Thanks Philip That is what I needed. The ipad is now back to the beginning. ... View more

Actually, we need both. I need to authenticate the user and machine, but the user is more important. So much effort was put into trying to sell us a Meraki solution, to the point that the features we wanted seemed trivial, and Meraki can handle pretty much anything we needed, in some way. But the results are that RADIUS or AD are the only two options--no LDAP, which I need most. But alas, we are doing other work to make the more old-school RADIUS work for us. ... View more

First put a tag on your ZI.  Go to: Secureity Appliance/Appliance Status Click on the pencil next to "tags" and give the Z1 a tag.,   Go to: Security Appliance/Site to Site VPN Scroll down to: Organization-wide settings Click on: Add a peer   Give it a name.  Put in the public IP address of the CSR1000V.  For the private subnet put in 172.9.0.2/32.  Note that you will need to change the destination encryption domain of your CSR1000V to include the entire subnet behind the Z1.    Under availability choose the tag of your Z1 that you created above.  Fill in your pre-shared key.  Leave the "IPSec Policies" on the default setting. ... View more

You can't do warm spare at a switchport level with MS switches, only at a Switch level. ... View more

So we would have to use either the router in front and the SD WAN features on that or the MX? ... View more

Maybe.  What features of ISE are you hoping to replacing, or what features have you been using?   If you also use the Systems Manager agent you can replicate a lot of the functionality of ISE using dynamic tags. ... View more

Yep, you need the physical interface to be brought down.  Otherwise you need to wait five or so minutes for the logic to switch over. ... View more

I also would love to see this. I think it would revolutionize how one does hosted Firewalls. But alas for right now it's not on the horizon. Sad 🐼 ... View more

Philip,   Thanks, I'll work with customer to take this further. ... View more

I haven't done this for quite a while.  You need to add an extra match in NPS to match the SSID.  I think you need to match on "Called-Station-ID".  Basically look in the event viewer to see what is being sent to you as well in the RADIUS request and add something for that.   This article same some related info. https://social.technet.microsoft.com/Forums/windowsserver/en-US/fa662135-3ddd-4699-a8eb-83f9f85b5674/nps-calledstationid-regex-pattern?forum=winserverNAP ... View more

Thanks, that did it, no need to do the factory reset. ... View more

Samsung Cloud is baked into the OS. I found two apps associated with it, and when whitelisting them didn't work to bring it back, I tried with a blank blacklist, and it still isn't there. To my understanding, a blank blacklist should be the same as a stock device, but I keep running into "missing" features.   I am attaching two screenshots of the settings page: the stock/standard setup device has "Cloud and Accounts" as an option, where the Device Owner device only has "Accounts" - the cloud functionality is simply missing. Oh, I guess I can't attach an image or file to this message? That's surprising and disappointing. I'll PM them to you if I can.   The two package ID's I was able to find were com.samsung.android.slinkcloud and com.samsung.android.scloud.    Thanks for your help! I might end up just not using Device Owner mode for now, but that is a last resort. ... View more

Did you make those three ports on the MS220 access ports? ... View more

If this is an App you should be able to push it out.   I have not seen any options for selecting or configuring a keyboard. ... View more

Wow, I wasn't expecting this much of in depth answers. Thank you very much for all who helped me in this.   Does anyone know how much maintenance does Meraki devices require per year? As you can see we have a lot of remote offices (and they move locations a lot due to nature of our business) and they are all over the world and our company can't offered to have IT at each remote site yet. (This is in fact the main driver for us to look in to Meraki as my understanding is that Meraki devices can be managed from HQ thru cloud.). We also looked at Cisco ASA and while it looks very nice, it seems to me that it is for a large company with more structured IT department.   Lastly, we would be also setting up a Microsoft Active Directory on our network and all our machines will be joined to the domain.  Would this setup support RADIUS authentication (even in the remote sites) for WIFI connection? (Can MX64W do the RADIUS authentication with AD in HQ?; assuming the VPN connection is configured correctly)   Thank you very much! This community is one of the best place I've ever been! ... View more

Did have some problems with firmware 14.11 and VPN's that stopped working.  Downgrading to an older beta firmware fixed that again. ... View more

It works.  I have connected 10G TX servers to the multi-gig ports on an MS350-24X without a problem. ... View more

@mnw wrote: So your response is different from the other person responding.  I find it hard to believe that one would have to pay $30 for every chromebook, windows computers, iPads, and other devices we have in the dashboard.  Of course, that is an annual license also and not a one-time charge.   This is funny, because I have talked to two Meraki resellers and their answer was different also. Ah, I misread your original post. Clients connected to your network, no, you do not need a license. Clients enrolled with SME, yes, you need a license. ... View more

You need both ISPs to connect to the same MX (or the same pair if you want to run HA) if you want to do load balancing (as opposed to failover).   Assuming you have some kind of fibre ISP circuit, you can trunk the ISP circuit across your dark fibre in a VLAN.   Ideally you want an ISP circuit which is using normal Ethernet encapsulation with static IP addresses rather than PPPoE. ... View more

The authentication only happens once, NAT or Bridge once they are authenticated it last's as long as the lease. ... View more

This is not a great solution.  Go to Organization/Overview.  Click on the "Devices" tab.  Click on the + on the right hand side and add the column "Uplink IP (Port 1)".   If the device is "up" and it has no primary IP address then the primary WAN/Internet interface is down.  Click on the column name to sort the column.  Sort it so that the sites with no primary WAN IP address are at the top.  Now you have a quick and easy way to see sites on 3G. ... View more

Correct me if I'm wrong, but I think you are under the assumption that you cannot broadcast multiple SSID's from any single AP? You should be able to have both SSID's broadcasting from any AP. Then you can setup a schedule for the "Lunchtime" users SSID that they will connect to under the SSID Availability page in your dashboard. Under the Firewall & traffic shaping page for that same SSID, you can set individual client bandwidth limits, or a limit for the entire SSID per AP. I think that would be the way to go unless you want to setup some more in-depth Group Policies.  ... View more

Thanks for the reply  ... View more

Meraki.com is also in our whitelist.... we've seen that problem too.  Crazy ... View more

We use band steering on all of our SSID's without any (known) problems. I would highly recommend moving to a 25.X release though as the 25 branch brings a lot of nice stuff like AP client load balancing. We're currently using 25.3 without any (known) issues and it sounds like many others are using 25.5 successfully as well (we had an issue with SSID's not broadcasting with 25.5 on MR33's).  ... View more