I would recommend putting it in 802.1q trunk mode and allow your management VLAN and production VLAN over the trunk (I typically allow all VLANs across the trunk and only allow access using the VLAN tagging option on the SSID; this comes in really handy if you want to assign a group policy to a device to put them in a different VLAN when connected to the same SSID).   On your 4948 you can configure the port with switchport trunk native vlan (ManagementVLAN), and then make sure you do not tag the VLAN on the AP configuration page (Wireless > Access Points > Click on the AP > LAN IP (edit button)). You will also want to make sure that you use VLAN tagging (Wireless > Access Control)  to ensure that your users are going to be in the prod VLAN.   -- CMNA Certified ... View more

This sounds like a DHCP server configuration issue or an issue with your DNS server.   Wireless Configuration: What mode do you have selected under Addressing and Traffic? (NAT mode, Bridge mode, L3 Roaming, L3 Roaming + Concentrator, or VPN) (Wireless > Access control) Are you using VLAN Tagging? If so, are both SSIDs associated to the same VLAN? (Wireless > Access control) Do you have any firewall/traffic shaping rules enforced on these subnets? Bandwidth limits defined? (Wireless > Firewall & Traffic Shaping) What kind of devices connect to these SSIDs? How many? Do you have any Network-wide group policies assigned by device type? (Wireless > Access control) Servers: Have you checked the DNS Server scope option on the DHCP server for the subnet(s) associated with the 2 SSIDs that are experiencing issues? Have you checked the resource utilization on your DNS server(s) to make sure that your CPU and Memory are not being heavily utilized? (this was a culprit to a similar issue I experienced not too long ago...)   ... View more

Are you using the DNS address to connect or the IP address? Do you have any other 3rd party VPN software installed?   You may want to check out this article here: https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Windows_Error_789   See below: Windows Error 789 Example event log entries: Jul 2 13:53:20 VPN msg: invalid DH group 19. Jul 2 13:53:20 VPN msg: invalid DH group 20.   This issue may also result in no event log messages, if the client's traffic doesn't successfully reach the MX's WAN interface. Possible causes and solutions: Incorrect secret key (pre-shared key in Windows) Solution: Ensure that the shared secret is configured correctly on the client machine. It must match between the MX and the client. More information about setting the shared secret can be found in the links at the top of the page. Firewall blocking VPN traffic to MX Solution: Ensure UDP ports 500 (IKE) and 4500 (IPsec NAT-T) are being forwarded to the MX and not blocked. If traffic cannot reach the MX on these ports, the connection will timeout and fail. IKE and AuthIP IPsec Keying Modules disabled (Windows only) Solution: This occurs most often when 3rd party VPN software has been installed and disables the IKEEXT service. This can be re-enabled by navigating in Windows to Control Panel > Administrative Tools > Services. Find the service named "IKE and AuthIP IPsec Keying Modules" and open it. Change the Startup type to "Automatic". If this automatically reverts to "Disabled" or fails to start, it may be necessary to remove the 3rd party VPN software: ... View more

It looks like the policies should be applied in passthrough mode. It would be worth a try; however, I would recommend creating DMZs and NATting to private IPs to allow for more firewall rules to be managed more easily.   "An MX/Z1 in passthrough mode can be configured to perform a number of functions like when in NAT mode. However, the appliance acts as an invisible third party, only touching traffic when required by a configured function. It can passively perform intrusion detection and collect statistics about traffic passing through it without taking action. It can also perform traffic shaping and content/security filtering functions to intercept and manipulate traffic as needed:"   https://documentation.meraki.com/MX-Z/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z1_Teleworker_Gateway ... View more