Is the VMX configured to push a profile when connecting (and maybe overriding the setting change you made)?   Is the VMX running current stable or newer firmware?  There has been a lot of AnyConnect fixes and updates in the firmware.   Are you running a recent AnyConnect client?  I think 5.1.3.62 is the current release. ... View more

Thanks guys. I appreciate the quick responses. ... View more

Welcome to the Meraki community @Swirve Happy to have you. There are a lot of good resources on this community board. I think you'll find a lot of information here. If not you can always ask in the community. There is always someone with a good answer. ... View more

What's the bet it is something to do with MAC randomisation.   The Android starts off using a private MAC address, gets a DHCP address, and then changes to a non-private MAC.  That would make it look like two different MAC addresses where trying to use the same IP address. ... View more

thank you victor for your response.. just another suggestion, after re-schedule performed, the newly date of firmware upgrade date could popped up and renew/refresh the old one. Due to the popped up notification could be seen once we access the dashboard and potentially be a misleading information.. cheers  ... View more

Client VPN IP assignment is not using DHCP. So it cannot reserve the IP address  ... View more

Thanks. I had a brief chance to troubleshoot and actually the route to 172.17.88.0 works, I wouldn't swear I fully tested that before as I might have assumed that if one route worked then so would the other.   Doing a network wide packet capture for ping to 172.17.1.1 shows the packets being received but no answer.   But that's the same taking a capture for ping to 172.17.88.1 which does work, only the ping request is seen, I guess because the reply comes direct from the Mikrotik on 217.2 to my PC 217.10. ... View more

The URL  www.msftconnecttest.com/redirect redirects to the MSN website. So it most likely it's the default website of the browser like Edge.  In the Access Control page for the SSID, there would be a setting "Captive portal strength". You may set it to 'Block all access until sign-on is complete' and it may help to force the device to open the splash page ... View more