If you have a combined network temporarily split it up. Then make a new network which is a clone of the resulted appliance network and add the new MX devices to that. In this stage all the config will already be copied with the exception that if you have a site to site autovpn, it will be disabled for this network since you would have duplicate networks. Then once the new HA pair is online, disable the old MX'es, cable up the new ones.  Once online enable your site 2 site vpn and you are ready. Do mind that your dynamic DNS name will be different.  So if you are using it for port forwarding or client VPN make sure the other sides are ready to change their config or if you use a DNS CNAME, adjust it. Once online you can now proceed and merge the networks with the new appliance network and then you are ready. ... View more

You got me there at least half.  You can apply outbound VPN firewall rules towards non-Meraki VPN peers but you cannot block incoming, so you are trusting the external network to not send unwanted traffic. ... View more

Indeed, if you can't share that same IP between multiple routers then your upstream redundancy is non existent. It is better to have two upstream circuits tied to both WAN ports since you can then actually use your SD-WAN features between the sites.  Now you're stuck with a single WAN on the second site which is then load balanced upstream. Alternatively if you would have a public subnet behind those 4 routers and have them use an FHRP like HSRP/VRRP/GLBP. You could have redundancy and no autoVPN issues. ... View more

iSCSI runs on IP. IP runs on ethernet. Meraki switches are ethernet switches, so this will work just fine. There is in fact nothing special about iSCSI switches...but for a way of the server vendors to sell their gear.  The only thing that can matter is the performance of the switch.  Which means, uplink bandwidth, oversubscription and buffer sizes.  Meraki switches are aimed and access layer and not exactly datacenter so the buffers won't be the biggest but if you make sure you design with the correct port speeds, the buffers shouldn't be an issue. ... View more

Yes put the Nexus switch into MST mode and have the MST0 instance on lower than default prio so it becomes the root bridge (unless you want the catalyst to be root bridge). Once you do this the nexus will only send BPDU's natively and not send per-VLAN BPDU's which can cause many issues. Then you can also set root guard on the ports on the rootbridge that go downstream to have a stable topology. ... View more

We know Meraki is working an a Azure native way of authenticating but this is not ready yet. At this time you can use a combination of SCEPman and RadiusaaS which is essentially a cloud based RADsec server that can be fully used with cert based authentication. ... View more

It clearly shows that the remote appliances you are trying to reach are offline. ... View more

As GreenMan already brought up: If you are using regular NAT from LAN to WAN then inbound is blocked by how NAT works. So the way you allow inbound connections is by setting the Port Forwarding rules a bit lower on that same page. You can use the regular port forwards if you want your appliance IP or virtual IP (if you have an HA pair) to be the destination of the inbound packet. You can use the 1:1 or 1:Many NAT rules if you have another IP in the SAME SUBNET as the MX appliance IP to be used as destination. ... View more

Basically you need to tell the VPN registry what public IP and port will be always pointing towards your MX for this to work.  This means the MX is not able to contact the registry itself with the IP and port combinations. In the end you need to have one UDP port configured that always goes to the MX.   ... View more

I strongly agree with your comment.  Most problems come from client issues if RF is OK. ... View more

The only compatibility you need to concern yourself with is the amount of PoE your ports can deliver. The heaviest of those AP's (9164) can work just fine on a regular PoE+ (30 Watt) port.  The only thing is that the USB port on the AP will be disabled due to power constraints.  These ports are only used for special dongles for very specialized applications. ... View more

1) Make sure you connect them correctly.  So port 1 of active goes to port 3 of switch 1 and port 2 of active goes to port 3 of switch 2.  Then port 1 of spare firewall goes to port 4 of switch 1 and port 2 of spare firewall goes to port 4 of switch 2. 2) Make sure the Sonicwall uses 802.3ad (or AX) which is LACP negotiation of the channel to bundle them.  Meraki switches will not form bundles statically.  If you are unsure, connect any one of the firewalls to 1 of the switch ports and run a dashboard capture on it and use the capture filter: ether host 01:80:C2:00:00:02 and you will definitely see messages coming from the MS switch but you should check if there are messages coming from the Sonicwall.  If not you have a static aggregate and need to reconfigure that. ... View more

