For that you need to talk to a account manager or someone within Cisco Meraki. For the group policies you could also ask if you want to be included in that private beta if you have a testing network of course or an adventurous client 😉 ... View more

I hear you.  I believe alas this falls under the feature request button but doubtful this will be implemented since they are more and more going full cloud.  It also took them a few years to actually implement the Anyconnect features we have so far.  It used to be only l2tp/IPsec. According to a private beta screenshot provided by Philip there will be SAML support with group policies in the future.  And also the SASE solution has Anyconnect integration and I believe that is also fully in the SAML or Cloud idP camp without radius. ... View more

The anyconnect function on the MX is a subset of the entire suite that you can find on an ASA/FTD device.  Same is true for multiple tunnel-groups.  This is stated thusly in the documentation and should be taken into account when choosing your deployment. The OTP not being supported is rather an issue of the Microsoft NPS server which I believe you are using.   There is also a use case of having MX'es used as SD-WAN devices while having a fully featured FTD on a central location that can also serve as a client VPN target. ... View more

Support and new firmware is not the same. When a platform is end of sale at some point those devices won't receive any new major software releases with new feature.  It does however receive minor updates, patching bugs and security holes. For example the MX84 has been end of sale a while now and only recently it stopped at the MX18.1xx software train.  There are still minor updates to 18.107.10 but no major new software releases for these platforms. The issue is that original Meraki hardware doesn't have the chip capacity for what's in store for the next features and the Catalyst line of switches do. At this time I would already start looking at the refresh and feature strategy your company wants to go for and steer new purchases accordingly. The C9300-M range should at this time be (with current discounts) around the MS250 mark anyway. ... View more

The Meraki native switches do support the standard IFMIB. So you need to configure the local SNMP from switch to your NMS.  Don't use the dashboard SNMP for this.  The local switch SNMP is configured on the network wide -> general page while the organization SNMP is the dashboard SNMP. In your NMS you can then limit the sensors to the switchports of interest. I'm hoping in the future the Meraki managed Catalyst switches will be able to support model driven telemetry to have some real in depth counters 😉 ... View more

Thanks all, and let's continue in September 😉 ... View more

The best way you can operate the Meraki based survey mode is as follows. Make a NAT mode SSID in dashboard. Let the AP come online and retrieve all config. Make sure your channels are fixed in both bands. Connect to the NAT mode SSID. Then turn on survey mode. There is however a very annoying bug and that is that when you boot up the survey mode AP the first time, everything works also in 5 GHz.  But if you shut the AP down and bring it up a second time it will have lost it's configuration.  So then you need to physically fact default the AP, put it on the cloud again, connect to the NAT mode SSID again and put it in survey mode again. I never had much joy with the Meraki version of the survey mode AP.  If you ever use a catalyst based AP for surveys please leave it in DNA management mode and use survey mode from there, it's a much better experience. ... View more

I'm not sure if that voice auth checkbox means you can just have a phone on the port without authenticating.  I believe it is to signal that you have a phone possibility on the port and can have the Radius attribute sent for voice domain authorization. The documentation also says in most host modes every client needs to be authenticated including the phone. If your radius server supports MAB you could just have the MAC addresses of the phones in there to authenticate against. ... View more

Interesting read. It is to be expected that Catalysts work on a different way there will be issues albeit sometimes cosmetic with the full integration. In this case however I haven't yet investigated if this is normal behavior on a Catalyst running in native DNA mode.  Normally IGMP snooping is enabled however I never heard that the IGMP querier feature would also be enabled at the same time by default.   If I get to a customer with native Catalysts I will try to capture this. ... View more

I view it more as maximum under ideal circumstances on the datasheet. The sizing guide uses EMIX which is a better test anyway. With some tuning you can get speeds between the advanced security throughput and the full throughput if you leave out some categories of the IPS. ... View more

Have you accidentally made an SVI on the C9300X with the same IP like the management address? 10.45.0.2? ... View more

