I don't know your environment, but it sounds like the proof of Meraki suitability is the fact that you already have it running successfully in 12 locations.  If you're an engineer and an architect suggests replacing it, you might challenge them for proof of an operational improvement.  And when they roll up a projected cost, don't let them skip over the non-product costs (like de-install/install of APs).   Unfortunately, ClearPass does win out over ISE sometimes.  When it does, I've always found that it interoperates very well with traditional Cisco products.  I would expect the same with Meraki.  In general, the 802.1x standard is consistently implemented these days.  One feature that's been a sticking point in the past (maybe still in some cases) is Change of Authorization (CoA).  That's how a security policy solution (NAC) tells a switch your access rights have changed.  I've never heard of it implemented on a WLAN, so it shouldn't be a concern for your stated use case.  While I have not specifically seen CP and Meraki interoperate, I would expect it to go just fine for the standard RADIUS based auth most folks are after on a WLAN.   Stand up a new SSID with 802.1x auth pointed at the CP host and see for yourself! ... View more

Sounds like you need to update your routing design.  Once those remote sites are connected via VPN, that prefix should then be listed as reachable via the MX, not the previously used router.  Of course, you could weight routes to fall back to the legacy router if the VPN goes down.  But there should be no reason you have to live with the asymmetry as a normal condition.   Another possibility to consider is whether the legacy WAN links could be supported on the MX.  If so, you could leverage the various Meraki SD-WAN capabilities such as policy based routing to then use both routes for different applications.  But this raises additional questions around why you would be in a scenario of having two VPN links and a traditional WAN link to field locations.  I'm hoping once you complete a PoC with the Meraki gear you will actually be simplifying, not complicating your design 🙂 ... View more

Great question.  In this case, all storage is going to be 10Gb, but several legacy hosts are going to be 1Gb.  Uplink will also be 10Gb to core.  Yes, in addition to iSCSI jumbos, some additional buffering capability to accommodate the rate changes could be needed.   Here's where I am at on this as of right now.  I've been in touch with a Meraki field SE who pinged his broader team, my team within a large VAR, and solicited feedback on a popular internet forum.  I'm getting zero encouragement to go with the MS425 in this application.  It's a shame because my customer is a perfect target for Meraki in terms of the impact cloud management will have on their efficiency, but I'll have to go with WLAN only for now.  Since they are "IT-lite" they are not a good case for a science experiment.  Hopefully I can move their access layer switching to Meraki next year, but it's not in the budget this year.   If anyone pops up this evening that wants to make a case fo the MS425 in a iSCSI ToR application, I'm still all ears, but tomorrow it goes to the customer. ... View more