There are various threads already bemoaning the lack of inbound firewall rules for Non-Meraki VPN Peers (bump for Product Management to take a look at that please), but rather than just pile-on, I wanted to see if anyone had got this working by way of workaround.   Scenario: We have an MX in the office that provides Client VPN (native and AnyConnect) connectivity to the office/server environment (while we all work from home), and we want to add a Non-Meraki VPN peer to allow all our internal systems to access a SaaS solution.  From a security perspective though, the traffic that could originate from this SaaS provider is a complete unknown and we don't want to to open our network up to takeover via a 3rd party, but without inbound VPN firewall rules this isn't possible with the MX.   The Workaround: Could I install another MX in a different 'organization' behind the Office MX, let's call this the DMZ MX, and then configure the DMZ MX with 2 non-Meraki VPN peers, i.e.: 1: (Office MX) <-- (DMZ MX) 2:                          (DMZ MX) --> SaaS   This would allow the DMZ MX to specify what is allowed outbound to the Office MX.  From the Office MX side I would configure a static route to the SaaS IP subnets via the DMZ MX IP address, allowing me to address the SaaS provider systems as if it was a direct VPN tunnel.  Presumably then traffic originating from the SaaS provider's network will be treated as 'outbound' then it egresses the DMZ MX in the direction of the Office MX, allowing firewall rules to be applied.   The main complication that I can see if that I I only have one internet connection and a single public IP, so I would need to create a VLAN on the Office MX and plug the DMZ MX into it for internet connectivity (and add firewall rules to prevent the DMZ MX from accessing the internal subnets).  Presumably I may then also need to open some ports inbound on the Office MX to allow IPsec tunneling to the DMZ MX.   Has anyone tried this? Did it work? Any gotchas? ... View more

Sorry for the n00b question, but I cannot seem to get a straight answer on this from a Meraki rep or any of the online documentation:   Is the Twinax stacking cable with SFP+ connectors (https://meraki.cisco.com/product/switches/switches-accessories/switches-accessories-twinax/twinax-cable-with-sfp-connectors-3m/) a different part to the standard stacking cable (https://meraki.cisco.com/product/switches/switches-accessories/switches-accessories-stacking/stacking-cable-3m/)?  If, so is there any advantage of using one over the other? ... View more

I've got an MX65 (with the 2 WAN and 10 LAN switch ports onboard) and an MS120-8LP switch daisy-chained off it to provide more switch ports.  I'm only running a single VLAN and IP subnet, the MX is in 'Routed' mode and I have client tracking configured to use 'MAC Address' - which seems to be right as the MS120 is not a L3 switch, and it's the only option available in my Dashboard.   When I open the Dashboard > Network-Wide > Clients (Default filter: All clients), I seem to only see the clients that the MS120 switch is aware of.  Generally speaking the detected OS information is pretty accurate, but there is only very low amount of traffic ascribed to client devices that are attached to the MX's LAN ports (presumably just broadcasts).  If I click on any of these clients, the 'switch / port' value shows that they are connected to the MS120 port that is trunked to the MX65 - which is accurate from the switch's point of view, but odd for a network-wide view.   I have to change the filter on the Clients page to 'only security appliance clients' then I see those client devices correctly, but oddly the client details don't seem to be shared with the switch's clients, e.g.: I have renamed my clients to have informative names (like, 'Lounge Room PS3').  This view doesn't reflect those names, and just shows the MAC address There is no topology information, so I have no idea which port on the MX65 these devices are connected to. There is no cable test option, presumably because the MX65 is an entry-level appliance and doesn't really combine a full MS switch's functionality with the MX's security appliance software. The OS information is much more accurate than the MS switch's client view, e.g. 'PlayStation 2' is now a 'PlayStation 3', 'Other' is now correctly identified as 'Windows 10' or 'Ruckus Wireless'. Is this lack of network-wide (combined MX/MS) view of clients normal for the equipment combination I have?  Or have I stuffed something up?   Is the client OS guessing semantics different for the MX vs. MS?   It cetainly seems a bit misleading that the 'All' clients filter isn't really all of my client devices, which makes it much harder to get a true picture of a client devices usage and location in the switch port topology.   MX65 firmware: MX 14.40 MS120-8LP firmware: MS 11.31 I can post screenshots for examples if anyone is interested, as this is just my home lab environment. ... View more