As @PhilipDAth mentioned, have you verified whether the fiber connection is single-mode or multi-mode and whether or not you've got link lights?  -Edit- Just saw your response posted a couple of minutes before this one.   Our experience is that the Dell PC switches tend to have connectivity problems when the SFP's aren't identical on both ends of the link.  I don't recall ever trying the Meraki SFP's in a Dell, but they may work just fine.   Something else to consider about the Dell PC62xx's is that Trunk ports can't have a native VLAN, so any untagged traffic is dropped.  From the looks of your setup, this shouldn't be a problem, but a quick packet capture would verify whether the traffic is being tagged correctly.   If you need to allow untagged traffic on the Dell, I believe you can change the port type to General and assign a PVID (same thing as a native VLAN on a Cisco Trunk port).   We've got a dormant PC6224F adjacent to an MS250, so could test the connectivity between them with our spare MA-SFP-10GB-SR's if that would be helpful.   Hope that helps 🙂    ... View more

Do any of your new VLAN subnets overlap the current 172.17.5.0/24 subnet? Also, can you successfully PING all of them from the current LAN? ... View more

Have you tried disabling the default traffic shaping rules and entering a custom expression for the hostnames backblaze.com and backblazeb2.com (without the *.wildcard)? ... View more

We've seen the same thing for multiple sites running MX 13.33. No evidence of blocking in Security Center or Event Log from the Dashboard, but we were able to look at the syslogs and find where a download was blocked. Opened a support case about it in late August. They asked us to toggle AMP, and the problem cleared up immediately. Until we upgrade to MX 14, we've just continued to do the same thing when the issue pops up. ... View more

We've got several AutoVPN sites on DSL/Cable along with several more on enterprise fiber and have seen this same VPN tunnel flapping behavior on occasion.  I've always assumed it was the lifetime timer expiring and tearing down the tunnel due to an absence of interesting traffic, but never examined it any further since it didn't affect operations.     While this may not apply to a Meraki AutoVPN connection, here's a Meraki document on IPSec VPN Lifetime settings that may help out if you've got a connection to a non-Meraki peer.   ... View more

@jared_f wrote: I would look into USB tethering. I believe it was released in iOS 11 last year. This little tidbit was a HUGE help when used in conjunction with @BlakeRichardson's advice above!   We had a managed iPad Pro become disabled by a user entering the wrong lock screen code too many times.  Also rebooted, so it wasn't connected to WiFi.   To add a little more fun into the mix, the device profile also didn't allow pairing with hosts, so it couldn't connect to iTunes nor would a connection to Configurator erase the passcode lock (even though it's the same MacBook used to enroll the iPad into DEP/ABM).   For others who've never had the pleasure of working through this problem, the recovery steps we used were as follows:   Release device from management in Apple Business Manager account. Boot iPad into recovery mode. (not sure that's necessary, but it worked for me.) Connect iPad to MacBook Pro via USB-C to Lightning cable and enable Internet Sharing on MacBook via USB-to-iPad connection. Open Apple Configurator 2 and erase all content & settings of iPad. Again, in AC2, prepare iPad for MDM. Assign iPad to Meraki MDM Server in Apple For Business account. Proceed with set up on iPad and allow it to re-enroll in Meraki SM network. Reassign and push original settings to iPad from Meraki SM Dashboard.     Thanks again for the USB tethering suggestion.  That was the missing link that allowed the iPad to phone home to Apple and get released from management so we could re-image it.   ... View more

@Rylock217 wrote: Unfortunately I've followed those instructions multiple times and am still getting the failure to connect. Does your primary LAN connection location in Windows happen to be set to Public?  Seem to remember that being a random problem on a remote user's Win10 laptop a while back, but can't remember the specifics. ... View more

@Jacko wrote:     I've successfully enrolled an iphone7 using VPP device assigment and its actually very fast to install all the apps. But, again, the issue of backing up things like sms, contacts, photos etc is forefront of my deployment dilemmas.   While you've likely considered these things, I wanted to mention a few quick thoughts for others who may stumble across this thread later.   It seems the biggest potential issues caused by using a single, common AppleID for iCloud backups might be:   5GB storage per account With more than a couple of devices backing up photos to the same iCloud account, this limit may be reached very quickly. Account Device Limit Apple states there is a 10 Device limit per account, but not sure how strict they are about this. Co-mingled data When using a single AppleID across multiple devices, it's possible that an individual device's Photos, Notes, Reminders, etc...will be placed into a single bucket in iCloud, then sync'd with all other devices.   iMessage mayhem when using a single AppleID across multiple devices, it's possible that a user can also select another user's device for Text Message Forwarding or to Send & Receive.   How might this affect Mac Messages app users? Keychain How might Keychains be affected by using a single AppleID?   Certainly food for thought 🙂  ... View more

I've never tested how they work with iCloud since we don't use it, but am interested to find out.  I'll try to find a few minutes this weekend to look into it further.   Update: Logged into our Apple Business Manager account, created 2 separate managed AppleID's, then used them to log into one of our DEP Supervised iPads.  Set up iCloud backup & ran it, then logged into iCloud via a PC web browser and was able to see photos, etc... as expected.   From this very limited test, it seems to me that, if you're in a situation where you've got DEP Supervised devices, but need each user to also have a unique AppleID for the purposes of VPP licensing, discrete iCloud backup of photos, etc..., the ABM account is the way to go for managing them.   I'm curious to know if these managed AppleID's will actually sync with SM so they can be assigned as device owners and VPP Users without having to create them in SM first.  As of yet, mine aren't showing up, so I'm thinking not. ... View more

