I'm hoping someone from Meraki can comment on this feature.  It's crazy that it does not exist yet. ... View more

Did you ever get this resolved? I assume you are getting NAT traversal errors? I am having a heck of a time here. I was on MX 18.210, some of our equipment can't go that high. I had one site downgraded get NAT type B. I can go online with wordwide of regional, but if I try making a room I can, but I cannot join with another. This is with MK8. Very frustrating as we are trying to start e-sports leaques. ... View more

Q: Did you have to reach out to your Cisco Meraki rep to unlock this?  A: No  Try to use -> Under Organization > Administrators  - > new section -> Update camera and sensor permissions ... View more

Thanks for your comment. Please report back if the "Beta" Firmware will work. We opened also a technical Support ticket. Let´s see what happens...         ... View more

I guess nothing has changed in 4 months? since @JohnT's message? ... View more

Block all access until sign on is complete is fine and works great. the doc from the WBA lays it all out and it does work. That is not to say that an end user will not have issues with their device from time to time due to whatever reason but in 99.9% of those cases it is not the AP or the RF. It starts with end user education about how your wireless environment  operates.  ... View more

Thank you. ... View more

The only way we could get it to work was to install the Windows Certificate Server web server on our certificate authority.  Each user on a Mac would have to run the certificate wizard in the keychain to create a certificate request and then submit it through the Windows certificate server.   It's not ideal, but it works.   Also, just a heads up that using MacOS certificates and AnyConnect is broken on 17.10.2.  We are working with support and are stuck on 16.16.3 right now. ... View more

Throughput bug on MX64 - V18.101   Just experienced a weird bug that made my net slower. No issues on 17.8, upon upgrade to 18.101, internet speeds seem to cap at 50mbps. Made troubleshooting (made client whitrlisted, changed to a new group profile with higher speed, changed network ports) but to no avail. I thought at first it was a ISP issue, but doing a dashboard throughput test, I'm getting around 100mbps (I'm sure cable is ok). Reverted back to 17.9 and the issue goes away.  ... View more

This has been on the "wish list" for a long time I think. But nope, we still do not have that feature.   ... View more

MX 16.12 seems to be out. Did not see the cert issue in the release notes any more and the cert seems to get created correctly (had issue with 16.10, now gone after the upgrade). Seems to be issued by "HydrantID Server CA 01", no more self signed. ... View more

Hahaha, that resolved it! I can now confirm it is working with version 16.11 and AnyConnect Client v4.10.00093.    Those that use different CA, you can convert certificates manually with certutil.     certutil -encode filename.cer newfilename.cer       Thanks everyone! ... View more

@cmr there was a Partner Download mailing on Wednesday where it was mentioned. ... View more

I suppose that would solve some of my AWS issues, but I forgot to mention we also have some sites in CloudFlare as well so it's a little more complicated.  I love Meraki, but this little limitation is killing me. ... View more

I performed what was indicated by @KarstenI on the MX I rolled back to 16.7 and it worked in terms of creating a valid certificate again.    I forwarded this thread to the guy I was speaking with on the ticket, but I haven't heard anything back yet, but at least the error is gone.  ... View more

@Netwow if you are using any form of Wireless WAN router/modem that has an Ethernet hand-off then you will need to connect it to a WAN port on the MX, which will mean you will have some charges on it. These charges come from the fact that every WAN port on a MX will constantly connect to the Meraki cloud to ensure it has connectivity - this will be in the region of about 100MB a month (from what I've seen) - and you can't disable it.   You can stop the MX from forming AutoVPN tunnels on all interfaces by going to Security & SD-WAN -> SD-WAN & Traffic Shaping and disabling the 'Active-Active AutoVPN' option. This will mean that the AutoVPN tunnel will only be formed on the primary link unless it fails, so keeping the traffic to a minimum.   The only way to have a true failover function (where there is an absolute minimum of traffic on the 4G circuit) is to have a USB connected modem, or to use a MX model with the in-built 4G/LTE modem. ... View more

Also keep in mind that failover WAN links create additional VPN tunnels, so a dual WAN link firewall may create up to 4 VPN tunnels per device when connecting to another dual WAN link MX.  If you mesh with additional firewalls with dual WAN links the tunnels grow exponentially and it can quickly get out of control.  I didn't consider this initially when I did my planning. ... View more

Meraki provides the site to site VPN connection for my DR site so unfortunately it's my only option.  However, I was able to solve the problem by changing the replication to transfer over port 443 instead of 80 to avoid packet inspection.  I just thought it was such a strange and interesting problem and maybe someone could benefit from this post. ... View more

https://support.apple.com/guide/mdm/shared-ipad-and-8021x-networks-mdm19659e20e/web   I think this should tackle the certificate deployment.   ... View more

If you deploy the client with PowerShell you can use the -IdleDisconnectSeconds parameter to set the idle timeout in the client connection settings.  You can also set this in the VPN network adapter settings on the Options tab.  Just set the timeout where it says "Idle time before hanging up.".  This only works on a PC. ... View more

@Nash So CDO does support Meraki native network objects as well, but you'll need a feature flag enabled to do this on CDO (please ask support if you'd like this).  Note: I'm a CDO developer. ... View more

This solution worked, thanks everyone! ... View more

I always create a "Deny All" rule for my entire local subnet.  This blocks all inter-vlan traffic.  All inter-vlan traffic that I want to permit I put above that line, and everything else goes below it.  In your case, you would put the ICMP rule above the Deny All rule.   Here is an example:     ... View more

As long as you're referring to devices that are able to handle cert based authentication. But in each and every network, there's more than that.   Unfortunately, many Windows admins don't see that and that's one of the main reasons NPS sucks bug time... ... View more

I think this,along with the MX15.x train disappearing suggests that Meraki have someone new in the QA team who is treating the release in a more enterprise manner.  While this is good for the stable versions, I liked the flexibility of being able to try the beta versions... ... View more