a web server residing on the local lan of the MX64 through port forwarding with a reverse proxy in between. The route is followed: PC on internet > MX64 port forward to > reverse proxy with splash page on its vlan > web server with its own vlan.   Since the PC is not on the local MX64 LAN and thus not on the client list, I'm unable to revoke and I was wondering if the PC not being on the local posed a problem, but I later found out the proxy is the splash page client and not the PC. However, the revoke button wasn't there on the Meraki client page of the proxy (see screenshot). I've called support and they said that they've seen this before and it's a known issue. Support asked me to disable VLANS temporarily to see if the revoke button still not shows. If that's the case, than they'll escalate it to the dev. team. I now need to find a good moment to disable VLANS (obviously not during production hours). ... View more

In this article: https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site_to_Site_VPN_tunnels_to_Azure_VPN_Gateway  you see Meraki choosing a IPsec policy preset called 'Azure'. This policy does a Phase 2 Lifetime of 3600.   In this article: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices at 'IKE Phase 2 (Quick Mode) parameters' you see Azure doing a RouteBased Phase 2 Lifetime of 27000. IPsec policy's are not editable in Azure.   Either the Meraki article or the IPsec template which you select in the Meraki device is incorrect (Phase 2 Lifetime should be 27000 on Meraki's side instead of 3600).   Note: Azure does not support PolicyBased in combination with Meraki so PolicyBased settings are not applicable (see 'Validated VPN devices and device configuration guides' in the Azure article). ... View more

Hi,   Implementing Meraki client VPN atm and all is working fine. Currently in the end stage where I need to deploy the VPN config to the end user laptops running Windows 10. I've tried a few methods but all have their downsides: - GPO-Network option: not able to deploy IPsec pre shared key or configure split tunnel options. - CMAK: Even though UserNameSuffix=domain.tld and UserName=%username% are set in config files, the vpn client doesn't use domain credentials by default and user is required to enter them as opposed to GPO-Network option where the connection automatically uses the domain credentials of a logged in user. Also the client wants to dial in through PTSN by default even though Dialup=1, Direct=1, ConnectionType=1 is set in the config files (can be manually fixed to force permanent connection though). - GPO-Powershell: unable to deploy with required Meraki settings as the script produces the following error: "The current encryption selection requires EAP or MS-CHAPv2 logon security methods." Script: Add-VpnConnection -Name "VPN" -ServerAddress "xxx.xxx.xxx.xxx" -TunnelType "L2tp" -EncryptionLevel "Required" -AuthenticationMethod Pap -UseWinlogonCredential -SplitTunneling -AllUserConnection -RememberCredential -PassThru Ofcourse, I'm able to manually tweak some settings on the user end to make it work but I would to like do it automated since we have a lot of laptops. Anyone else found a better approach? ... View more