We have a single campus with multiple VLANs all terminating on a single MS425 switch. The MS & MX networks are separate networks in the Dashboard. Almost exactly as it's done in the documentation example: Layer 3 Switch Example - Cisco Meraki Documentation   Now, however, we're looking to add ISP 3 & 4 (yes, 4 different ISPs!). However, I cannot seem to figure how to route individual VLANs to a different Next Hop IP.  The MS is 172.23.111.2, MX1 is 172.23.111.1 and the nex MX is 172.23.111.3   How can one tell the MS that 172.23.68.0/23 should route through 172.23.111.3 while 172.23.72.0/23 routes through 172.23.111.1 ?   ... View more

I'm not sure what I'm doing wrong with this. We have a department that is getting their own internet connection, so will have their own MX device (MX64W) with their own VLAN (104) in their location. However, they also need access to the internal servers on VLAN 68 which is on a MS425.   MX64W (.104.1) - LAN3 Trunk port allow 104 - MS425 has VLAN 104 - (.104.2) and VLAN 68 (.68.1)   I can ping from a device on VLAN 104 on the MX64W to the VLAN 68 and webpages hosted on 68 work. I know the routing works.   However...anything blocked in our Layer7 rules (it's a lot! slow internet with lots of users...) is also blocked on this static route. Joining the AD domain and smb file server doesn't work. The event logs on the MX64W tell me it's blocked. If I remove the rule, then things work, but that also allows it from internet as well.   How can I tell the MX64W to treat these static routes as internal LAN, and not firewalled? ... View more

We're looking to re-do most of our network firewall and network configurations. Combining separate MX, MS and MR networks into one combined network and re-evaluating our content filtering at the same time.   To do this, I've made a new combined network. Thought was to put all the routing rules, most of which won't change, into the new network and then add in the desired setup for the L3/L7 firewall and Content filtering. Once that is all setup, during off-hours, we can move the MX and other equipment from the other networks into this one and be up quickly as all the "hard" work has already been done.   Details...details...always the details...   Is there a way to "fake" a L3 capable switch so we can add the L3 interfaces and such? Apparently, one can't set any of those until an L3 device is added to the network. We're looking at almost the same setup as this: MX and MS Basic Recommended Layer 3 Topology - Cisco Meraki only most of our "downstream" setup isn't Meraki.   I suppose I could do most of the L3/L7 firewall rules and such, but then only add the Layer 3 interfaces & routing during the change over, but really didn't want to fight that at the same time we're taking the bulk of our network down.   Thoughts? ... View more

We're adding a couple of Z3 units to our organization. As I'm testing I noticed that my laptop only connects at 2.4GHz and went looking for the Band Steering settings, but they aren't there.   Am I missing something? Or do the Z3 units not support band steering? ... View more

So, I've been trying to block port 25 on our network.   If I don't have rules 5 & 6 then everything is indeed blocked on port 25. With rule 5 or rule 6 or both, then port 25 works for any system on the network. I'm confused, but also assuming that the issue is with me, not the MX. Help? ... View more

Due to severe bandwidth limitations we use a lot of blocking and content filtering. As such, we block video & music as a Layer 7 firewall rule.   However...we're configuring an Apple Caching server. Idea is that the caching server has more bandwidth allocated to it, the clients sign-in with Apple on a throttled connection then are redirected to the caching server for the payload. However, we have to unblock iTunes everywhere for it to work. (Ug)   I'd like to block this category, but allow only iTunes. The only way I've seen so far is to add the individual items in the group separately. However, this also defeats the purpose of the Meraki magic of dynamically updated lists. I don't suppose anyone has other ideas.   ... View more

We have a global bandwidth set to 7Mbps. I want to set a 2nd VLAN, on the same WAN1 connection, to use no more than 3Mbps; it's not per client. Whether there is 1 client or 30, no more than 3Mbps on that vlan.   Is this doable in any way, shape or form? Group policy when applied to a VLAN seems to be a per-client limit for each device in that VLAN. I'm not sure what else to try.   ... View more

We have a rather extensive list of content filtering, both allowed and blocked. Is there a way to add a comment into these boxes without breaking things?   I'm thinking something like: #Block Google - Not needed in our company google.com   #Block Microsoft - leadership's decision microsoft.com   #Block this cause the manager said to lego.com   ... View more