Hello @RaphaelL,   I will take back my previous response, as it does not seem we are compliant with RFC 5798 as you correctly pointed out. Thanks for that! Implementation of VRRP for HA is limited within MX product models and we don't use it for communication with another vendor for VRRP. We are not claiming that we are VRRP compliant, we just provide HA for MX and MS with our implementation. Apologies for the error everyone, I have added the feedback to the documentation already as stated earlier. ... View more

Hello @RaphaelL and @Jedediah_Jumbl,   Linked documentation is related to the switch warm spare and the mentioned virtual mac addressing scheme (88:15:44) is exclusive to switches. For MX devices virtual mac will be starting with first three octets as cc:03:d9 as mentioned earlier. According to RFC, the first 3 octets are derived by OUI, and from OUI lookups cc:03:d9 and 88:15:44 are Cisco Meraki. Hence, RFC is followed. @Jedediah_Jumbl I will add feedback in the MX warm spare KB to add that cc:03:d9 will be the starting virtual Mac address of the MX, similar to the lines that are seen in the MS warm spare KB.   ETA: This is incorrect. Please see my new response below with the correct and updated information. Thanks, and sorry for any miscommunication here!  ... View more

Please open a case with Meraki Support so they can identify and attach it to the parent bug and inform you when a resolution is available. ... View more

Hello! As stated above MR will bypass the L7 rule if there is a matching allow rule for the IP address in the L3 rule, so only wireless clients that connect to MR will be able to access the IP address.   Unfortunately, MR L7 rules don't have an option for country block, so you don't have option block Australia and then allow one IP address in L3 rules. MX L7 rules are all or nothing type of configuration, so you would need to remove geo-block for Australia which is what you have done already. However, it will be a good Feature to that will allow certain IPs from geo blocked countries, I encourage adding a feedback on the dashboard via Feedback button.  ... View more

Hello!   Do you mind opening a case with Meraki Support? An NSE can help with scoping and identifying this known issue. ... View more

Hello! If you need any assistance with packet captures and verifying tunnel connectivity, I recommend opening a case with Meraki Support so an NSE can also help with the investigation. ... View more

Hello! Please have a look at the configuration article below to confirm roles are created for each device type as required. E.g, you can add a role for switch event logs and make changes like cycling a port to see if syslog gets generated and gather packet capture to confirm.   https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration#Configure_Dashboard   Further, are you able to ping the Syslog server IP address? This is just to ensure network connectivity. I recommend opening a case with Meraki Support or calling us so an NSE can help with troubleshooting your issue effectively. ... View more

@Alain_Bensimon Have you tried using servername.domain.local (fqdn)? Or are you using servername? ... View more

@Alain_Bensimon Curious to know if you can ping the DNS sever from the client VPN host and what packet captures taken on the client vpn interface show when you are trying to reach via hostname. Also, check if the local firewall on the DC is blocking non-local subnets like 10.69.69.0/24. ... View more

@donh_sbht Please let me know what error you get when you attempt to enroll the device. Refer to the documentation to check if device is being enrolled correctly.   > https://documentation.meraki.com/SM/Device_Enrollment/Enrolling_Devices#Windows ... View more

Hey Boyan,   You are correct, the license will apply to the entire organization.   Once you add in the enterprise license for SM (for activating new features) in your organization it will automatically upgrade the entire organization from Legacy to Enterprise and the process is irreversible.    To answer your question, you cannot add paid licenses without converting. Legacy and Enterprise models will not co-exist in an organization.   You can create a new organization and apply the paid license to the new org. After that, move (re-enroll) devices that need to use the enterprise features to the new organization.         ... View more

Greetings,   Client IP conflict events cannot be disabled. These events are generated if the MX has observed traffic from multiple MAC addresses, using the same IP address.     ... View more

Greetings,   The VRRP MAC address (virtual mac address) is used by both MXs in the HA pair and will be a part of the VRRP process. LAN of both MX will use this virtual mac address instead of a physical MAC address. The First 3 octets for the virtual mac address will be "cc:03:d9" and is based on Primary MX.   The VRRP MAC address is shared by both MXs for LAN communication. Clients on the LAN will associate this shared MAC address with the MX's LAN IPs. As such, in the event of a failover, LAN clients won't need to update their ARP table with a new MAC address.          ... View more