I'm having the same issue. "Content filtering is disabled. I can ping the host, but i cannot SSH into it. There is no firewall rule blocking the port. "   Removing our MX85 allows SSH connections to function. I'm attempting to SSH into our router connected to the WAN side of the MX95. ... View more

Both Vlans are on the Route-table! ... View more

@CarolineS   I finally got that Meraki Yacht Club swag out on a boat!   😁  ⛵  S/V Azzurra, a Jeanneau Sun Odyssey 479, out of Marina Scarlino in Italy.     ... View more

If I understand correctly; you have a non-Meraki WiFi system sitting behind a Meraki MX.   You wont be able to do anything on the MX to stop MAC address spoofing being done on a client connected to a WiFi controller connected on another system.   You should consider using some kind of authentication system on your WiFi network, such as WPA2-Enterprise mode, or splash page authentication.   On the MX you can configure a splash page with authentication. https://documentation.meraki.com/MX/Access_Control_and_Splash_Page/Splash_Page     You could also consider looking at what the customer is accessing.  If it is something that is not commonly used you could consider blocking that type of traffic. ... View more

Thanks for the link, I did wonder why our switch upgrades didn't happen when we first asked for them, now I know there is a 20 minute delay! ... View more

We have also ordered more APs..... 🙂 ... View more

The question you're asking, I think, can be more generally stated to be "How can you control what devices connect to your network (virtual or real)?", and the current solution is 802.1x. The downside is that implementing .1x isn't a light lift, but if you truly want to stop devices from connecting then this would be how.    As an alternative, perhaps MAC Whitelisting or Sticky MAC fits your environment. These features define a list of MACs that are allowed on a given port, and rejects traffic from other MACs. It's hard to manage in large environments, but for smaller deployments it can be a quick and easy way to implement a basic level of port security.   If, as @AjitKumar suggest, you just want to stop rogue DHCP servers then DHCP snooping is a much easier feature to implement.   ... View more

If you need to apply a group policy in mass you can do it from the clients details page. Just check mark all the clients wanting to apply to. Click the policy button on the top left of the list and then select the Group Policy Radio button. Then choose the policy to apply to all the clients. Another option is to do it by VLAN if you want it to apply to all devices behind the MX. ... View more