From what I can remember (and from what I posted) this was fixed in MX 18.205. There were no additional error messages to check for, I tracked it down by running a constant ping to something at an affected site and matching up packet drops with the DHCPv6 renewal logs showing up in the eventlog. ... View more

The closest you can get is by going to Network-Wide -> Clients. Set the search filter from All to All Clients with a Policy.   Then you can Download As either CSV or XML. ... View more

If the only thing you're interested in is basic 802.1X/Radius (and you're a Microsoft shop), you could also look at Microsoft's Network Policy Server (NPS). We had it available as part of our Microsoft contracting, and it was a breeze to set up and configure. For HA, we just set up 2 NPS servers and mirrored policy configurations between them, then pointed our Meraki stuff at both of them.   ISE only for Radius is major overkill, IMO. Now, if you're looking to move into a more zero-trust security approach and have the budget/time to fully build out/utilize ISE's full suite of features, it's hands-down one of the better options. But just for radius? That's pulling a wagon with a semi. ... View more

Yes, I don't have a % failure rate, but API calls are not dependable at the moment. I also completely lost access to the dashboard itself in the past 10 minutes or so, it now times out when I try to even pull it up. ... View more

Appears to be possibly affecting API calls, too   EDIT: Appears to be heavily intermittent. I do have several MX's showing offline in the dashboard, but can confirm I can reach the 'offline' devices over the VPN.   @Meraki hasn't learned not to make changes on Fridays, apparently ... View more

Seconding BGP between the concentrators and your core(s)! We have a very similar setup - 2 DC's each with 2 hubs (each hub on a different ISP), DC's connected via dark fiber, with ~200 spoke sites participating in the AutoVPN. All the spokes are full-tunnel AutoVPN.   We have BGP stood up between the concentrators and the core L3 switches at both DC's, with the core L3 switches advertising their local supernet into the AutoVPN and receiving routes to the spokes from the AutoVPN. The BGP routes are redistributed into EIGRP, and the core L3 switch at both DC's share routes with eachother via EIGRP. We control/massage load by adjusting the hub priority on a per-site basis to spread the love between both datacenters (and between the concentrators/ISP's at those datacenters).   Prior to standing up BGP between the concentrators and the core switches, we were using OSFP and the 'local networks' to advertise the DC supernets into the AutoVPN. However, in this setup, if we lost one or both of the concentrators at one DC, the routes through that VPN concentrator never dropped out of AutoVPN and caused a black-hole situation. This may have been a configuration issue on our side, not sure.   One gotcha I remember having to chase up was getting Meraki support to stop the hubs from routing between eachother over the AutoVPN (instead of dumping traffic to the L3 core and letting it route across the dark fiber). ... View more

When can we expect the postmortem on this? What steps will be taken to try to ensure this doesn't happen again? ... View more

Throwing in a +1 here. We were fine until around 10:00 AM Central Time, then everything broke/blipped.   Luckily enough, we had one of four VPN concentrators running 18.107.X due to an issue with SSID tunneling on MX 18.2, so it picked up the load until we could reboot its buddies which are all on MX18.2.11.2 ... View more

You cannot 😞   If you want any sort of proper reporting on usage, you'll need to stand up a product to process Netflow from your devices. ... View more

This is *probably* way over-simplifying things, but we ended up with a similar situation at a couple sites. The way we handled it was using two unused VLANs to stretch the ISP connection from building A to building B, and vice-versa. Talked to the provider(s) to have them widen the subnet a smidge to handle 2 active devices, set IP's on WAN2 on both devices.   So, we have ISP auto-failover for both buildings, but not warm/spare in the event we lose one of the MX's; The idea being that one of our regional spares could be easily swapped with the 'dead' MX if/when needed. ... View more

Seems unlikely, but any chance your organization has more than 1000 networks? I know the Get Organization Networks API call defaults to a perpage value of 1000 if not otherwise specified. You can adjust the perpage value up to 10,000, if this happens to be the case. I don't see a similar limit documented for the other two API calls you mentioned.   Recently ran into something similar with the Get Organization Devices API call, except that one doesn't let you request more than 1000 and instead makes you learn pagination (bleh). ... View more

I asked via my ticket, but I got a pretty general answer. Not a direct quote:   Engineering implemented some back-end changes which inadvertently irritated SAML. The changes were backed out, which resolved the problem. ... View more

Ditto, seems to be working for my folks as well. ... View more

Spent ~30 minutes on the call while the rep looked into the problem. Had to bail due to a meeting. No progress made thus far. ... View more

Glad it's not just me. On the line with Support about it now, will post what we find out.   Note: We're on N426, incase this is a node specific issue. ... View more

Do you happen to have a bunch of Site-To-Site VPN Firewall rules? Or a small # of rules with a huge # of associated subnets/hosts?   We tried using Z3's in our network, and they worked pretty well for a year or two until we started building out VPN firewall rules. After some point, some critical mass, it was apparently too much for the Z3's to handle and they became very unstable after VPN connectivity blipped for any reason. ... View more

Seconding this. Put 0 faith in whatever it is Meraki is telling you is on your network, and absolutely do not use this information for anything related to security or auditing.   I have 3 Nintendo XBox 360s on my network that can attest to this 🙂   Went digging through the Knowledgebase to see if this is explicitly called out anywhere that the client 'device types' are just semi-informed guesses. Closest thing I was able to find for reference is the following: Applying Policies by Device Type - Cisco Meraki Documentation ... View more

Not much useful coming out of a packet capture. All I see are probes, no actual attempt to connect. Bummer. ... View more

Same problem here. Coworkers also reporting the problem. ... View more

Yeah, totally blank there too - no further attempts after the couple tries.   I agree, probably some device-side thing...just I'm not aware of any mechanism for that in Windows. Hoped casting a net on the forums might fish up some clues. ... View more

Culprit identified! Those date format strings are sneaky, would be lying if I said I'd never done that exact same thing. ... View more