Hi Daniel, how is the SSID encryption configured? Are you using "WPA1 and WPA2" or "WPA2 only"? I am asking because according to your screenshot, your clients are trying to connect with WPA1. We have observed the same messages in log with iPhones, which always try to connect with WPA3 on our local auth SSID. ... View more

Hi, the current performance capabilities of the MX devices are listed here: https://documentation.meraki.com/MX/MX_Sizing_Information/MX_Sizing_Principles Unfortunately, the MX600 is no longer listed there as it is out of sale, but if I remember the datasheet correctly it was capable of handling 1gbps VPN traffic with a maximum of 5000 tunnles, right? So the increase in performance with the MX450 compared to the MX600 is significant.   ... View more

Hi ksumann, I had the same issue with a large organization. As a workaround I have rescheduled all the scheduled networks firmware upgrades on a specific time via API. So you can upgrade your networks on the minute precise.   Edit: We are using this API call to reschedule the firmware upgrade in every network: https://developer.cisco.com/meraki/api-v1/update-network-firmware-upgrades/ ... View more

Hi Shankar, does this message also appear when you are using a private browser window? Have you made any changes before this error showed up? Because my organizations are working fine. I had a similiar issue last week where I screwed up a networks configuration. Unbind and clearing the networks configuration solved it for me. ... View more

Hi, the device will continue operation if it loses its cloud connectivity. If the device loses connection with your change, it will revert this configuration change automatically: Safe Configuration  Safe configuration means that “the device has connectivity to cloud and hasn't rebooted for 30 minutes following a configuration change.” That is, the safe configuration is the last configuration the device received from the cloud that was not followed by a reboot within 30 minutes.  MS switch If the configuration is safe MS switch will never reboot If the configuration is not safe MS switch will try to obtain an IP address on an alternate VLAN and then connect to the cloud through that alternate connection MS switch will revert to previous safe configuration 2 hours after lost connectivity After reverting to a safe configuration, the former configuration will be marked bad Source: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Behavior_during_Connection_Loss_to_Cisco_Meraki_Cloud#MS_switch   In worst case you have to change the IP on the local status page: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page ... View more

Then I am unsure if I understood your ISP setup right. Placing a dumb L2 swich between both MXes and the ISPs routers should not create loops. At least not on MX side, as the broadcast domains of the MX WAN ports are separated. But placing a single switch between your network and the ISP is creating a single point of failure.   In my opinion, you could use two spanning tree capable L2 switches, to make this setup redundant. The cabling could look like this: Juniper 1 -> WAN-Switch 1 Juniper 2 -> WAN-Switch 1 Juniper 1 -> WAN-Switch 2 Juniper 2 -> WAN-Switch 2 WAN-Switch 1 -> MX 1 WAN-Switch 2 -> MX 2 WAN-Switch 1 -> WAN-Switch 2 ... View more

Hi Joshua, yes, you are right, both MX need their own active Internet connection. They don't sync their configuration over LAN. Breakout switches between the MX75 and the Internet connections would solve your problem, with both Internet uplinks and both MX WAN 1 in the same VLAN.   With this setup you also would be able to use the virtual IP feature for seamless failover.   But make sure your internet switches are not creating any single point of failure.(For example, what happens if primary Juniper port 2 fails?)   Greetings, Marvin ... View more

Hi rhamersley, Is connect failure policy closed on your your client? Then captive portal remediation must be enabled to connect to wifi with captive portals. I hope this article can help you fixing your problem: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/admin/guide/b-cisco-secure-client-admin-guide-5-0/configure_vpn.html#topic_B5459554778A483BBDB929E1F250E8CE ... View more

Hi Shubh, when your MX is placed on an ISP connection with Carrier-Grade NAT this can result in this error. This document describes possible workarounds for your issue: https://documentation.meraki.com/General_Administration/Service_Providers_-_SPs/Carrier-Grade_NAT_and_Meraki_Auto_VPN ... View more

Yes, these calls have been added. GET https://api.meraki.com/api/v1/organizations/:organizationId/appliance/trafficShaping/vpnExclusions/byNetwork and PUT https://api.meraki.com/api/v1/networks/:networkId/appliance/trafficShaping/vpnExclusions With this body: {   "custom": [     {       "protocol": "<string>",       "destination": "<string>",       "port": "<string>"     },     {       "protocol": "<string>",       "destination": "<string>",       "port": "<string>"     }   ],   "majorApplications": [     {       "id": "<string>",       "name": "<string>"     },     {       "id": "<string>",       "name": "<string>"     }   ] }   For some reason I cannot find this call at https://developer.cisco.com/meraki/api-v1/ , only in the postman collection.   Greetings, Marvin ... View more

Hi Juraj, have you tried rebooting the MR28? In documentation there is a note stating: "Note: It might be necessary to reboot your APs to clear Group Policies inherited from respective iPSKs after changing the SSID authentication type from iPSK without RADIUS to a different authentication method.". https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_without_RADIUS Maybe this is necessary after what you have changed on your SSID. Greetings, Marvin ... View more