Sorry for the late reply ... But there is a discrepancy between your answer and Karsten's answer. My understanding is, that Threat Protection includes IPS/IDS and AMP. Karsten mentions, IDS is done on the hub/concentrator. Your answer says, there is no inspection with Content Filtering and Threat Protection on the hub/concentrator. Please, clarify: Is IDS/IDS done on the concentrator for the remote subnets? ... View more

It seems that deep links to managed clients are not possible. ... View more

Actually, I have no SM Device. I cannot test it. Did you try it with a "regular" Meraki device, like a switch, access point, mx, camera? If it works for you and only a SM device cannot be called like this, your guess seems to be correct. ... View more

What do the brackets represent? I tested this API call with a MAC address from a switch: https://api.meraki.com/manage/dashboard/show?mac=aa:bb:cc:dd:ee:ff It works. ... View more

The AP is not aware of the syslog server and it's reachability. ... View more

Create a new template. The network type does not matter, so combined network is no problem. Organization > Monitor > Configuration templates While creating the template, you can choose "Copy settings from" and the network, from which you will retain the config. Click "Add". In the next step, you can choose the networks to bind to the template.     Some parameters can be set individually in the networks (local overrides). Do you work with AutoVPN? Before you bind your networks, read the documentation about the difference between "same subnet" and "unique subnet": https://documentation.meraki.com/General_Administration/Templates_and_Config_Sync/Managing_Multiple_Networks_with_Configuration_Templates#MX_-_Template_VLAN_IP_Address_Range_Allocations ... View more

Config Sync only applies to MR and MX networks, not to MT networks. ... View more

You can disable Active-Active AutoVPN. Then the tunnel is built with the primary uplink. The secondary uplink is used, if the primary uplink fails. ... View more

Your description does not contain any relevant information. There are issues - but what exactly? So let me guess ... Do you have more than one subnet in your traffic selector? According to https://documentation.meraki.com/MX/Site-to-site_VPN/IKEv1_and_IKEv2_for_non-Meraki_VPN_Peers_Compared#IKEv2_working_vs._non-working_example_packet_captures the MX builds a single SA with multiple subnets. Maybe the Mikrotik devuce responds with only a single traffic selector. The result is connectivity only with one subnet instead of more than one subnets. ... View more

You can move licenses independent from license keys. Just klick on "move". You will see a dialog like this:   Just fill in the count per license and move. ... View more

You can move any count of licenses from one org to another. Moving licenses is independent from license key. ... View more

A real alternative is https://quad9.net/. You can choose between filtered DNS and unfiltered DNS. ... View more

It's quite a long time ago, but one thing: The heartbeats are VRRP heartbeats, these are L3 packets. Source address is the address from the active MX. Destination is the multicast address 224.0.0.18. The spare MX does not have any LAN IP addresses, but it can receive the multicasts. So the only MX sending the heartbeats is the active one, the spare MX cannot send any IP packet. ... View more

Thank you. I know how to configure admins in dashboard. I know to adjust the permissions, I know how to delete an admin in an org. Remember: The admin account belongs to our company. So it is not "someone else's" account. It is an e-mail address belonging to our company. There should be a solution to delete an obsolete account. Beside that: It is not possible for me to delete my own account, too. ... View more

"Meraki VPN" ist based on IPsec and L2TP. L2TP has additional overhead. Maybe you have a fragmentation problem? Check the MTU setting on client side. For Auto VPN the MX does Path MTU Discovery. I do not know if this is true for Client VPN, too. It is not possible setting the MTU on the MX manually. You have to contact the support for doing that. ... View more

Yes, of course. It's another way (and shorter) with the same result as configuring the subnets as VPN enabled. ... View more

I think your setup is this way: AutoVPN to the other sites VLAN interfaces on the MX needed for inter-VLAN routing VLAN interfaces configured with VPN enabled in the AutoVPN configuration   The new setup: Delete the VLAN interfaces on the MX Configure a transit-VLAN between MX and MS Configure VLAN interfaces on the MS Set static routes to the networks  behind the MS. Gateway is the L3 interface for the transit-VLAN. Configure the appropriate VLANs as VPN enabled ... View more

@alemabrahao wrote: instead you have to use 192.0.1.2. Just to clarify: It should be an address from 192.0.2.0/24 ... View more

I have no idea what could be the reason. Maybe you should open a support case. One more thing: Do you have any adblocker installed in the browser. Try to deactivate it. ... View more

I do not completely understand your point. Why is it another point of failure? You need a routing device without NAT. NAT excemption would achieve this, I think. You can configure a VLAN interface on the LAN side with one address out of the /29 subnet. ... View more

You can configure NAT excemption per uplink. This feature is available as beta (Security & SD-WAN > Addressing & VLANs). ... View more

Have you tried to use another browser or a private/incognito window (Firefox/Chrome)? This would be my first try. ... View more

That's exactly my result. QUIC traffic is not filtered. If you block UDP/443, you will block DTLS. If somebody wants to establish a DTLS based RA VPN (e. g. AnyConnect) through your firewall, the client has to fall back to TLS. ... View more