@Jacko wrote: The other benefit of having iCloud sign in is tracking. SM is laughably bad at showing the location of a device. I mean, ssoooooooo bad they should probably remove it. I have almost zero faith in SM’s ability to geo locate, I had to abandon the geo policies I set up as they constantly got it wrong and it’s embarassing to ring an employee and ask why they are literally 100s of miles away (according to SM) and then they walk into your office, phone in hand with a quizzical look on their face. ooops! Check out the SM Location doc to determine the method your devices are most likely using to approximate their location.  I suspect that, since your devices have cellular data capabilities, the discrepancy comes from a combination of factors such as lack of GPS signal, cellular carrier IP geolocation, VPN/Proxy, location services disabled, etc...   To keep our users from disabling location services on iOS devices, we had to manually enable restrictions on the devices, then restrict the ability to change location services settings.  This was a manual process that couldn't be performed by SM, and had to be re-enabled after the iOS 11.3 or 11.4 (can't remember which) update broke it.  We also had to make sure the SM App was installed and that it was allowed to use the device location before the restrictions were enabled.  So much for hands-off deployment, huh? 😄   I think it's also worth noting that the disparity you see between SM and iCloud device locations is intended as such by Apple, and would likely be an issue regardless of the MDM system being used.  Perhaps others with more experience in this regard can chime in.  These Apple privacy restrictions probably have something to do with why OneDrive for Business won't allow camera uploads from the iPhone app (but that probably belongs in the other thread...).   ... View more

@Jacko wrote: Thanks. i did read that upgrading DEP to ABM only allows management of AppleIDs for actual users of ABM not general employees, which if true is a damn shame ☹️ I think maybe I misunderstood your situation 🙂   Who owns the devices and associated AppleID's; the end user or the company?  Are the devices actually enrolled in an Apple DEP account?   If both the AppleID and device are corporately owned and you have an ABM account, you should be able to create managed AppleID's under your registered domains and assign different roles to them; all from within the ABM dashboard.  These managed Apple ID's are considered ABM Users due to their creation under an ABM account, but should operate much like a standard Apple ID.   I've never tested how they work with iCloud since we don't use it, but am interested to find out.  I'll try to find a few minutes this weekend to look into it further.       ... View more

@Jacko wrote: Thanks, i'll make the config alts now.   What about backing up of devices though? Without a signed in icloud account the device won't get backed up and that could be an issue due to photos, notes, contacts etc. We use Office365 and SM pushes the outlook app to devices. Would it be possible to use the same managed icloud account for each device, just so they back themselves up i wonder? We don't use iCloud for backups, so can't offer much insight there.  It should be easy enough to test, though.   Since you already use Office365, have you evaluated whether or not OneDrive meets your backup requirements?   If you find it necessary to continue using multiple AppleID's for your devices, I'd suggest checking into upgrading our DEP account to a new Apple Business Manager account.  May make managing multiple AppleID's easier for you. ... View more

@mmmmmmark wrote: @Jacko wrote: Further to this, if we truly don't need AppleID's, is there a part of the SM policy where i can disallow an iphone user from actually signing into their appleID so that they cannot install their own apps? I've not tested it, but this should prevent the users from installing their own apps.   Unfortunately, I believe this setting will also prevent Meraki SM from installing apps on iOS devices, so it must remain checked.  I vaguely remembered reading @Melissa's post in an earlier thread, so all credit goes to her 🙂 ... View more

@Jacko wrote: Further to this, if we truly don't need AppleID's, is there a part of the SM policy where i can disallow an iphone user from actually signing into their appleID so that they cannot install their own apps? For non-DEP devices, you should be able to disallow the use of the iTunes Store under the iOS Restrictions section of your profile and get the desired result.   For DEP/Supervised devices, you can also whitelist or blacklist apps depending on your needs. By whitelisting a group of allowed apps, users won't be able to install/use anything that's not included.  I've also found it very handy to use the blacklist feature to automate the removal of those pesky pre-installed iOS system apps such as iTunes Store, App Store, News, Tips, Find Friends, GarageBand, etc...   ... View more

@Jacko wrote: I have VPP all setup and have loads of purchased apps in VPP. So if i acquired all our free apps through VPP also, it would allow me to silently configure an iphone fully without the needs for creating employee AppleIDs? Hi @Jacko   If you already have VPP configured & sync'd in your dashboard and you are using Device Assignment vs User Assignment, then yes.     Meraki has made this type of installation very easy by using device tags in conjunction with each app's Target Scope to automate installation on specific devices.   Let's suppose you want to install Google Chrome on several (but not all) devices. By creating and applying a device tag such as APP-Chrome to the desired target devices, then setting the Chrome app's Target Scope to install on devices that contain all of the following tags :APP-Chrome, it will silently install on all devices within scope and will not prompt for credentials.   This isn't to say that the same thing can't be done when licensing by User Assignment or Redemption Codes, but we don't use those, so I don't know the specifics of those methods.    For reference in case anyone else needs it, here's a link to the Meraki documentation:   https://documentation.meraki.com/SM/Apps_and_Software/Using_Apple’s_Volume_Purchase_Program_(VPP)_with_Systems_Manager         ... View more

Meraki Cloud auth. Also using DDNS Hostname of MX instead of IP. ... View more

I'm able to connect from a device running iOS 11.4 without issue.  Just went to that network to verify the MX65 is running MX 13.33 with Advanced Security.   ... View more

We've got a customer with that exact hardware configuration, but with a public IP.  Never had any issues with the Client VPN.   If you haven't tried this already, on your Comcast router you can navigate to Gateway>Firewall>IPv4>Custom Security settings and temporarily disable the entire Comcast firewall feature, then try your client VPN connection again.   Hope that helps.     ... View more