Anyone got  any thoughts on this? I won't be taking my phone abroad for a couple of weeks but if anyone can offer any advice on this I'd appreciate it. ... View more

Update: I've just heard from the user. She's in Brussels and her phone is working as expected. Note that I toggled data roaming on by hand on this device. Looking at my phone today, it is managed by SM but the roaming features are still not toggling on or off. hm. There's not a lot of chat on here about this so I imagine we're missing something? ... View more

Thanks Deniz, that's good to know! ... View more

Hi Blake,   Yes, I can toggle it on by hand. I'll be taking my work phone on holiday in a  couple of weeks and I have another user taking her phone abroad shortly who is helping test this out. I've been all over the documentation and it's not clear why we would be having this problem. ... View more

I've had an email acknowledging the issue so hopefully things will start to happen. ... View more

I did not know this. And in fact the I had assumed that the person listed here was just my sales contact from back (way back) when we purchased our MRs! Many thanks. He's getting an email from me!! ... View more

I have a meraki account manager? I guess I should look into that. ... View more

Have you asked your neighbours if any of them implemented a WIPS/WIDS? Something like Air Marshall can deauth your network if the admins have blacklisted your SSIDs. It would certainly cause Deauths to be a problem. We've had issues with this on our main site with this in the past. Have you had a walk around with a wireless scanner (get one for your smartphone) to see if you're accidentally using the same SSID as another office? Note: see the AM docs below for an explainer on what I mean https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal ... View more

You're not using a wired connection at the same time are you? We see real issues with Macs that are on wifi and wired at the same time. ... View more

Checked in with our guy today. Here's what happened here and it's not really a bug per se. For whatever reason the user's iphone factory resets.   On boot it goes through it's normal setup process. The user enters the wrong credentials. This fails check in with SM. But the phone starts. User is now missing the SM setup we'd configured. He doesn't have adinistrative access so he can't make the changes he needs to get the profiles working on his phone. He reboots - the phone is stuck in this weird twilight state. What our guy did was change the associated account in SM from the wrong credentials to the correct one. He then pushes a new profile  to the phone. This prompts the use for his password which he enters. At this point all of the pending config tasks execute. His phone is fine now. ... View more

Hi Deviant I appreciated the advice and I'm quite happy to discuss the network we're proposing. I don't know what Meraki was like before its Cisco acquisition (we only had APs and never needed assistance) but as we've now standardised our infrastructure around Meraki kit we've needed more assistance from Meraki. But every time we've talked to them we've had to abandon the ticket and muddle through because we get very little interactive pleasant customer service. ... View more

We've not had any support on this one. I believe we rebuilt the phone once we got it back into the office. So I am very curious to hear what you get back. ... View more

That's interesting. We've had issues with one of our staff iphones which has gone through the same thing. I thought it was just his iphone. I'll ask my colleague what's been done with the phone in question. ... View more

  If I could perhaps also ask, how did you interconnect to the ISP. Did you assign the switchport access vlan 18 or did you trunk some VLAN's and native vlan 18? The latter. The idea was to trunk all VLANs to the router. This doesn't explain to me why the switch suddenly started advertising the gateway??   TBH: I'm having an issue with Meraki support. The reply I've had back is "You need to understand how the upstream router is going to work." The thing is, I DO understand. The router is going to listen on it's assigned IP address (10.120.18.7) and as I've outlined above it's expecting vlan tags to arrive via a trunk. On the switch port connected to the router, I set the port to be a trunk that accepts all expected VLANs from this network. Or am I missing something? Either way I've now exchanged 2 emails with support where I've sent them pictures of the setup and explained what I was expecting to do. But they're not helping. I don't know if anyone from Meraki support monitors this forum but I'm not getting the support I expect for this quite expensive kit. My colleague has separate issues with SM and essentially gave up trying to get support from Meraki. I hope I'm not getting more of the same treatment. I couldn't get hold of anyone on the phone yesterday.   /rant.     ... View more

Definitely no wireless kit directly attached to the network any more. Although like you I've seen that before. I really do think that the MR was detecting itself or perhaps another unit. It's not happened since I saw the alert I am keeping an eye out though. ... View more

