TLS is an encryption transport system, and is not required if you are just doing authentication.  TLS is most commonly used for encrypting TCP (and sometimes) UDP connections (aka transport layer protocols).   IPSec does not require TLS but can use certificates for authentication. ... View more

I found this: https://meraki.cisco.com/lib/pdf/meraki_whitepaper_autovpn.pdf "The VPN tunnel is negotiated. The Cisco Meraki cloud already knows VLAN and subnet information for each MX, and now, the IP addresses to use for tunnel creation. The cloud and MXs establish a 16-character pre-shared key (one key per organization), and a 128-bit AES encrypted IPsec tunnel. Local subnets specified in the dashboard by IT admins are exported across VPN." ... View more

It uses IPSec, but I am not certain of the method it uses for the authentication.  I have heard it is a rotating key, and I have also heard it is a certificate.  I have not heard something I could say is 100% true. ... View more

This is a good article about connecting up physical stacks. https://documentation.meraki.com/MS/Stacking/Configuring_a_Physical_Switch_Stack ... View more

The MS250 also uses an 80Gb/s stacking connector so uses the same cables.   The cables are not that expensive compared to the switches.  I often include extra cables because of this.  Having an extra unused cable is much easier than having a cable too short and is unusable. ... View more

Did the install actually fail?  Did you use an Administrator style account to attempt the install? ... View more

You have to enrol the device in "Supervised" mode, and then the MDM can wipe the phone without it being an issue.   To get a phone into supervised mode you have to use Apple's DEP program (an Apple requirement).  It is painful.  You can read about it here: https://documentation.meraki.com/SM/Device_Enrollment/Using_Apple's_Device_Enrollment_Program_(DEP)_with_Systems_Manager   Actually, you can also use Apple Configurator (note that this is only available for Mac's - not Windows): https://documentation.meraki.com/SM/Device_Enrollment/Enrolling_and_Supervising_iOS_Devices_using_Apple_Configurator_2.0_or_Later ... View more

Negative.  You need two cables to create a ring. ... View more

I disagree with nearly everything you say.   I've written several password breaking tools for Cisco products: http://www.ifm.net.nz/cookbooks/cisco-ios-enable-secret-password-cracker.html http://www.ifm.net.nz/cookbooks/passwordcracker.html   The larger the source pool of characters that the password is drawn from the more time it requires to crack.  An 8 character password that consists of only letters (and where this is known) is considerably faster to crack than an 8 character password that consists of letters, numbers and special symbols.   Any modern password system does not store passwords in an easily reversible manner.  Having the crypted version of the password is just the starting point of breaking the password.  The more complex the password set of charcaters the more time it takes to break the crypted text.  A long strong password combined with a good algorithm can be impractical to crack because of the huge amounts of CPU time involved.  Pretty much if the algorithm requires more than 1000 years of computing time on high end distributed kit you are pretty safe.   I do agree that if the unencrypted passwords are captured by a key logger then you are screwed.  You need two factor authentication to mitigate that threat. ... View more

AutoVPN uses IPSec.  TLS is not used. ... View more

I think nearly all of the options mentioned would work.   Take a read of this document, and search for "Layer 3 roaming with a concentrator" and the section after that one. https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment   I suspect you will be wanting to use "Layer 3 roaming with a concentrator" mode. ... View more

There is a cert on the AP and that is used to authenticate with the cloud but I can't observe that portion of the communications as it is already encrypted. ... View more

I don't see any point in running all traffic through the ISR when the only thing it is processing is PRI voice traffic.  I would plug it into the Meraki switch using a single Ethernet interface.   You could even put the ISR and all the phones into a separate voice VLAN. ... View more

I just did a packet capture on an MR42 starting up.   It negotiated a TLS1.2 connection.  The server it was talking to had a SHA-256 signature on its certificate.  I couldn't verify the client certificate.   You can not replace the burned in certificates installed in Meraki kit.  If you did - then they would fail to authenticate and get their configs. ... View more

I can't think of any way to do that. ... View more

I don't know the answer.   In a Windows environment you have both user and machine credentials, and by default both are used.  First the machine one when the machine is first powered on, and then the user one when the user logs in.  That that user logs out and another user logs in then the user is 802.1x authenticated again.   In Windows you can also configure a policy to only do machine authentication.   It sounds to me you need an option like this for the Mac - machine only 802.1x authentication.   This forum post seems to be loosely related to your issue. https://discussions.apple.com/thread/4433348?start=0&tstart=0 ... View more

Change/remove the policy that causes the issue.  Then in the Meraki console ask the device to check in. ... View more

First put a tag on your ZI.  Go to: Secureity Appliance/Appliance Status Click on the pencil next to "tags" and give the Z1 a tag.,   Go to: Security Appliance/Site to Site VPN Scroll down to: Organization-wide settings Click on: Add a peer   Give it a name.  Put in the public IP address of the CSR1000V.  For the private subnet put in 172.9.0.2/32.  Note that you will need to change the destination encryption domain of your CSR1000V to include the entire subnet behind the Z1.    Under availability choose the tag of your Z1 that you created above.  Fill in your pre-shared key.  Leave the "IPSec Policies" on the default setting. ... View more

No, it wont work in that case. ... View more

I like the 802.1x idea!  It should not be that much of a discipline for users to log in and out of their machines.  You can set group policy to lock their machines if idle for (say) 5 minutes.  Then if someone forgets to logout the next user will be forced to log back in again as they wont have the credentials of the prior user. ... View more

I'm sorry to say but I do not believe this is possible.  The entire Meraki model is based around device enforcement.  Even when you authenticate it just associates this with the device and then enforces that device. ... View more