Greetings All,   Thank you for all of your advices,   After calling the Cisco Meraki TAC,   This problem is solved by upgrading the MR firmware to MR 27.4, after that the MR46 successfully got IP from DHCP and broadcasting my office SSID.   Cheers! Hope its helps. ... View more

I was my stupid error!   I had assigned the VLAN for VLAN20 in the Access Control for the SSID.  The switch port was configured as a Trunk with a default VLan of 20.  According to:   https://documentation.meraki.com/MR/Wireless_Troubleshooting/Wireless_Issue_Resolution_Guide#SSIDs_in_Bridge_Mode   Traffic will not flow.  I do not know why 70% of the clients could connect and 30% couldn't, but as soon as I removed the VLAN from the SSID, the problems went away. ... View more

The solution that worked for me was to place a switch in front of the remote MX to receive the trunk port from the ISP. The remote MX is connected to an access port. I used one of the public IP's that was assigned to us for the uplink, and set that as a static IP. On the main office side I placed a switch between the router and the main MX. The router and MX are connected to access ports, while the PTP connection is a trunk port. All of the ports are on the same VLAN. Thanks for the help. ... View more

Hi @PhilipDAth    I been working with Meraki Support and We can confirm tht there`s two-way traffic and that we have all the Firewall Rules in my upstream firewall. But when we started to deploy meraki branches (1 year ago till now) I have been registering MR,MX and MX in each brach without problems.   But we are a Financial Institution and we have to be aware about our firewall rules. And we deployed more than 100 branches with the NTP bloking in our Upstream Firewall. But now this is the issue bc MS cannot connect to the principal cluster in USA. So it tries to establish the M-Tunnel against the secondary cluster and to acompplish this M-tunnel needs NTP and It`s the port that we have deny in our firewall.... The issue now is that we cannot perform a rule to permit NTP with any any entries bc We are a bank. So we will try to modify our DNS entries to simulate a DNS Poisoning to resolve an internal NTP to the domain that MS tries to resolve the URL that uses to get NTP services.... ... View more

OK, just to inform you and without further explanation here is what I had to do to fix the issue. Simply changing the mask to /12 did not work. And beware of this if you think it will work in your case: Doing so will reassign new random subnets to your bound networks!!!   save firewall rules of the template (if there are rules that have VLAN1 either in source or destination) save bonjour forwarding-config of the template (if VLAN1 in included) save every another piece of config of the template that includes VLAN1 delete firewall rules that include VLAN1 delete VLAN1 from every another piece of config of the template that includes VLAN1 save MX subnet config for VLAN1 (including DHCP settings) on every branch network    delete VLAN1 from template add VLAN1 with the new mask to the template doing this will assign random subnets to your bound networks rebuild firewall rules to the template rebuild every another piece of config of the template that includes VLAN1 reassign the saves subnet configs to every single brach network   Quite a lot of work, but the API did the trick 🙂 AND, of course: Create a copy of your template first. Test, if you are using a script! ... View more

The warm spare automatically gets the same local VLAN and interface config. In an L3 CORE design, just have a transit VLAN that is a /29 or lower because you need at least 3 IP's for your switches in a stacking scenario and 1 IP for the uplink MX.  Use access ports on the switches connecting to the MX'es. In an L2 CORE design, use trunks between the switches and the MX'es and use one of the configured VLAN on the MX as native VLAN on those trunks because you should not "drop untagged" traffic because STP BPDU's are sent untagged and I have seen four links in forwarding state due to this. ... View more

@GIdenJoe - with the new 2.5.0 release in the app and play stores you now can have multiple accounts managing the same network and easily switch accounts in the app to manage another network. Shared-admin Management is the new feature you will use to execute this.   Regarding VLANs, we just released VLAN configurability on the SSID, more coming around increased VLAN configurability but currently, no you cannot create a VLAN on the GX.   There are many differentiators between the Go solution and the dashboard ENT solution. Key differences: - Mobile-app cloud management platform vs URL based dashboard cloud management platform. - ENT will scale as large as you need vs Go allowing as many switch ports as you need and up to 20qty APs but only 1qty GX in a network before you're needing to have the dashboard conversation. - Go does not support site-to-site connectivity like dashboard. - Go does not support APIs for customizations or integrations as the dashboard is so perfectly built to accommodate. ... View more