Yes, for the L3 and L7 rules will be used what you configured on the group policy. ... View more

When the switch forwards a DHCP packet it includes the layer 3 interface IP address where the original DHCP packet was received.  This lets the DHCP server know which subnet it came from. ... View more

Make the first MXs WAN IP .56 and then set the vIP to .54, that's it 🙂 ... View more

Negative.  Clients get an IP addressed derived from their MAC address.  You will.aleays get exactly the same IP address every day of the year on every AP. ... View more

If you want to ensure that your network remains operational even if one switch in Stack B fails, it would be better to take 1 port from each of the 2 switches in Stack B to 2 ports on the core switch (Stack A). This way, if one switch in Stack B fails, the other switch can still maintain the connection.   If your switches support link aggregation (also known as port trunking or teaming), you could potentially increase the throughput between the stacks by using multiple ports. In this case, either option could work, but you’d need to ensure that the switches are properly configured to take advantage of this feature. ... View more

As long as you don't have a circle of switches the outage should be quite minor.   RSTP reconverges by blocking the links between two switches while sending a proposal BPDU and the other switch should immediately send a response if it agrees. If you have a good star topology the outage should be minimal (less than 2 seconds).  If you have a circle you could experience a count to infinity issue where you go down for a while before the topology can resolve itself. ... View more

Thank you all for the input all.  I imagine option 2 would make the the list in the firewall quite large, but maybe easier to manage and decipher. ... View more

Yes, it's client vpn.  Thanks for verifying. ... View more

Thanks for sharing what the problem was.  ... View more

As well as what's been said above, MX firewall rules can use policy objects and Vlans as source or destination. ... View more

Documentation really helped.  If I want to test this on just one switch ( have 3), and on just one port, will all connected clients be affected when I make this on the NPS?  Or does it only get applied when it is applied via Meraki? ... View more

Meraki also uses a public IP in the NAS field when AP's and Switches probes the radius server to see if it is alive. Meraki also uses public IPs for BGP router ID's when enabling BGP and for the APs when they are in mesh.   It's really strange to see these public IPs show up at seemingly random places. ... View more

@RaphaelL  answered your question. 🙂 ... View more

There is a known bug which occurs when you disconnect stacking cables and then connect them back, it might hit you: "Stack members may go offline after a stacking cable is reconnected requiring a power cycle (present since MS 12)"   We hit these way before it has been reported as a known issue and rebooting one of the switches in the stack most of the time helped, but just expect running into issues, so if you don't want that, then power down the whole stack. ... View more

There's quite a few ways you could do this. A lot of it comes down to design choices. Eg.  - Will the VM's and ESXi management use the same physical port on the server?  - Will the VM's be on the same subnet and VLAN as ESXi Management or different? Assuming your ESXi host and VM traffic will exit the same physical server port onto Meraki switch port 5, you can:  - Configure Meraki port 5 as a trunk with Native VLAN 10, or Access VLAN 10  - Leave the VM traffic untagged in ESXi Or if you'd prefer to tag on ESXi, you can:  - Configure Meraki port 5 as a trunk port with native vlan 1  - Configure ESXi management to use VLAN 10  - Configure your VM's to use VLAN 10 within ESXi These are just a couple of ways you can configure the devices to have both ESXi and the VM's on VLAN 10 and receiving IP addresses, assuming that's what you're trying to do. ... View more

Could be related to Advanced Malware Protection.    Also, if you’re unable to download files in chrome such as PDFs and it says “network error”, disable AMP. Pro tip I learned through two hours of troubleshooting.  ... View more

I'm think I'm going to have to add the second one in Meraki, turn off the old one and see if I can connect.  Off hours of course.  Wish there was a better way. ... View more

@Announcer in order to have the "SM Sentry Enrollment" option un-grayed, there needs to be a Systems Manager network defined within that SAME Dashboard organization where the SSID is defined.  Does that help?  Sorry if I misunderstood the question. ... View more

I guess we will start to use the MX built in security.  We wanted to use Websense since it was already paid for.  Perhaps this can be a wish list for Meraki.  Thanks all for your replies. ... View more

This blog article is a nice simple guide to getting the VPN going. https://meraki.cisco.com/blog/2013/03/meraki-auto-vpn-is-just-a-click-away/ ... View more