Network-wide > Configure > General settings for Device Configuration With Device Configuration enabled, local users on your network will have the ability to see/access the local Meraki equipment and make login attempts.  If disabled, they will NOT be able to access it locally (it's a protection mechanism to BLOCK logins locally).  Typically after the device has connected to the dashboard this is DISABLED to prevent local access since it's managed normally via the dashboard. You would therefore manage the Meraki equipment through the dashboard.  Just be sure to have more than 1 admin in case that lone admin loses access.  It's best practice to have multiple administrators in case one gets locked out. ... View more

Negative.  You can also have traffic analytics with just an MX in the network.   Under network wide/general, set "Traffic Analysis" to "Detailed".   BUT, I don't think tihs will help with what i consuming traffic over a site to site VPN.  Do a packet capture since the traffic is there all the time.  Load into Wire Shark.  Ask for a top conversations reports. ... View more

@cmr wrote: Not that it is a solution, but I've always advocated using L2 unmanaged switches for WAN splitting for two reasons: 1) what you've seen here where perhaps some tags are clashing 2) as the switch is completely unprotected, best to have something that can't be hacked... Thanks. Understood. That's likely my solution - replace with something simpler. I used these Unifi switches because they were perfect for this purpose; tiny 5-port switch, powered over PoE so can be powered from a single MX LAN port and used for both management and power, visibility into traffic stats (not very detailed, just basic throughput and volume), troubleshooting, and I happened to have some lying around. Oh well. ... View more

@PhilipDAth wrote: Being RDP, the client is likely to auto-reconnect again. But...our RDP farm is accessed via a name like remote.company.com, which points one of our /29 addresses, not the MX address. Ah, OK, you're saying this doesn't matter, as... if the primary MX fails, the secondary will also know about the NAT rule and accept traffic. That makes sense.  I'm really overthinking the VIP concept. Talking it through really helps. Much appreciated! ... View more

Just chiming in with my experience here. I too needed to use a custom certificate with Anyconnect, instead of the Meraki provided cert. I bought a Comodo PositiveSSL certificate from SSL2Buy. When the certificate was issued, I received a zip containing 4 files. <mydomain.com>.crt << this is my certificate AAACertificateServices.crt SectigoRSADomainValidationSecureServerCA.crt USERTrustRSAAAACA.crt   The latter 3 are root CA or intermediate CA certs. When configuring the custom cert in the Meraki dashboard, you are prompted to upload (1) your certificate and (2) the CA chained bundle. My cert if obvious, but I didn't know which of the others are the bungle, so I tried each of these 3 and it failed.   After chatting with SSL2Buy's support, they suggested I would need to create this bundle myself by copying/pasting the 3 other certificates into a new crt file in this specific order, one directly on top of the other.   1. USERTrustRSAAAACA.crt 2. SectigoRSADomainValidationSecureServerCA.crt 3. AAACertificateServices.crt   This bundle crt was then uploaded and accepted by the dashboard. I hope this helps others in a similar situation. ... View more

Yeah, the Policy Objects/Policy Object Groups are a lifesaver for that exact reason. Even though they're marked as a beta feature, I believe several folks are using them successfully. We haven't seen any problems with them either - they behave exactly like you would expect. That said, we do back up the policy objects, policy object groups, and site to site VPN firewall rules daily using API calls...just incase. ... View more

Hi, I now have the trial vMX's setup and running on Alibaba Cloud and part of my Org. However, I'm struggling to get the basic setup working.   My current setup is:   The end goal is this topology: As a side note, I would prefer to keep the London <> Hong Kong Office AutoVPN as it is as latency is good at 210ms. I would prefer to avoid the scenario below, where these sites are both spokes to the HK vMX as this increases latency between these sites. ...would like to avoid this setup, if possible Anyway, back to my point, in the vMX's > Security & SD-WAN > Site-to-Site VPN, it says about adding routes to the upstream router. I presume this means the Alibaba Cloud VPC. Here, I have created static routes for 192.168.110.0/24 (which is the network the HK Office MX64 is in), next hop = ECS instance (HK vMX)   However, with this in place, if I go to the HK Office MX > Appliance Status > Tools > Ping the internal IP of the HK vMX, I get no reply (100% loss).   When looking at Organization > VPN Status, I see all sites connected. On the HK vMX, if I run a packet capture on the site-to-site VPN I get nothing at all🤨   What am I missing? Thanks in advance.   ... View more

Thanks. I have opened a support case. I'll update here with the results. ... View more

>That link refers to NAP (Network Access Protection).   NAP is deprecated by Microsoft and does not work in newer OSs.  Don't deploy this technology.  If you can get it working because you have old OSs on your servers and clients you will loose the functionality as soon as you upgrade them. ... View more

Hi Miyo360,   1) I would create the Shanghai subnet(192.168.120.0/24) on HongKong Meraki so that it gets advertised to London Office.   2) You need a static route on HongKong Meraki toward WireguardVPN      If Dest is 192.168.120.0  then go to 192.168.110.8    3) For return  traffic, you need a static route on Wireguard VPN    if Dest is 192.168.100.0/22 then go to 192.168.110.1   ... View more

Despite changing the default VLAN to 2, this hasn't solved this problem as I just got another alert. I have now raised a case with Meraki support, who were equally as stumped. Because the Unifi switch is blocking the DHCP request, the MX isn't reporting anything helpful in the Event Log. A case has been created and I will watch for the next alert to try to establish activity around that time (clients arriving, joining the network, leaving, new devices plugged in, etc).   I have also turned on remote syslogging for the Unifi switch, so this will hopefully help identify what is happening. I'll update this topic when I have more to share. ... View more

Thanks. After reading the articles, I think you are right   As the device runs on the network, it will communicate device and network usage analytics back to the Meraki Cloud. Dashboard analytics based on this information, in the form of graphs and charts, are updated regularly in Meraki’s Cloud, and are displayed in the dashboard of users when they are viewing this information. ... View more

@jdsilva I agree with that. I don't think it would be very reliable. It would be helpful if the "Traffic shaping rules" also had a SpeedBurst option like the "Global bandwidth limits" offered. ... View more

Thanks very much. This was helpful. I created a new network and looked at the options you suggested. I set the following...                       I then added a device and checked the permission list and the differences are    Erase all data and settings Lock device and remove passcode List configuration profiles Add/remove configuration profiles List provisioning profiles Add/remove provisioning profiles List device information List network information List installed applications List restriction information List security information Apply settings Install and remove applications and data Thanks again for your help. ... View more

Hi,   We have offices in London, Hong Kong and Shanghai and definitely have issues with our MX64W in Shanghai.    I see registry issues with the VPN, sometimes it drops the connection, other times it stays up and the registry issue resolves itself. When the VPN drops for more than 5 minutes we usually reboot the appliance, which forces it to use another random port which seems to work.  IIRC this was the advice of the Meraki Support rep. We live with this.   Out SH office is just a room in a managed service building, so we have no control over the internet connection or ISP provided to that office. It's literally just a cable hanging out the wall. I have no idea what upstream devices are being used, how the bandwidth is managed, whether any shaping is going on, etc. I have suspected this setup could be part of the issue, but we don't have another mainland Chinese office to test from.     The VPN between HK and London is rock solid. ... View more