As you said, you are also not able to ping to window-10  client, you first need to narrow down the issue, start by taking the packet capture on client VPN and lan interface on MX and see how ICMP traffic looks like, if the firewall is passing the traffic then the troubleshooting should be focused on lan side.   Start checking from windows firewall and the services, and you should be able to resolve it and if the issue is with the tunnel building with MX 84 from windows 10, then please refer below document,    https://documentation.meraki.com/MX/Client_VPN/Client_VPN_Overview     ... View more

VPN subnet translation feature is ideal for deployments where the same subnet is used in multiple locations and each of those subnets needs to have access to the site-to-site VPN.  This feature is not limited to any Model but it is just not available on the dashboard by default, to enable this feature, you need to open the case with Meraki support to enable this feature for your organization.       ... View more

In general, when the new firmware upgrade is available for your network, then it will be available under Networkwide > General, once the firmware will be available then you will be able to see following three options (default behavior),     And if the firmware is not available, then it will be greyed out,      You can also manage the firmware upgrade on the organization level by scheduling the firmware for the particular network under Organization > Firmware upgrade > All networks > Schedule upgrades.   I would highly recommend you to refer below documents for all the firmware related queries, https://documentation.meraki.com/Special:Search?q=firmware&path=&limit=11&page=1&tags=         ... View more

I don't think I am able to answer the first question because, I think we have not established a problem yet and want some more detailed information to start with but yes for the frequency of the splash page, you can always go to wireless> splash page > Splash Frequency (By default it is one day) and adjust the value.       There is a setting under the access control called Simultaneous logins, you should try adjusting that value as well.       ... View more

You can always filter the traffic with the following rules, please note that the maximum packet capture duration is 432000 seconds, the capture will stop after 60 seconds, or when 5000 packets have been captured.   host 10.20.30.40 packets to and from ip address 10.20.30.40 host 10.20.30.40 and port 80 packets to and from ip address 10.20.30.40 and TCP or UDP port 53 (DNS) icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply all ICMP packets that are not echo requests/replies (i.e., not ping packets): ether host 11:22:33:44:55:66 packets to and from ethernet host 11:22:33:44:55:66   It is always preferred to run the packet capture without the dashboard filters and use Wireshark filter when we want to check inside header values (i.e. caller and calling station id in radius packets)  ... View more

As soon as your MX is connected to Meraki cloud and has reachability to the peer it should be working but building an IPsec tunnel on cellular is never considered as a best practice, the best approach should be using the Wan interface.     ... View more

num_eap='X' means the authentication failed at the Xth RADIUS packet exchange between AP and the RADIUS server.   Let's say the client shows num_eap='3', the authentication would go something like: AP sends packet 1 to the RADIUS server RADIUS server responds to packet 1 AP sends packet 2 to the RADIUS server RADIUS server responds to packet 2 AP sends packet 3 to the RADIUS server RADIUS server responds to packet 3 by rejecting the client The authentication failed at the 3rd packet exchange Please refer below document for the packet exchange between the client and the radius server,   https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise   let's say a client was trying to authenticate against the RADIUS server and for some reason, the authentication failed at the "RADIUS Access-Request: EAP Response Identity / Access-Challenge: EAP Request MSCHAPv2 Challenge" part, then you would see a log stating num_eap='6', because the authentication failed at the 6th packet sent to the RADIUS server.   Does that mean that every time you see num_eap=6 means that the client failed at the RADIUS Access-Request: EAP Response Identity / Access-Challenge: EAP Request MSCHAPv2 Challenge?, not really, as you also have to consider that the AP sometimes will need to re-transmit some packets.   So let's say that the AP retransmitted the first RADIUS Access request: EAP response identity 3 times and never got a response, then you may see an 802.1x failure event with num_eap=3, as the AP sent three packets to the RADIUS server and failed.   ... View more