Thank you, I have reviewed the document step by step for the past week. My experience says it has to be something simple/basic at this point. Does the fact that I have one clan (vlan 0) for everything? No errors on the AD server. Packet capture shows traffic to and from the domain controller on port 3268 but I don't really know what I looking at beyond the traffic is there.   Currently, Active Directory-based authentication works only if one of the following is true: The Domain Controller is in a VLAN configured on the appliance The Domain Controller is in a subnet for which a static route is configured on the appliance The Domain Controller is accessible through the VPN. If there are multiple Domain Controllers in the domain, all of them must meet one of these criteria in order for Active Directory integration to function properly.   I think I have satisfied the above requirement because packet capture shows traffic between the  device on the wan port (IPHONE connected to let network) and Lan device (Domain Controller).   Meraki cloud Authentication works but it is not the best solution for my network because I have applications running on the network that will be accessed by outside vendors that I eventually will want to separate them on to a separate vlan.   I have to be missing something probably simple.   ... View more