Assuming you're using a Microsoft Windows NPS (RADIUS) server, here's some more up to date Microsoft documentation for adding the IP address of the Meraki switch(es) to the server: https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-radius-clients-configure Without first adding those IPs to the RADIUS server, RADIUS requests may just be ignored. Further, you can confirm the IP address that the switches are using to communicate with the RADIUS server by taking a packet capture (filtered for UDP port 1812 on whichever port is connecting to the RADIUS server) while attempting to authenticate a network client. Then look at the "NAS-IP-Address" attribute field for each switch:   It'll likely just be the management IP address, but if you're using Layer 3 routing on the switches, it might be good idea to confirm. ... View more

This announcement: MS 15.21 Stable (GA) is available for install! ...says that MS 15.21 introduces port isolation under "new features". But then links to this old article :Restricting Traffic with Isolated Switch Ports ...which says: Firmware MS 11.22 adds support for Port isolation on the following. MS Switch Stacks All ports on the MS210, MS225, and MS250 series switches. Prior to MS 11.22, these switch models supported Port isolation on ports 1 - 24 only. But that same article as recently as October 2022 use to say: For MS210, MS225, and MS250 series switches, port isolation is only supported on the first 24 ports   Port isolation is not supported across stack members Back in October 2022, MS 11.22 was ~3 years old. Colour me confused by the mixed messaging! 😕   ... View more

I FOUND THE GNOMES! https://community.meraki.com/t5/Security-SD-WAN/Sign-up-to-participate-in-future-Mobile-research-studies/m-p/177470#M41988 ... View more

Kudos Brash! I didn't even know how to get to that forum! ... View more

As per Brash, you'd need to incorporate RADIUS into your VPN authentication if you want to utilise MFA on Meraki Client VPN. This means you'd also have to migrate your Meraki Cloud Authentication users to some other authentication back end. I Googled and stumbled on this link which describes in detail a method that could be used "at no extra cost": https://kb.hillstonenet.com/en/wp-content/uploads/2019/09/SSLVPN-Two-factor-Authentication-with-Google-Authenticator.pdf However don't underestimate the cost of your time, and the risk cost associated with a solution that comes without support. That's why we pay for 3rd party paid solutions 😊 ... View more

Further, the LACP administrative key (which is generated from the aggregation group number) is locally significant only. It doesn't need to match the group number or administrative key of the switch at the far end of the aggregated link. From the 802.1ax standard: ...there is no global significance to Key values. Similarly, the relationship between administrative and operational Keys is meaningful only in the context of the System that allocates it. When a System assigns an administrative Key to a set of Aggregation Ports, it signifies that those Aggregation Ports have the potential to aggregate together.... - 802.1AX-2020 - IEEE Standard for Local and Metropolitan Area Networks--Link Aggregation | IEEE Standard | IEEE Xplore As long as the Juniper switches that you are connecting to follow a standards-based approach, then interoperability shouldn't be a problem.  ... View more

Check this out on the AnyConnect documentation page (emphasis mine): AnyConnect on the MX does not support multiple VLANs or address pools for Client VPN users. However, the MX supports the application and enforcement of policies to AnyConnect users on authentication. It is also important to note that, from a Client VPN standpoint on the MX, having users on the same subnet does not mean they are in the same VLAN. Users are assigned a /32 address (one address) from the pool configured on Dashboard. Group Policies can then be used to limit users on the same AnyConnect subnet from talking to each other or other resources on the network. - AnyConnect on the MX Appliance - Cisco Meraki Group policies are not an AnyConnect-only feature, so it may be possible to achieve with vanilla Client VPN ... View more

The Dynamic DNS updates automatically to whatever Public IP the MX is using, but it can take about 10mins go update as per this:   Note: The expected TTL for dynamic DNS records is typically about 10 minutes, so you may need to wait 10 minutes before testing to see accurate results. - Dynamic DNS (DDNS) - Cisco Meraki ... View more

See here: MX Uplink Settings - Cisco Meraki The live data graph provides a real-time view of the uplink traffic that is passing through the MX to and from the uplink interface. The graph breaks down the total and download traffic into two separate, color-coded lines. The Historical Data graph will give latency and loss statistics that can be used to determine your Internet circuits suitability for VoIP. Further to that, you look into trialling Meraki Insight and using the VoIP Health monitoring features: MI VoIP Health - Cisco Meraki While we're talking about VoIP and you mentioned you're full stack, if you're thinking of VoIP over Wireless, read this: Wireless VoIP QoS Best Practices - Cisco Meraki ... View more

This sounds like trying to force technology to fix a process problem. I can't think of a Meraki or indeed a networking solution to this. If I was managing those hot desk desktops, I would hate to think what state they'd be in after a couple months of developers installing their own custom tools, development environments, libraries, languages, redistributable packages, drivers, etc., etc. In your situation, I'd push for centralised servers that the dev team can remotely login to from these desktops. Upfront cost may be more, but I would think that long term operational cost would be less. My 2¢ ... View more

If you're intending to provision the MX over cellular, beware of this: "When bringing the units online for the very first time, MX67C/68CW units should be connected via a wired WAN interface to the Meraki Dashboard to retrieve an update to allow for proper use of the integrated cellular connectivity." - MX67 and MX68 Datasheet - Cisco Meraki Out of box MXs may not have stable cellular drivers, requiring Internet access over WAN to download latest firmware. Indeed, for whatever reason, Meraki has lately been encouraging the use of their own MG cellular modems connected via MX WAN ports, rather than their legacy cellular solutions.   Regarding 3rd party VPN over cellular, if you control the cellular network, can provide static IP addressing and manage and limit NAT-ing as much as possible then you should be able to get it working. However, this is an edge case design (I can't find anything in the documentation) so you'll be on the bleeding edge of finding any stability/reliability bugs.     ... View more

I believe you should be able to achieve this using 1:1 NAT.   https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Configuring_1%3A1_NAT ... View more