I know that route filtering for BGP is generally under consideration, but can't provide any specific details.   In the meantime, definitely apply VPN firewall rules - controls traffic leaving the MX:  https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#VPN_Firewall_Rules   ... View more

I'm not in PM but my take would be;   IPv4 requires NAT - there aren't enough addresses to give each device its own public address.   IPv6 was designed to allow every device it's own address, so no NAT required. ... View more

My question would be;   what's the driver behind wanting four links? ... View more

@Mad_Dog_82 - Thank you very much for following up on this thread! I'm going to mark your reply as the solution since it seems you have found the answer (even if it's not the answer you were hoping for). Cheers! ... View more

Can someone advise me on the Spanning Tree changes with this? I'm looking to purchase some C9300L-M switches and use this new feature.   Previous Meraki guidance for MST configuration was for a root Cisco switch to match this config:   spanning-tree mode mst spanning-tree mst configuration name region1 revision 1 spanning-tree mst 0 priority 4096   This makes sense because I can assign the same name across all switches. This ensures that all the switches are in the same MST region.   But with this new Cloud-Native IOS-XE feature, the MST recommendation changed. According to the overview document, the Spanning Tree configuration name changes to the MAC address of the switch. And so if each Meraki switch has a unique MST name, this would essentially put all of your Meraki switches outside of the MST region of your root switch, no matter what.  I'm pretty sure the MST revision number, VLAN assignments and configuration name must match to ensure each switch is in the same MST region. spanning-tree mode mst spanning-tree extend system-id ! spanning-tree mst configuration name 00180a4f0001 revision 1   Cisco covers this here: Understand the Multiple Spanning Tree Protocol (802.1s) - Cisco   Note: If for any reason two switches differ on one or more configuration attribute, the switches are part of different regions. For more information refer to the next section, Region Boundary.   So what MST configuration should my traditional IOS-XE root switch (C9500) use to ensure Meraki edge switches are in the same region as my root?     ... View more

iSCSI runs on IP. IP runs on ethernet. Meraki switches are ethernet switches, so this will work just fine. There is in fact nothing special about iSCSI switches...but for a way of the server vendors to sell their gear.  The only thing that can matter is the performance of the switch.  Which means, uplink bandwidth, oversubscription and buffer sizes.  Meraki switches are aimed and access layer and not exactly datacenter so the buffers won't be the biggest but if you make sure you design with the correct port speeds, the buffers shouldn't be an issue. ... View more

Yes put the Nexus switch into MST mode and have the MST0 instance on lower than default prio so it becomes the root bridge (unless you want the catalyst to be root bridge). Once you do this the nexus will only send BPDU's natively and not send per-VLAN BPDU's which can cause many issues. Then you can also set root guard on the ports on the rootbridge that go downstream to have a stable topology. ... View more

We know Meraki is working an a Azure native way of authenticating but this is not ready yet. At this time you can use a combination of SCEPman and RadiusaaS which is essentially a cloud based RADsec server that can be fully used with cert based authentication. ... View more

It clearly shows that the remote appliances you are trying to reach are offline. ... View more

Thanks for this answer, @GIdenJoe! I'm marking it as the solution. @M_Faizal - if this does not answer your question, please let us know what further clarifications you need.   Cheers!   ... View more

For info, I've been notified of a bug with long allowed Vlan statements which IOS breaks into multiple lines. So if you have an allowed vlan over ~39 characters (including ,-) it will fail configuration validation. I hope this is fixed soon, so I can get IOS-XE onto the last few of our MS390s..I feel  IOS-XE beta is a more stable/robust firmware than the MS/CW fudges to get the MS390s (C9300 HW) into the dashboard.  ... View more

Hi JessePeden,   Building SAML 8021x auth for SSIDs is not on the roadmap but it's an idea floating around. It would likely be built for Splash first. ... View more

I strongly agree with your comment.  Most problems come from client issues if RF is OK. ... View more

Because that's how the Splash Page was designed to work on MX. ... View more

1) Make sure you connect them correctly.  So port 1 of active goes to port 3 of switch 1 and port 2 of active goes to port 3 of switch 2.  Then port 1 of spare firewall goes to port 4 of switch 1 and port 2 of spare firewall goes to port 4 of switch 2. 2) Make sure the Sonicwall uses 802.3ad (or AX) which is LACP negotiation of the channel to bundle them.  Meraki switches will not form bundles statically.  If you are unsure, connect any one of the firewalls to 1 of the switch ports and run a dashboard capture on it and use the capture filter: ether host 01:80:C2:00:00:02 and you will definitely see messages coming from the MS switch but you should check if there are messages coming from the Sonicwall.  If not you have a static aggregate and need to reconfigure that. ... View more

This.  You need to enable QoS in Teams first.  Afer you do that, there isn't much to do if you have Meraki's default traffic shaping enabled. ... View more

the Wi-Fi 7 AP's support Ultra Wide Band radio for even better location scanning. I would check up on that instead. ... View more

I seem to recall, being told that it also shares the PMKID and PTKIDs, for Oppotunistic Key Caching. Unless I'm mistaken? ... View more

Have you found the fix yet? I have exacally same issue here. S2S VPN between MX100 to FTD. there are 4 vlans on the MX side, We used Ikev1, it has been working fine, until June last year, the tunnel is showing packet drops intermittently, When there are packet drops, i can see vlan4 is not come up as ipsec sa but other vlans are working fine.  ... View more

Both ports must be negotiated at the same speed. You can't mix 1 and 10 Gig inside a port-channel. Since you have MS225, why not use 2 10 Gbps links? If the MS225 is in the same rack as one of the MS425's you are better off using a twinax cable to cut costs instead of trying your luck with copper ports. ... View more

It looks as though MS17 introduces RSPAN:   New feature highlights Support for MS150 devices DOM (Digital Optical Monitoring) Intelligent Capture RSPAN and VLAN Based SPAN SmartPorts ... View more

Correct. For the moment only those two features you mentioned are dependent on the advanced tier. In the future I believe major features like VRF, and fabric technologies will most probably be part of the advanced tier. ... View more

Completely missed that! Thank you 🙂  ... View more

That warning is nebulous. I had zero issue installing them directly into a prod network that contains  MT40 and MT15 sensors during the Beta  ... View more