I use ISE and and 802.11r is available...  PMF aka 802.11w will disable 802.11r   Protected Management Frames (802.11w) can be used to prevent client spoofing, but when it is required Fast Roaming (802.11r) is not supported. ... View more

It's a bit hard to assist remotely, but I can make some suggestions. Was the site survey done as a 'predictive' survey, or did you have one done after all the access points were installed and configured. If you haven't had an active site survey done since the installation you should really do that to understand what the RF looks like. You should also do a new site survey if there have been any changes in neighboring buildings or their occupancy (new tenants can mean they're generating new interference). You also need to look at the capability of the devices you're using. If they can all make use of 802.11a/g/n (i.e. no 802.11b) then you should be setting a minimum bitrate of 12Mbps - this disables 802.11b which will improve overall performance of the network, which you need for VoIP (802.11b is unsuitable for wireless VoIP). What's the approximate distance between access points? Are they mounted on steel beams or similar? ... View more

You cannot configure a non-Meraki switch thru the dashboard. You would have to configure that the traditional way (cli, etc).  the obvious advantage of all-Meraki stack is that you’d get complete visibility thru the dashboard.  ... View more

Thanks this is perfect and puts my mind at ease. ... View more

Also, is it possible that the client device is using randomized MAC addresses? https://community.cisco.com/t5/security-documents/random-mac-address-how-to-deal-with-it-using-ise/ta-p/4049321    ... View more

If the trunk to your AP is correct, and the SSID is in bridge mode tagging everything to VLAN 20, which it sounds like it all is, then the next area to check is your DHCP setup, and make sure you’ve not accidentally created a bridge between VLAN 10 and VLAN 20. ... View more