The traditional Meraki switches (all MS except for MS390 which is in fact a C9300) act like individual switches.  So they each have their own management IP in addition to a common stack SVI used for routing.  So the entire stack will have 1 IP as SVI but each individual switch will have it's own management IP. The management IP's cannot be routed by the stack's own SVI so the default gateway of the management IP's must reside on the upstream device (like the MX). ... View more

When your licenses are about to expire you might want to check out the new Subscription Licenses.  There the same license type could have been used between the MX65 and 75 since they are both in the small category. ... View more

If you capture on the MX LAN side you should have each packet twice in the capture. Once with the source MAC address of the device in VLAN 60 and the MX as destination.  And the second time with the MAC address of the MX as source and the windows/printer device in VLAN 70.  If you see those packets twice, then the MX is forwarding correctly and you are experiencing issues on the switched network or on the end hosts. ... View more

The route priority is a static thing described in this document: https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior Is there no way you can prevent the default route on your vWAN to be shared over eBGP and have only the specifics to your Azure networks? ... View more

If those remote site are being serviced by an MX that is running SD-WAN over that circuit you could full tunnel the traffic to the main site and have any policy locally on that MX. However if you are using separate routers outside of Meraki SD-WAN then you could still have the SSID tunneled to a central separate MX.  Or you could go the catalyst route and use a central C9800 controller who can already be onboarded into dashboard. From what I heard this year in Cisco Live Amsterdam they may be moving away from the MX as concentrator solution in favor of a new type of device or using the second solution which is Cisco Native and can now be fully monitored. ... View more

If you have the IP address space or are using private IP's on the WAN you could ferry both ISP's over to the other building using 2 "external" VLANs.  So you could get WAN circuit redundancy for both buildings.   However your MX'es will remain single unless you get a secondary device of each type which doesn't cost that much and does not require a separate license. Trying to mix both networks to both MX'es is only technically possible if you use a Cisco native Catalyst mode switch and VRF's and use some fancy floating static routes.  However in that case you would never be able to announce these networks to each other over SD-WAN since that would require NAT.  So as already been said, your solution would reach quite a complexity without much added benefit. ... View more

Thank god for dashboard to point you in the right direction! There are many kinds of transmitters that transmit smallband signals in the 2.4 GHz including: cameras, baby monitors, RF based security motion detectors. If the environment is large it will be difficult to pinpoint the issue wihout knowing exactly what kind of devices could be transmitting there.  In that case you could hire someone who has a spectrum analyser type of device for example Ekahau Sidekick or Sidekick 2 that can search for where the signal is received strongest. There is a chance however that the machine that is transmitting the signal is in fact necessary and that would make a good case for avoiding 2.4 GHz SSID's in that area. ... View more

Alas you can't.  For that you would need a C9500 with Stackwise virtual. I don't have any customers with a full 3-tier network topology so all of them use collapsed core simplified campus architecture.  So the choice between C9500 and C9300 usually comes down to the fact if both collapsed core switches reside in the same closet or in different closets.  That and the fact that C9500 supports ISSU 😉 I believe you'll have to be on the lookout for the IOS XE 17.15 release on Meraki before having access to these features.  So at this time you will be a little stuck on a single coreswitch for routing. ... View more

If you are doing a design on 6 GHz in Europe 40 or even 20 MHz is considered normal.  Since if you use 80 MHz channels you only have room for 6 AP's within each other's range. So if you are purist and don't want any OBSS above -86 dBm you may very well need the extra channels. ... View more

Oh wow, it has been a while since I saw something to be really excited about.  This just has done it.  Now I fully understand why they couldn't deploy on the C9200 because they are still using the container way of configuring the device. ... View more

Of course, if you pit an MS355 to a C9300 switch you probably will get a better deal for the moment for the C9300.  However if the bulk if your customers use MS210, 225's for access layer switching then it is still a leap to the C9300's. I can totally see the appeal for C9300's or C9500's in distribution layer switching and I can more easily position those to customers. Usually our customers already have some cheap non monitored HP switch line present like a 2530 which you can't really compare.  So the price up is always a challenge to get them on board. ... View more