Hooray! We have some new Visio shapes! These were a side project of a Meraki employee, @DrDray - so they're not in the official Visio .zip file on cisco.com but.... take a look! https://community.meraki.com/t5/Dashboard-Administration/Meraki-SVGs-Visio-LucidChart-Stencils/m-p/215661 ... View more

Hi all,    If I understand well, If I configure i.e. a Meraki MS Switch for the first time connecting it to the Cloud but I power off the Switch before of 30mins, all the configurations done are lost on the device. So when the devices is powered on again, it will start with the default configuration  (it means all port in Trunk Native VLAN 1) ?    The question is because I've staged a stack of switches but when I stared installing it to my customer that switches was without any configuration. This colud be a problem if the switches are installed as Edge Devices with Internet devices (Internet Router/Firewall)  connecting to an Access Port with a specific VLAN (not vlan 1)   Thanks   Francesco ... View more

Hi @whistleblower, here’s my take on your questions based on experience. Happy for others to advise if they’ve had different outcomes.   1. Yes, local configuration overrides network-wide configuration, but I’ve never seen a warning message if the two don’t match. I’ve only seen warning messages if there is a communication issue with the Meraki cloud.   2. There is no automatic tagging for the management VLAN across the network. You have to get the traffic to/from the switch. Based on this I always find it easiest to have the management VLAN set as the native on all trunks that are uplinks.   3. Imagine the management address as an access port on the switch. It doesn’t care which VLAN it is, only if there in a path to a DHCP server on that VLAN. Since it’s an ‘access port’ it’s always untagged, whether it’s tagged or not on another port depends on that port’s configuration.   4. The definition of a safe configuration is a few paragraphs further up in that document, “Safe configuration means that ‘the device has connectivity to cloud and hasn't rebooted for 30 minutes following a configuration change.’ That is, the safe configuration is the last configuration the device received from the cloud that was not followed by a reboot within 30 minutes.” A ‘not safe configuration’ is just the reverse - I.e. one where no connectivity to the cloud has been achieved. ... View more

Thanks for the input. See, the problem with Cisco ISE is, it provides a host and wealth of other features we simply don't need. We're not going to Cisco ISE because it does "too much" and requires too much effort to set up to solve one simple problem. It would be cheaper and far simpler to use Meraki MDM with Sentry rules, but, the MDM won't co-exist with our approved MDM, unfortunately. Plus, the Meraki MDM price doesn't compete with our chosen options. ... View more

If you have geo-separation based networks in your organization only way is Layer 3 concentrator. But there are very well known bugs which causes packet drops in this mode. Rather I would recommend bring all of your AP's to one single network under your organization, and use Bridge mode. Only in cases where there is a coverage hole when roaming client will have to go through the whole auth process again, otherwise it will be a seamless roam.  ... View more

I would use Meraki MR74 with patch antennas. You have to make sure that you have line of sight and RF profiles are properly surveyed and configured to exclude DFS networks, use the best channels preferably in 5GHz etc. ... View more

It is possible that Air Marshall is showing historical data, you can verify it by simply peeking in to the Last seen column under Air Marshall ==> Rogue SSIDs.   FYI. It is expected behavior that meraki setup SSID to be flagged as Rogue SSID as it is not advertised ny an AP which belongs to ur Network or organization. Meraki Setup SSID is advertised by APs which are not added to any network.  ... View more

You can add MAC addresses by going to Network-wide ==> Clients ==> Add Client, you can also choose a group policy if you required to have custom firewall rules, shaping etc.    However MAC address based restrictions are not the best thing to do as this can be easily spoofed. I would highly recommend looking in to deploying 802.1X with EAP-TLS or using Meraki MDM to manage and restrict the devices which will be using the SSID's. ... View more

@ArshadSafrullaI was actually quite happy with 500Mb/s but I did try as you suggested.  The result was a throughput of about 420Mb/s so I re-enabled the rules and got just over 480Mb/s. ... View more

I don't think there is anything to configure.  The RADIUS requests will just get sent from the MX to your RADIUS server (instead of from the APs). ... View more

I agree handsets are best on an access port, but they can work in a trunk too. I was referring to the cisco router part of the phone server solution providing DHCP that was trunked. I don't know why it was setup as trunk as it only requires a single vlan, done before my time. ... View more

@ArshadSafrulla wrote: It will just show up in the inventory. Nothing much can be done. For now... I wonder what it will be like in a couple of years. ... View more

Set the native vlan on Meraki side trunk to the VLAN you want the IP from. ... View more