There is not a direct API endpoint to “click that revoke button” for a client in the Meraki Dashboard. The Meraki API provides endpoints for managing users, but these are primarily for creating, updating, and deleting users.   One possible workaround could be to use the RADIUS CoA feature. Your RADIUS server would need to send a disconnect packet to trigger the revoke of access. But, this would require a RADIUS server, which you mentioned you do not have and do not plan to set up.   Another potential solution could be to set the splash page frequency to 1 day, as you mentioned. This would effectively revoke access after 24 hours. If you need to extend access for certain users, you could potentially do this by updating the user’s settings via the API. ... View more

I would use one supernet for all your clients, and another for the production networks.   For example, 10.16.0.0/16 for clients and 172.16.0.0/16 for production.  Make the third tuple the site identifier.  For example, a single site might use 10.16.34.0/24 for clients and 172.16.34.0/24 for production.   Then you can create broad VPN firewall rules like 10.16.0.0/16 is denied access to 172.16.0.0/16.  Instantly with one rule, every client network is denied access to every production network. ... View more