This is a problem we've encountered as well, we do split tunnel with everything external routing out locally at the branch, only internal routes via the AutoVPN tunnels. Some vendors implement IP whitelisting which would be a nightmare to manage with the number of branches we have deployed, so we need traffic to those destinations to egress our datacenters.   Two options:   1 - (Preferred) - If you are running BGP to your hubs and have the route in the upstream router, simply advertise that route to the MX hub. If you don't have the specific route you could leak it our just install a static and redistribute to the MX.   2 - (Hack) - Configure the IP or subnet you want to pull back over VPN as a local route on the MX hub. Be sure to block the hub from advertising that to the upstream peer.   Caveat - Our hubs are in one armed concentrator mode, not sure if similar fixes would apply to different configurations.   I'm under the impression that this is not a problem with other SD-WAN providers... you can build exceptions to route over the VPN in split tunnel in the same manner Meraki allows you to build exceptions to route over the public connection when full tunnel. Hopefully Meraki implements this some day. ... View more

There is nothing of that nature for Meraki at this time, these community forums and reddit are your best available tools to know when there might be an outage affecting your node. Agree a status page would be really useful, definitely submit a feature request. ... View more

A system health/status page similar to what other cloud providers provide would be a nice feature for sure, but Meraki does not provide one. Submit a feature request if this is something you would like to see. ... View more

If you have a switch stack southbound of the MX pair just have the ISP come in on one of those. If there is only a single port available on the ISP modern there is still the lack of redundancy if the switch it is plugged into fails, but you would at least be able to swing it over easily. ... View more

I believe the Dashboard Throughput test would be sourced from your WAN link, so no specific local VLAN.   It will respect your primary WAN link selection. If you want to setup a flow preference to a specific WAN link you might be better testing from an internal endpoint. Meraki doc indicates the built-in throughput test should not necessarily be relied on for accurate results.   https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Throughput_test_to_the_Cisco_Meraki_Dashboard   ... View more

We would love to implement this but need to update policy in order to backhaul client VPN traffic from remote workers which is split-tunnel by default. Meraki does not document an IP range for api.meraki.com and it does not currently resolve to the publicly documented Meraki ranges. Can we get any info around this? ... View more

Please submit a feature request telling Meraki you need this feature, its basic firewall stuff ... View more

iPSK is really just MAB with the PSK in as an attribute in AuthZ when used with ISE. I think the Meraki implementation is essentially the same as that but Meraki cloud is the RADIUS server.. I do not receive the Dashboard security warning when configuring 802.11r and using iPSK without RADIUS ... View more

Unfortunately there is no way with Meraki to permit anything layer 7, only block. So we can't for example have a more specific permit rule for this traffic followed by the L7 deny. I ran into this limitation with Geo-Blocking...   Please send them some feedback indicating you would like to see this feature. ... View more

What MX firmware are you on? I think there are significant improvements in 16 vs 15. ... View more

No we can't add specific permits in front of any layer 7 rules including Geo. I hope everyone who is missing this feature submits a feature request. ... View more

For event alerting I don't think you can send directly to SMS. Most carriers have an email address associated with your number that will forward to SMS, or you can use webhooks to send to a service that will trigger an SMS alert. ... View more

works for clients with IP, but I get a traceback when it encounters a client with no IP:   Traceback (most recent call last): File "ClientsInOrg.py", line 98, in <module> f.write(curr_clients[k]['ip']) TypeError: write() argument must be str, not None ... View more

This works great! Wondering if there is an easy way to include the client IP address in the output?   Guessing I would need to add something to this section? # Output to file "name", "model", "serial" of the device as well as the "description" and "mac" # of the client f . write ( current_networks [ i ][ 'name' ]) f . write ( ',' ) f . write ( curr_net_devices [ j ][ 'model' ]) f . write ( ',' ) # f.write(str(curr_net_devices[j]['name'])) # f.write(',') f . write ( curr_net_devices [ j ][ 'serial' ]) f . write ( ',' ) f . write ( str ( curr_clients [ k ][ 'description' ])) f . write ( ',' ) f . write ( curr_clients [ k ][ 'mac' ]) f . write ( "\n" )   ... View more