Really curious to see who the new All Stars will be! 😎 ... View more

This is the first firmware release that I had to roll back due to issues with clients not able to connect to the outside world anymore. ... View more

What kind of Antivirus software is running on those machines? ... View more

Great job, @KSM, @Paccers and especially @DrDray!   Really great to seeing the top 4 change a little from month to month. It really shows the drive behind this community. Thanks a million, especially to this special group of people! ... View more

This is brilliant, thank you so much for your effort to explore the MX further! 👍 ... View more

No, SSL Decryption was pulled sometime ago from the MX (for good reasons). IF you really want to decrypt SSL, you'd have to stick to another firewall like Firepower or another vendor's solution.   Your best option though is to go the cloud-native way with something linke Cisco Secure Access that will handle a lot more of your (future) tasks. ... View more

@DarrenOC Just as posted by @GreenMan, 18.2 will bring "Multi-WAN (2 Active + 1 Backup)". ... View more

...currently... 😉 ... View more

I don't know the answer for the MX, but for ASA / Firepower it would be: all IPs.   EDIT: This has been discussed in another thread too https://community.meraki.com/t5/Security-SD-WAN/Meraki-MX-Firewall-with-FQDN/m-p/116396/highlight/true#M29106 ... View more

To my knowledge, MX is working exactly like you're describing it: the IP is simply cached for a specific amount of time. Don't know if the TTL is recognized over there. This is by the way (almost) exactly how ASA / Firepower are working internally. These platforms will take the TLL into account though (and could "extend" it internally if needed). ... View more

@misterchaiguy: interesting! I'm on a SD-WAN Plus license and my Dashboard tells me that there is a Trial period ending in (currently) 89 days. ... View more

Sounds promising @JonasD!   I guess one of the biggest issues currently is licensing: At least, one of the "bigger" licenses is needed to actually use this feature On top of that, ThousandEyes licensing comes into play that makes it a lot harder (for the typical Meraki customer) to dive deeper into that topic. Somewhere it's mentioned that the licensing situation is to be improved and I can only hope this will come sooner or later. Something like a bundled "Advanced Security plus complete M365 / Webex / ... monitoring would be a lot easier to consume than what's currently existing. ... View more

Quick initial feedback @misterchaiguy:   Setup was Meraki-easy, so good experience I understand that setting up tests is more of a ThousandEyes thing. It's not difficult to set those up, but wow, then there comes licensing! Don't ever try to set up one of the pre-defined apps as they won't be able to run due to missing "credits". I'm possibly not the best example customer regarding that particular use case, but that's definitely not very Meraki-like 😞 It would be great to see the application tests also within the Meraki Dashboard, just as you're doing with "Internet Outages". The current state will force me to be transferred to the ThousandEyes Dashboard to really see what's going on. Hope this helps a little bit. ... View more

@DarrenOC  Taking a look at https://documentation.meraki.com/MI/Meraki_MX_ThousandEyes_Configuration_Guide, it seems to require at least the Advanced License. ... View more

According to https://social.technet.microsoft.com/wiki/contents/articles/901.directaccess-and-firewalls-and-nat.aspx, you'll need to enable   Protocol 41 inbound and outbound—For DirectAccess clients that use the 6to4 IPv6 transition technology to encapsulate IPv6 packets with an IPv4 header. In the IPv4 header, the Protocol field is set to 41 to indicate an IPv6 packet payload. UDP destination port 3544 inbound and UDP source port 3544 outbound—For DirectAccess clients that use the Teredo IPv6 transition technology to encapsulate IPv6 packets with an IPv4 and UDP header. The Forefront UAG DirectAccess server is listening on UDP port 3544 for traffic from Teredo-based DirectAccess clients. TCP destination port 443 inbound and TCP source port 443 outbound—For DirectAccess clients that use IP-HTTPS to encapsulate IPv6 packets within an IPv4-based HTTPS session. The Forefront UAG DirectAccess server is listening on TCP port 443 for traffic from IP-HTTPS-based DirectAccess clients. when using MS' own "firewall" solution. My best guess would be that outbound rules will be sufficient, because as you say MX is a stateful firewall. ... View more

Just to clarify: was the ARP entry done for a client on the MX? Or have you added the MX's MAC address to an upstream switch? ... View more

RADIUS itself is an unencrypted protocol framework, so yes. You're able to transmit obfuscated password though by using a Shared Secret that is used to hash via MD5. There are several protocols that can be leveraged "inside"  to have a common "language" in-between its peers. PAP, CHAP or EAP-MSCHAPv2 are three of those password-based protocols. It sounds like you're using EAL-TLS that will use certificates for authentication.   As for your question, you'll find great information about it on https://www.securew2.com/blog/what-is-eap-tls. In a nutshell, encryption starts after having completed the authentication that is based on encryption keys that both parties will rely on. ... View more

Adopting the approach https://documentation.meraki.com/MX/Site-to-site_VPN/Tag-Based_IPsec_VPN_Failover should help you out here. The only difference is that this is based on two 3rd party S2S connections. ... View more

Wow, who would have thought the MOTM would be that close?!   Congrats to everybody and special thanks to @GreenMan! ... View more

Whoa. More Known Issues than fixes 😳 ... View more

Could you provide us with a screenshot of one of the affected clients? ... View more

Take a look at https://support.umbrella.com/hc/en-us/articles/230904088-Preventing-circumvention-of-Cisco-Umbrella-with-firewall-rules ... View more