that’s weired 😞 probably you know, why than the MR Firewall Configuration blocking the client from getting IP-settings from the MX via DHCP and from accessing the network as well? ... View more

what`s the difference between "Normal" vs. "Whitelist"? Unfortunatyl I can`t find a useful documentation... ... View more

@PhilipDAth ... regarding the ‘shared buffer‘ - do you maybe have some official documentations that you can share? I noticed that other technicians mean that there are port-buffer used!   ... View more

ok, now I understand what you mean 😎 just comparing the informations on the switches vice-versa... not the thoughts I had but of course that could work for me! 😜 ... View more

hi @PhilipDAth    yes, the plan was to buy the license to use the Adaptive Policy!   BTW - I‘ve attended the meraki PVT in the last week and the SE‘s advised that currently the way to go in using Adaptive Policy will be to work with C9K in the core! the questions - if the classic MS Series will also be adopted to use the same future proofed features like the MS390 offer today... where’nt answered very clearly to me 😕   In my case now, if the customer will decide to use micro-segmentation, I‘ll change all over to Cisco C9K switches for core/distribution and access layer! If not, than I probably choose the MS355 as the access switches because of the better stability... ... View more

hi all,   @Bruce just for my understanding I’d like to ask another question about that design approach in more detail... Let‘s assume that I use instead of the static routing a dynamic routing protocol like OSPF!     please correct me if I’m wrong - but I think that in that case OSPF won’t use ECMP because it’s only a /30 Network and the two physical links will of course not be noticed in the Routing-table on each side! But because of the use of LACP Bundling on Layer2 some sort of load-balancing will happen... here‘s now the question - will the LACP Load-Balancing Algoritm be used in that case the same way as if I use a classic traffic flow inside a Vlan located on both sides over a Layer2 Etherchannel? ... View more

hm, what can this information be used for? looking directly under the port information I only get the information what cable and QSFP is in use but no information identifying the neighbor port?!  ... View more

that’s what I‘ve tried as well, also with an explicit firewall rule - the same issue! 🙂   ... View more

thanks  @Bruce @GIdenJoe    @Bruce wrote: I’m still in two minds about the MS390. From a futures perspective, yes it will be the best switch. Should you deploy it now? Hmmmmm... if you just want switches doing nothing too special in small stacks (three or less), and you’re happy for the odd hiccup and to run the MS14 ‘beta’ code then I reckon they’re probably deployable. ...and that`s the point, for now the switches will be used for wired-access /w 802.1x and to connect APs maybe via mGig... for this to achive the 355 Series would be fine! But when it comes for future use and one point out of that would be in my opinion Adpative Policy/SGT than I`d have to go with the MS390...   The thing is... when I use the MS425 in the core and they won`t support the Adaptive Policy feature neither in the future as well - the design is`nt as good for future proof! So I`d to use the MS390 (/w all differences e.g. like flexible-stacking compared to the MS425...) or mix Meraki MS-Switches with Cisco Enterprise C9K devices - which I honestly would like to avoid! 😕 ... View more

hi @All do you still think the same way today? how is the experience with the MS390 series as of today? I’m also considering a MS425 flex stack in a new deployment and use the MS390‘s as physical stacks as access switches! One reason for me is that I was told that the 390 would be the best for future use - e.g. of the hardware specifications, Adaptive Policy feature etc. Maybe someone knows if SGT would also be supported on the other switch models like MS425, 350 and 250? ... View more

please allow me two more questions on this topic..   1-) @Bruce wrote: For straight 802.1x assignment of a VLAN when a user first connects to the network, CoA isn’t required.  what is the reason from technical perspective - the CoA is disabled per default in the dashboard?   2-) @Bruce wrote:  Enabling CoA configures the switch to listen for CoA messages from the RADIUS server. This allows some more advanced servers, e.g. Cisco ISE (there are other vendors too), to tell the switch to perform the authorisation of the switch port again, so allowing the VLAN to be changed after initial authentication has been performed. This is useful where the RADIUS server has separate threat feeds, or is performing ongoing posture monitoring and can detect, or be informed, of a change in the client state. maybe you know the current possibilities when using ISE in combination with Meraki MS Switches products? I´m not sure what of the features are supported compared when using the Cisco Enterprise devices e.g. device profiling, posturing, TrustSec, etc.   @Bruce wrote: There is also a new feature that you may be interested in too called Group Policy ACL, https://m.youtube.com/watch?v=nekC3_z5SDk. It’s akin to dACLs on the Cisco Catalyst. I can’t find any information on the Meraki site about it, but it was included in the MS14.5 release notes - so you’d need to run the beta code train. thanks for pointing me to that - I´ll have a look and try to understand how this can be used probably in my deployments as well 🙂 ... View more

hi @PhilipDAth,   thanks for your reply on this post! ok... but the local DHCP-Server on the MX is NO option in the project I‘m currently working on! Unfortunatly another reason more (in the meantime they‘re many...) why I’ve to think twice if the MX is really a security component to compete with other vendors on the market! 🤨     ... View more

so it isn‘t necessary to enable CoA for the dynamic vlan assignment to work, correct? if so, why does this option than exist and where/when should or could it be used? ... View more

so the tie-breaker is always the lowest device MAC-Address which determines the Stack-Master and the device-type (e.g. stacking MS225 and MS210) does‘nt matter or influence the election also? ... View more