Yes you can create  the same.   What  the local  lan rule does is block all trafic from/to this ranges https://www.arin.net/reference/research/statistics/address_filters/         ... View more

Thanks again @MerakiDave, this worked out great. I had to take a methodical approach to cutting over specific VLANs first in prep for the guest and student network move, but with them all moved to their new home it appears to be working great. An ancillary benefit that i did not "ask for" but was one that was pointed out in the @NolanHerring response is in regards to impacts for roaming clients (this is looking much better now.) ... View more

Hmm Gotchas hmm Make sure your Meraki is on latest firmware. Some early build MX250/450s don't support /31 addressing until they're updated from factory level (you're running live already so no issues but will put in just in case a factory reset happens). If in Passthrough then your MX may end up doing the PPPoE authentication. If you have a static IP address assigned then best configure the WAN to USE that address rather than rely solely on PPPoE username and password. Check for VLAN tagging; in cases where you use static IPs only and no PPPoE authentication, then tagging must be watched out for on the Meraki. (We used Draytek V130 modems and had to tag the Modem + MX to get it to work.) Ensure your router that is soon-to-be in passthrough, doesn't do anything silly like operate wifi even though its a L2 device. I've seen a few boxes that despite turning it into a bridge, makes all wifi connections L2 (fails to find DHCP.. or worse.. finds them and allows wifi users onto the network without firewall protections.).. Don't ask me how that was achieved 😛 ... magic I guess. Once connection through other device is established run your throughput testing (Security Appliance > Appliance Status > Tools) disregard the result, but watch in the uplink tab to see a good measure of the bearer cct with device in the way. It should be limited to bearer speed and not to 1Gb which is the negotiated duplex between the passthrough router - MX. That's all I can think of for now, sorry if some of them are like teaching grandma to suck eggs. All came out in a big expositional dump XD ... View more

To add to what @PhilipDAth has written, bear in mind that smartphones and tablets are now used for Office/Google applications, in addition to laptops. Indeed I wish it was easier to carry out some actions on phones that are second nature on laptops and workstations. Kids, being kids, will detect any obvious chinks in security and exploit them. In my experience, getting a handle on phones is difficult. I have to visit certain sites where one leaves phones, computers, tablets, USB sticks, writing pads etc. in a locker before leaving the entrance lobby, because the security guys can't keep on top of BYOD kit or any device that goes off-premises. Just remember STUXNET. And the target machines in that project were air-gapped. Sometimes one has to ask oneself "how paranoid do I want to be?" The answer is always "a bit". So its a judgement call 😎 ... View more