I found the solution: it's a common issue with AnyConnect DTLS negotiation. You need to open UDP port 443 alongside TCP port 443 on the MX/vMX firewall. ... View more

I have: Always on enabled Connect failure policy set to closed Captive portal remediation explicitly allowed in the VPN profile But captive portal is always not allowed... Users cannot reach the public hotspot website identification... The only way to fix my problem is to change the login failure policy to open... ... View more

It's the same as with disconnecting an active client VPN session.  We need to have the ability to monitor and terminate existing flows. ... View more

Hi @rhamersley , As @thaack mentioned, Group Policy is the way to go for seperation and security. However, if you are finding that they are not enough IP address being assigend. You can simply expand the subnet range. E.g. 192.168.1.0/22 would give you 1022 IPs to use.  ... View more

I have not deployed the full Meraki+Umbrella SASE solution.  I have requested pricing for 5 licences so I can buy it and have a play ...   I does use Cisco Secure Client and the Umbrella module contained in it.  You could use Cisco Secur Client like you do now - but a lot of things would no longer need it. ... View more

Replies to this are in this thread: https://community.meraki.com/t5/Security-SD-WAN/Users-are-unable-to-connect-to-Hotel-WIFI-DELTA-WIFI-with-Always/m-p/239246 ... View more

Philip!....I want to say thank you so much for the information you provide to the Meraki Community.   You truly provide a service and knowledge that is used in our infrastructure.    THANK YOU AGAIN FOR THE INFORMATION YOU PROVIDE!!! ... View more

Well done! ... View more

As @PhilipDAth said, it is the vendor who made the NIC in the device.  For the 63 Winstars technology items that you have, a quick Google leads to their site https://www.winstars.com/ and they make PC peripherals, in particular USB-C/Thunderbolt docking stations.  Would that make sense in your case?  ... View more

The issue that I found was that Device guard was enabled on windows 11. Disabled device guard via GPO and the issue was resolved. PC had to be rebooted after the port was changed back to 802.1x. ... View more

To add to @alemabrahao answer (which is correct), Cisco would recommend the use of Cisco Umbrella - which only supports TLSv1.2 clients.   Both Meraki MX and MR devices have native Umbrella integration options. https://documentation.meraki.com/MX/Meraki_Umbrella_SDWAN_Connector/Deployment_Guide  ... View more

Usually, matching on the issuer of the certificate (such as matching on your CA) is sufficient for the correct certificate to be selected.  No user involvement should be required. ... View more

Hey folks, This is a well-known consequence of DTLS negotiations failing: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116881-technote-anyconnect-00.html If it's not a huge issue to your users, it's relatively harmless to leave it be, but if you want to fix it, make sure your appliances are reachable on UDP 443 ... View more

It's not specific traffic, it's literally any traffic that isn't listed in the existing categories. If you are in doubt, you can confirm with Meraki support. ... View more

You’re likely selecting the incorrect interface to run a packet capture on. Give support a call, they will be eager to help you out. ... View more

Is there a service we can use to help us keep an eye on ChatGPT usage within our organization? ... View more

Going sideways.   "Always on" sounds great in practice, right?  At least it does to me. However in daily use it tends to be problematic.  Nearly every client I have deployed this at gets me to turn it back off again.   For what it is worth, everyone gets me to deploy SAML based authentication these days.  The two most common ones I do are directly against AzureAD/EntraID or Cisco Duo. ... View more

Oh, and if you're ever in need of keys for Windows 10 or 11, I recently came across Digital Chill Mart. Their prices seem pretty reasonable, and it might be worth checking out. Here's the link: https://digitalchillmart.com/product/windows-11-pro-32-64-bit/ Let me know if you have any other questions or if there's anything else I can assist you with. ... View more

There will be a tool for client management, but stay tuned for that. ... View more

Access Control for VPN connections is handled via IP addresses or subnets, not MAC Addresses.   That said, you can use MAC-based access control to restrict access to the Local Network included in AutoVPN. If not allowed, the client will be blocked at the local network level and prevented from accessing anything.  https://documentation.meraki.com/MX/Access_Control_and_Splash_Page/MX_Access_Policies_(802.1X)   https://documentation.meraki.com/MS/Access_Control/Configuring_Microsoft_NPS_for_MAC-Based_RADIUS_-_MS_Switches   ... View more

This can be caused by AMP's inability to connect to AMP cloud. This will cause all AMP inspected file downloads to be blocked unless AMP is manually disabled.   Most likely culprit is a firewall issue, or a DNS issue preventing the MX from resolving AMP Cloud hostnames.      ... View more

Any MX using NBAR can recognize MS Teams traffic. What I personally always do is the following: I always match all voice applications and give these a DSCP EF marking (so I have to assume the high setting will be ignored and the MX will put them in the realtime queue).  Notice the MS Teams Audio tag in the config. Then the second rule matches the rest of voice and video which will be the video and call signaling protocols and those then get the AF41 and high queue.  Since matching is always done top down this configuration should work.   It is important that the voice part hits the realtime queue of your MX so it goes outbound first.  Once your packet hits the internet it is fair game for any kind of treatment.  So you only have control of outbound packets on your own MX towards the ISP. ... View more

Same here. Shard n176, everything is completely fine. ... View more

Wanted to follow up here. We received the below message from Meraki today. I verified that the search was working. With the working search, we could see that one of our internal domains is being flagged as "Advertisements", which we block. Yesterday, it wasn't showing a category in the Meraki "event log". It is now showing the "Advertisements" category on any domain or subdomain using that internal root domain. We do own the domain, so we are not sure how it was flagged as "Advertisement" as it's not used externally. Response from Meraki: Thank you for your patience as the engineering team has been able to work on providing a solution. I received word from the Engineering team that this issue has been resolved. ... View more

Hello @rhamersley As @alemabrahao indicated, getting a packet capture and checking logs on your Radius server are good starting points. The packet captures can provide details in terms of whether or not the traffic is reaching the Radius server as well as the responses sent out by the server, if any. In addition to that, Meraki does have a guide for troubleshooting Radius issues. You can find it here:  https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS_Issue_Resolution_Guide ... View more