So. We had this work scheduled at the weekend. The routing was configured as described. We decided to test this by switching over to the secondary router (it's a hot spare). We allowed switchover to happen and I had a port ready to go to carry the vlans.   However no traffic would route to the internet. It took me and the support tech at our ISP a while to figure out the cause but in the Cisco logs we noticed a conflict. The gateway address (10.120.18.7) was a duplicate. Looking at the MAC address the IP that was being advertised was the one for the MS250. We flipped back to the primary and everything reverted back to normal service.   This is how I created the first VLAN (Internet - 18).   Note that I binned the other VLANS for the purposes of this update. They were all created as outlined in my table above. The routing interface for each was the .1 for the subnet. My ISP sent through a portion of the log which shows this: This is what the CISCO (ISP) router saw. Sep 7 2018 20:59:36.856 BST: %IP-4-DUPADDR: Duplicate address 10.120.18.7 on Vlan18, sourced by e055.3dfb.8d2e I'm completely confused by this. Why would the Switch be advertising that it had the IP Address? Why would this go away when we flipped back to our normal routing arrangement? And also yes, we lost our ability to manage the switch once we flipped over but I am not sure how to keep our internet connection alive during the change. I have raised a ticket with support about this but other than an acknowledgement I've not heard back. ... View more

Now, that's interesting. I will keep an eye out for that. ... View more

True. Unless you track it down. I spent some time yesterday wondering around testing the signal strength and I couldn't find anything. I've a suspicion that the router detected itself. It alerted then didn't alert again. in another environment I did find a spoof once which turned out to be an old access point which had the same SSID as the current corp one. Someone had found it in a corner and plugged it in. In that case there was something I definitely could do about it... The information about spoofs that's available in Air Marshall is sparse. It would be good if it could provide everything the aerial found. ... View more

ps. I think I put this in the wrong forum. It should really be in Wireless. Sorry about that. pps. I don't think is a spoof but that the AP is detecting itself. I've rebooted the AP and so far no more alerts. ... View more

Our @Adam wrote: When you say both sites are completely Meraki do they have MX's as well or a different firewall? Maybe I wasn't clear in my long post. Internally our LANs are all meraki. It's MS switches and MR access points. Our Routers are managed Cisco. I'm not sure what the firewall above is. ... View more

Hi Deviant,   I'm actually less worried about the users. We've picked the DHCP range to broadly present the DHCP range (with a different mask ...) that's present already. From reading the documentation we'd need to tag the ports in the USERS stack. Servers though, you've hit one of my concerns. We've budgeted an entire weekend to work out the kinks. I've already placed Servers broadly into the range I expect them to be in so I hope there's not too much work to do there. "The Internet VLAN seems confusing, I assume that that will be the VLAN between ISP and LAN. And when you refer to VLAN's allowed you mean to say VLAN X may Communicate with VLAN Y for example via the Routing Table of the switch." Yes. Sorry I think I put that badly. the "internet" VLAN will contain a segment that we use to route traffic from the LAN to the external managed network. Traffic will flow site-to-site and to the Net. "All you would need is to have an IP in a VLAN on the Distribution MS250 side and also give the ISP an IP to use. Then they must route the relevant subnets to you're IP and you have a default route up to the ISP's router. The key off cause is to get rid of the /20 subnet mask on the end devices first or they wont know how to get to the other VLAN's. You would also need to ensure that you create the IP's for each VLAN to make them routable. Also ensure that you only tag VLAN's to Users and Server switches that are required on those switches. Choose a management VLAN for the switches and ensure on the trunk links that they are untagged." Great that's my thinking. We already have the IP for the router set up. One thing I am not clear on is the configuration of the route. Example: If I am on VLAN 20 (users) and I want to route to the Internet my ISP will configure the necessary interface. But this raises a question for me. Do I make the default gateway for these devices the the one on VLAN 20 (e.g. 10.120.20.254) or set it as a the router address? I assume the former and if I am right about this I'd  just set the route to be: VLAN 20 gw (10.120.20.254) -> VLAN 18 Internet gw (10.120.18.x)? I find the Meraki route creation page a bit confusing. "Also ensure that you only tag VLAN's to Users and Server switches that are required on those switches. Choose a management VLAN for the switches and ensure on the trunk links that they are untagged.    Make sure you're switches receives DHCP in the management range VLAN and that it is permitted by the ISP's firewall." I'm not sure what you mean there. I was just going to setup a helper address for Users DHCP and hand off to a microsoft server to facilitate the various services we've defined?  And a final question re ACL creation. is there a best practise for when to do this? Right at the end or as we go along? ... View more