Can anyone clarify how the Z3 client list might be generated ... at a high level, expecting there may be one of two methods OR a combination of both methods ... could be other methods ... just attempting to understand my finding listed below Method A) Router keeping track of all addresses communicating on the network OR Method B) Router doing something like an arp to discover what devices respond If only Method B, could explain the following  ... due to not trusting the security of Cheap IOT devices, whenever possible, instead of configuring them with the true Gateway Address, the Gateway Address is either left blank or is the same as the Static Address assigned to the device.  Comparing device configurations appears to indicate that only devices with the correct Gateway assignment are in the Z3 client list If this indication is true, is there a way in the Z3 to deny a device WAN access ... these devices need to function within the network but don't want them communicating externally ... Perhaps some kind of Outbound/Inbound Firewall rule? Deny all protocols to/from IP address x? ... View more

Cambium cnPilot is an AP with the gateway (gateway is the Z3) defined to provide DHCP service so don't think it is acting as a router ... as stated in my previous reply to you the Cambium traffic appears to be listed but perhaps the non explicit reserved settings on the Z3 were causing some of the client details to be ignored? As I have now explicitly defined all of the STATIC devices hopefully they will now show up in the Z3 client list   ... View more

no apologies are required ... appreciate the feedback Of the 507 available addresses with a 23bit mask, the Z3 DHCP has been set to have 300 unreserved addresses, 207 reserved addresses with 17 of those static The client list is confusing because it claims there are currently 144 clients ... my confusion might be because I was expecting this list to show active clients ... instead, it is showing clients that have connected within the current filtered time; (Day, Week, Month) ... what led me to open the original question was I expected that ALL 17 of the STATIC "Active Devices" would be found in the Client List (9 of which are connected via the Cambium AP) On closer inspection today I missed 2 that were within this 144 listed clients over the past 24 hrs. Which leads to more questions As 8 of these 9 devices are IP cameras which are being actively polled every 5 minutes, why aren't they all showing up in the Client List ... if 2 are showing, why not all? What I have done today is EXPLICITLY add ALL 17 of these Static Address Devices as FIXED IP ... perhaps the Z3 was ignoring these devices as they were in the Reserved IP Block and most were NOT added to the FIXED IP ASSIGNMENT list ... View more

ok so I have applied a group policy with Layer 3 of deny 192.0.0.0/8 and Layer 7 deny p2p ... YET ... I can still ping any of the 192.168.210.0 or 192.168.209.0 devices ... am I doing something wrong or am I misunderstanding the guest example given by: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies ... View more

Please Disregard my previous posting ... tried another machine which had exactly the same results with W10 Pro 64b   Turns out in this case the 691 error was CORRECT ... there may be an issue with the Meraki Dashboard used from the latest Firefox browser ... I explicitly CHANGED the PW for the VPN User to something simple as a temporary test ... this temporary password apparently wasn't accepted by the dashboard ... don't recollect seeing any error message when I pressed the change button so will take a closer look at this as a possible issue   Anyway I have now put back the original PW and reset all users ... all working now      ... View more

Not certain what is going on with my attempts to connect to a Meraki Z device using VPN Client  in WX Home (brand new out of the Box HP Laptop):   2 Laptops side by side (same local network and appliances); L1=W7 Home Premium   L2=WX Home   L1 connects to the Meraki Z VPN with no issues Disconnect L1 and attempt to connect L2 with IDENTICAL credentials but the connection is denied   L2 reports the following VPN error Can't connect to <name of VPN> VPN The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server   The L2 application events log shows a 691 error also suggesting the credentials don't match   The MZ log indicates the following common negotiation messages - received broken Microsoft ID: MS NT5 ISAKMPOAKLEY - invalid DH group 20. - invalid DH group 19. while L1 connects with the following negotiation message - VPN client connected <local ip> both display the following negotiation messages - ISAKMP-SA established <MZ ip address> - IPsec-SA established: ESP/Transport <connection details> - IPsec-SA established: ESP/Transport <more connection details> L2 does not connect and has a number of additional negotiation errors - purged IPsec-SA proto_id=ESP - ISAKMP-SA expired <MZ ip address> - ISAKMP-SA deleted <MZ ip address> - no configuration found for <local internet ip address> - failed to begin ipsec sa negotiation.   I have followed the: - Meraki troubleshooting guide - Meraki W10 VPN Client instructions   Being I can connect via another machine with the same credentials with the only notable difference being the W10 Home 64b OS (All updates have been applied), I can only assume there is some issue within the W10 machine   All the 'Solutions' found on the net or in this forum thus far have NOT produced a solution     ... View more