Correct.. This is not recommended. You can ignore the above idea. Primary MX and secondary MX need to be configured using warmspare VIP. You may need to have /29 subnet - as we will 6 usable ip address. / 30 subnet wont work.   Below switch need to be separate not in stack to forward the VRRP packets.   If you have the Cisco FTD in active / passive scenario, you need to add two more connections. Cisco FTD Primary to Secondary MX Cisco FTD Secondary to Primary MX.  ... View more

Have a direct connection between Primary and Secondary MX for heartbeat monitor. If there is a possibility to stack the switches, that would be better design. SW can also use all the links.  Primary MX and Secondary MX can send and receive VRRP heartbeat over LAN as well.  ... View more

I think then we configure a round robin instead strict order ... Atleast one of radius server should be able to authenticate the client request. It will reduce the impact ..  ... View more

clients are unable to reach the DHCP server or DHCP server is not responding to the request. If there is no dhcp response , client will get 0.0.0.0 ip address. ... View more

Take Meraki support in the call and do a packet capture on the VPN interface to see the ingress and egress traffic to Meraki authentication. I think Meraki support also has access to backend logs to see whether the authentication is reaching the server.  ... View more

One more way to do it, create a group policy for client machine to disconnect the AnyConnect VPN during the timeframe. ... View more

You can give create a SSID Manager - one of the admin role, so they can enable and disable the SSID.  But they will get access on configuration part of SSID as well.  ... View more