The access control you are showing has nothing to do with wireless.  This is the firewall access control. If you have an MX68W then your wireless settings are on the .... wireless settings page 🙂 The page you are showing is if you are connecting to a wired port on an MX68 and you want to have a splash page before users can use the network. ... View more

the Wi-Fi 7 AP's support Ultra Wide Band radio for even better location scanning. I would check up on that instead. ... View more

For the downstream direction it suffices to use the MS Teams Voice NBAR category to set the DSCP value to EF and of course put a custom limit or ignore limit option.  If your VLAN is tagged you can also set the PCP tag to 6. However for upstream traffic treatment you will need to make sure your clients tag their traffic with DSCP EF and L2 tag to 6 to give it the correct upstream scheduling. If you use the port matching you can add this using the Add-NetQoSPolicy commandlet in windows.  The default UDP source ports are 50000-50019 for voice traffic and you can use that for matching. ... View more

The only thing I personally don't like about the combined templates is that the MX template randomizes IP subnet generation and not groups them per site but only per local VLAN. The rest is all awesome. ... View more

There is a formal template method where you can create the SSID's and basic settings at the template and then bind the template to networks.  You can even bulk create networks using a CSV file with the AP's per network.  You still have some local control per network where you can override some behavior.   But as Mloradith already said: you can create a first network too and then clone it many times too.  But then you lose the ability to bulk change without using some automation script. ... View more

I had my first issues with this, which is a bit of an install problem. So imagine this: You want to use a switch management VLAN which is different than VLAN 1. However your switch first came online with all ports in trunk native VLAN 1 and it received an IP in that this switch thinks is VLAN 1, however the trunk leading to the upstream devices has the switch management VLAN as native (think the MX downlink).   So to fix this you want to change the uplink ports so it takes VLAN 2001 in my case as native VLAN and then apply a fixed IP address inside that range.   Now here comes the problem: The switch will deny the config since it now has to apply the IP from VLAN 2001 which is in the same subnet like the switch now has DHCP in VLAN 1.  This will cause the netconf call to fail and leave an error xml file on the flash of the switch. RPC Error occured during SET: /flash/meraki/config_updater/monitor/dwnld_running.config Info: <?xml version="1.0" encoding="UTF-8"?><error-info xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0"><severity xmlns="http://cisco.com/yang/cisco-ia">error_cli</severity> <detail xmlns="http://cisco.com/yang/cisco-ia"> <bad-cli> <bad-command> ip address 10.10.1.11 255.255.255.0</bad-command> <error-location>36</error-location> <parser-response>&#13; % 10.10.1.0 overlaps with Vlan1</parser-response> <parser-context> description Uplink_VLAN mac-address 0018.0a4f.0001 no shutdown ip access-group l3-v4-acl in ip address 10.10.1.11 255.255.255.0</parser-context> </bad-cli> </detail> So the switch gets stuck in the VLAN 1 config and does not allow any other configs for some reason.   I was able to console into the switch and manually remove VLAN 1 IP address and apply fixed to VLAN 2001.  The switch then came back online with the correct VLAN and now I can no longer access the CLI via console cable.  There are still some other issues like no longer being able to console from dashboard (internal error).  So it would seem we are having a bit of an issue with the configs. ... View more

Both ports must be negotiated at the same speed. You can't mix 1 and 10 Gig inside a port-channel. Since you have MS225, why not use 2 10 Gbps links? If the MS225 is in the same rack as one of the MS425's you are better off using a twinax cable to cut costs instead of trying your luck with copper ports. ... View more

You can also easily capture the traffic on port 1812 on the AP port to see how long the packets take for their roundtrip between the AP and NPS server.  If the server packets just don't come, then probably you have an issue in NPS.  (misconfigured radius client?) ... View more

On a classic MS switch you can choose any other port on the same switch as destination port (except stacking ports of course). On Catalyst based switch at the very least you will be able to send captures to different switches too. ... View more

Correct. For the moment only those two features you mentioned are dependent on the advanced tier. In the future I believe major features like VRF, and fabric technologies will most probably be part of the advanced tier. ... View more