We're getting this behavior now with an MX450 on 18.107.8.  Anyone else experiencing this now? ... View more

Good catch! Networks that were using an incorrect tracking method resulted in security features failing to identify clients correctly on the newer firmware levels. Depending on if you use any layer 3 devices downstream of the MX, we recommend different tracking methods as outlined in the documentation Here. ... View more

HI,   Meraki Tec suggestion was  using Unique Identifier ... View more

HTTPS Issue has ben solved on L3 Switch and MX -firmware issu on 17 x Ver or higher   We are using MX105 and MS 250.   had issue with firmware upgrade when upgrade from 16 x to 17 x or higher ver.   problem was HTTPS traffic got slow even with good bandwidth .   Please use Unique Client Identifier instead MAC addres as shown on screen shot.   you can find it in Security & SD-WAN --> Addressing&VLANs           ... View more

There no "override" for Geo IP blocking, so strictly speaking you can't ... View more

Older wireless adapter drivers, particularly Intel ones don't properly see WiFi6 APs.  Anything newer than 2017 is usually okay.  What adapter is in the laptop and what date is the driver from? ... View more

It is brand new network i made it with L3 switches. before was like All L2 switches going to DC  via 1 Gb fibre and connected to another L2 and then via That L2 in DC connected to same MX, but we have no issue at that time. then we changed it to 10 Gb connectin between 2x L3 switches in dc and campus and problem comes up, as i mentioned for now after change the DNS and also some more work on Client PC seems ok but still some users having issue somtimes. first page loading so slow or sometimes get error loading page. internet bandwidth is about 200Mb/s- but we are using this bandwidth for MX's auto VPN of other branches come to this MX from another site as well. ... View more

I realize that this is an old thread but thought I would update with information that would be relevant in today's environment.  I had similar issue and the solution was to enable VLAN 1 on the core switch and walk it down to the other switches.  After doing so the switch status will update to point to the Core Switch as being the Root Switch in the topology.  Here is an article that was provided to me for further reading.   Identifying Root Switch:  https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Determining_the_RSTP%2F%2F%2F%2FSTP_Root_Bridge_on_an_MS_Switch_network   Configuring STP on Meraki Switch: https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_Spanning_Tree_on_Meraki_Switches_(MS)   Advance Setting of STP on Meraki Switches: https://documentation.meraki.com/MS/Deployment_Guides/Advanced_MS_Setup_Guide#Spanning_Tree_(STP.2C_RSTP) ... View more

@NolanHerring I believe the issue is that a corporate device is configured with a particular SSID, but the user chooses another one as they think it is 'better'.  We get it all the time where we have to allow users to add SSIDs to their laptops and phones, so they can connect at home etc. and find that they have connected to incorrect ones at work (public or employee byo) and then wonder why nothing works as expected...   The only pure MR way I think you can do this is with iPSK where you have a mac address and password for each known device, forcing them to the given VLAN.  ... View more

You should block access to the Internet at the point where your network connects to the Internet.  In a Meraki world, this would normally be done on an MX.   Being a PLC network, can you just leave it as a L2 network with no layer 3 configurations?  Then it can't talk to anything else which is not on the PLC network. If you need remote access to the PLC network then using a jump host is more secure.  It has one NIC attached to the PLC VLAN, and one NIC connecting to the rest of the network. ... View more

you can see in picture all those Subnet i show them with RED line,they are  belongs to the same network and different VLAN,  next hope is not like another network. ... View more

The client registered SIP phones usually have a small outbound connection to the cloud (to listen for incoming calls) and passes keepalives outbound to keep that little connection up and running. Any calls coming in are actually "return" traffic to the SIP phone in question and is therefore "solicited" traffic. SIP trunks usually have a switch that builds what is essentially a VPN tunnel to the Cloud gateways. Phone calls coming in land on that switch and it's responsible to delegate to one of the phones connected to it. Because of this 3rd party VPN these trunks can be a little bit harder to configure and may require assignment of a public IP.   Looks like you have lucked out and have the SIP service that doesn't have any of that complex nonsense. ... View more

I let the MS's Port learn MAC from the printer, so it did not work, after I set MAC manually it is working. looks like Printer does send ARp because i can see the Printer MAC when i check the details of the port, but MS port Security Can not catch it automatically.     ... View more

Yes that looks much better to me now. ... View more

The problem is VPN, Because Meraki MX made Auto VPN, all subnet still can see each other, go to SITE TO SITE VPN and make rule there as well. ... View more

@Kavethis should be posted in the switching forum.  I haven't used ACLs on L2 switches but they are supposed to work.    Is it simply taking 20 minutes for the changes to take effect or is packet processing slow? What firmware are you running on the MS120? If you enable or disable a switch port how long does that take to actually happen, 20 minutes or much quicker? Can you add the VLAN in the rules as all the examples have the VLAN in there. ... View more

Thank you General-zod, before That I did not use space after the comma. ... View more

I'm using windows RADIUS server, both Microsoft OS and Android can join to VPN but IOS problem. ... View more

Re: Dynamic ARP Inspection on MS 120 Does not working I could not find any Dynamic ARP Inspection on MX series, It is just L3 switches capability I think. Smiley Happy ... View more

Should open a new ticket, this one is dead and buried back in 2017 lol.   That said if you change the Firewall and set the static IP you need to reboot the modem afterwards or it won't release the ISP DHCP IP it was assigned, only after the Meraki is static'd and the modem rebooted. Well that was my experience with Suddenlink ... View more