You can't @Dunky.  You need to either use VPN firewall rules to prevent the sites from talking to each other or use a VMX in Azure and make only it the hub.   Even if you use a VMX as a hub, all the sites will still be able to talk to each other, they'll just route via the VMX in Azure, so you would still need VPN firewall rules.   https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior  ... View more

Good morning.  I'm expecting any device that I assign one of my 13 user-assignable IP addresses to to broadcast that IP.  Currently, we have a Comcast coaxial modem that is connected to a switch for distribution of the IPs.  If I put any of those IPs into any of my Meraki equipment, they immediately broadcast that IP.  The issue here is that I have a Meraki behind a Meraki.  Perhaps the Comcast router (with the fiber) needs to be reconfigured?  As it is now, my /28 IPs are useless, as I can't remotely access them, nor ping them.   Old Comcast modem (coaxial w/13 IPs) <> switch <> MX250 (core stack) and MX64 (VPN) - Works perfectly, with all assigned IPs responding externally and each unique IP is broadcast.   New Comcast router (fiber w/13 IPs) <> MX68 <> switch <> MX250 and MX64 - Fails. Each MX250/MX64 both broadcast the same IP, with is the IP from the /29 assigned to the MX68.  The /28 IPs do not respond to pings or web access.   Thanks,   Jeremy  ... View more

Yes. I would just set them  as access port vlan22  ... View more

Yes it is.   Specifically, this is the SFP/SFP+ compatibility guide. https://meraki.cisco.com/lib/pdf/meraki_datasheet_sfp.pdf  ... View more

Thank you posting the update, saved me so much time from being on hold with support!!!!! ... View more

HI there,   Having just completed both the SNSA and SNSP courses, one of the things that was highlighted was to make sure only one end of the site has keep-alives active, unfortunately on the Meraki side there is no keep-alive option so you must make sure this is enabled on the Sonicwall side, also you might find playing with the MTU may also work. ... View more

Did anyone ever come to a resolution on USB modems?  Currently trying to get one of these Inseego / Feeny modems to work without much luck. ... View more

Don't have any docs I could find to indicate the limit.   Don't ask me how I verified this, but 500 L7 Deny Rules works!  ... View more

The impact to my MX250 environment may be minimal, as I use a separate MX64 to manage all VPNs and I use 1:1 NAT and no port forwarding, so a different IP (upon failover) isn't horrible.  For me, its more of a matter that all 13 of my static IPs on each circuit are being utilized.  So, I have to look to see what I can do to recoup one.  I'd prefer to do the virtual IP approach, but recouping 2 is not going to happen.  So, I'll go with the MX uplink option for now, and then likely change to the virtual uplink option when we change our primary ISP later this year.    Thanks for the good information, guys. ... View more

Yes.  I have all my Meraki endpoints (MX65) creating a VPN back to an MX64 hub at my DC.  Not ideal, as it masks the traffic across the VeloCloud network, but it is working.   Jeremy ... View more

I must admit, the MS120's had a bad start around spanning tree issues.  This was mostly back in the 9.x firmware days.  The 10.x code is pretty solid.   I would run with a stack as you network core. ... View more

Specifically, these are mostly web servers.  They just listen for inbound http/https connections. ... View more

Good to hear! ... View more

Thanks for your reply. I figured out on how to enable ICMP. I went to firewall,    ... View more

I have been told that if the account your MX product uses to authenticate to your DC has ANY special characters in it at all, that can cause WMI 100% CPU Usage on your DC.   FAIL. ... View more

Sorry I did not see you replied while I was writing 🙂 Glad to hear it‘s working now. I assume the switch finally got the configuration from the cloud. It depends on having clean access to the cloud to update itself. I generally recommend to bring it up first and then connect stuff to it since for example a server on the switch doing DHCP could interfere with the first boot (when it has no configuration yet). Regarding DNS: Yes it needs DNS. I think Meraki has a fallback in case DNS can‘t be resolved, they try very hard to get to the dashboard 🙂 I recommend configuring DNS server on the switches (and other Meraki gear) you can always reach, like 8.8.8.8 and 8.8.4.4 so you have clean DNS in case the tunnel or your server internally does not work. That‘s also why I recommend having a separate management VLAN, you can decouple management traffic from your normal traffic. Also security-wise it‘s easier this way, you could firewall off clients from the management address of your infrastructure by blocking traffic to the management subnet with a single firewall rule 🙂 Cheers! ... View more

Argh...  That is what I was looking for, but couldn't remember where it was at!  Thanks for pointing it out.  Unchecked it this morning and it worked just fine.   Thanks again.   Jeremy ... View more

Right, because it's the domain I'm running on my DNS server.    The devices will register in DNS if you allow dynamic updates on your DNS server. The domain suffix is provided as a DHCP option.  ... View more

We're having the oposite problem, we're having a bunch of cases where we Whitelist some urls and it is blocked by some categories, specially if it fits more than one category. @RodrigoCwrote: To Expand a bit on @MerakiDave's previous post, you can use THIS page to directly look up a URLs against Brightcloud's servers. If you see a site that is categorized there but is not getting picked up on your MX, call our support line and we'll take a look!   That being said, you should keep the following things in mind: Content filtering will only apply to new flows. This means that most changes will not take effect immediately. (KB suggests ~10 minutes) If the site you are trying to block is HTTPS, the MX will only be able to block that flow after the existing HTTPS session expires and the client attempts to renegotiate.  Make sure any clients you are testing with are not whitelisted or part of a separate group policy. For more common issues with content filtering, feel free to check out the Content Filtering Troubleshooting KB  We are having lots of problems like @DunJer622  we have quite big whitelists indeed, but the problems occours with new devices, that are suposed to have downloaded Full configs, but still some of the whitelisted patterns doesn't work. We use full list for sizing It is being a headache, we are thinkink about removing the rules based on categories and useing just Black/whitelisting. ... View more

@jdsilva Right, I thought he was asking if it had to be configured on each AP.  You are correct.  Setting applies to whatever SSID selected in the dropdown.   ... View more