Thanks - I'm not quite sure I can make sense of your reply as it applies to VPN profiles.  However, strangely enough, I seemed to have stumbled across a way to 'glitch' Meraki and iOS into working with Global Protect. I already had the Certificate added and GP would never see it and try to use that to auth and would always default to request user/pass credentials.   So, I tried playing around with the Per App VPN configuration.    I set it up using the VPN server name, then Cisco AnyConnect as the Connection Type.  Account was the username for the .p12 certificate and then I added the GlobalProtect App. Saved it and pushed it to the device.    When I tried to connect via the iOS GP app, it would not ask for user/pass, but would almost immediately throw a failed to connect to server error.  After that, I simply removed the Per App VPN setting on that Profile on Meraki, pushed it again to the device, and then next time I tried to connect, GP it didn't ask for creds and used the certificate and connected just fine. Very strange and will be interesting to see if this persists.  It's very buggy behavior and doesn't even feel like a real 'workaround'.  However, I have been able to remove the profile, get forced back into GP iOS asking for credentials, then did the above workaround and got it connecting via certificate on the GP iOS client...so it's repeatable.  Ugly ugly ugly workaround though and I think it was just dumb luck I stumbled onto it....   ... View more

I opened a case and it's a bit of a dashboard bug.  Even though we removed the old MR33 from our network, the SSID configuration settings persist in the backend database. To resolve the issue, I had to add the old MR33 back into the network and change the configuration to remove WPA3 transition mode and this resolved the issue. Fortunately the MR33 was still in my inventory so I was able to add it back in without having the physical device.  I'm a bit concerned about whether I could do that if I unclaimed the device and it was claimed by someone else. Certainly, I think Meraki has some work to do here with cleaning up configurations when MR devices are removed.  I can't see any clear way to delete an SSID or force the wireless configurations back to 'factory default' at the dashboard level so I had to go manually correct the 3 SSIDs and try to set them back to what is default configurations. After all that, I was able to remove the MR33 and now I can create/edit Group Policies ... View more

Did you get this solved? I can't figure out how you allow Social Media sites at multiple time windows in each day.  As best I can tell you can only set one time range per day per GP.  I don't see anyway you could allow Social media during breaks & lunch within the same day (e.g. allow facebook access from 10:30-11am and again from 1pm-2pm)? ... View more

It should be "Custom" from my point of view. Please find examples about the format here. ... View more

I've tried to troubleshoot some of these and didn't make the connection but in hindsight, I do remember iPhones being the devices linked to these. That's good stuff to know!    Thanks! ... View more

We are using this dble NAT solution on PPPoA lines in the UK but are having great difficulties getting the MX64 to fail over from the Internet port (which is connected to one PPPoA DSL modem) to LAN4 port (configured as an internet port and which is connected to another PPPoA DSL modem).  Both the Internet port and the LAN4 port are configured for Direct connection and DHCP from their respective PPPoA DSL routers.  Problem is, we can't get a 'soft failover' to occur (ie. we unplug the dsl cable from the modem connected to the Internet port - to simulate an ISP issue) from the Internet port to the still up-and-working port4.  The only way we find we can get the failover to occur is by simulating a 'hard failover' where we unplug the DSL modem from the Internet port so that the Internet port drops.  This is not an ideal situation - any ideas or thoughts? ... View more