This documentation has a great image showing how the process works.    https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise   So as long as your client can access the AP and the AP itself can access the Radius server you are all good.  ... View more

Check out this documentation for more detail information to date. Device Utilization - Cisco Meraki Documentation ... View more

Yes, we had 6450 7150 7250 to ms130 and 9300. We had a few issues with the 9300 with getting to the cloud and issues with spanning tree at the beginning. all steep learning curve. The MS130 are a dream to work with though. currently getting AP sorted  ... View more

I deployed a vMX in Google Cloud and ran into this same issue:   Non Windows devices can get into the VPN without any issue. Windows devices give Error 809 No real information in the Windows Event Log   Technically, the vMX is not natted.  It is setup as a one-armed concentrator, so the one NIC has a public and private IP address.  This is enough to confuse Windows though!   So I put the registry key in, and that solved our problem!   Thank you @alemabrahao  ... View more

2 years later. This still not been offered as simple whitelisting feature! Really Meraki? ... View more

I see we have a number of people looking at this old thread.   Since this was originally posted a new method is now available.  You can now configure certificate with username+password authentication with RADIUS. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#Certificate-based_authentication_with_Username_.26_password   You setup an Enterprise CA, and issue every machine with a certificate.  Meraki+AnyConnect will first check that the machine has been issued a certificate, and then check the users username and password.   You can also use AnyConnect+SAML+Duo, and use Duo device trust to verifify the computer is a member of AD or manually trusted. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#SAML_Authentication    https://duo.com/docs/trusted-endpoints   ... View more

I used this PS and it works. route is persistent.   Set-VpnConnection -Name 'VPN1' -SplitTunneling $True Add-VpnConnectionRoute -ConnectionName "VPN1" -DestinationPrefix 172.1.1.0/24 ... View more

Revising this old thread. I'm having the same exact issue when a client is behind a FortiGate firewall. Has there been any update on this? ... View more

I disagree, firmware updates have very little to do with security, maybe security of a device itself, but not the clients behind it. FortiGates will update signatures and bad IP lists and other things every 30min or so with FortiGuard subscription, or you can create custom feeds. Another HUGE security advantage of FortiGate is deep-packet inspection which Meraki can't do at all, given that over 85% of all attacks are encrypted. ... View more

It's clearly a typo for the word "deprecated." ... View more

Thanks for the solution. ... View more

I'm not sure about Google Cloud specifically, but most cloud providers (AWS/Azure) do not route private subnets behind the vMX (for example the client VPN subnet in this case) out to the internet. However, VPN clients are still able to access cloud resources if you configure routing correctly. You can (1) Split tunneling; or (2) Turn the vMX to NAT mode, which is the default mode when you first spin it up. More info here: https://documentation.meraki.com/MX/Other_Topics/vMX_NAT_Mode_Use_Cases_and_FAQ ... View more

thank you for that information ... View more

There are two parts to setting up a Site to Site VPN to a cloud like the AWS cloud.   Typically, you would need a VMX in the Azure Cloud and a physical MX   The instructions to set up the VMX in the Azure Cloud are here: https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Amazon_Web_Services_(AWS) and here: https://aws.amazon.com/quickstart/architecture/cisco-meraki-vmx/   Once you have set that up, you may need to add routes in the AWS route table so packets can find their way back to the Site to Site tunnel.   Once the tunnel is in place and the servers can be pinged from the LAN the physical MX is on, then you should be able to access your server in AWS.  You could also configure a Client VPN on the physical MX so remote workers can access the servers. ... View more

Thanks Charlie. Just supporting your information adding that our switches have this behaviour also. Whilst we were resolving another issue regarding a DNS change in our network it is something that baffled us when it appeared in our logs. ... View more

@JimboinTexas    Changing settings for the WAN should be done on the local status page only.   Once that is done, you can create a network in the application by clicking on the WiFi button at the bottom of the screen.  There you add your subnet.  Give the subnet a name and the GX an address ending in .1 with a subnet mask of 24.  Disconnect any clients and reconnect them so they get the proper address and DNS information for the network.   To setup a reserved address: Go to Settings (the gear) Click on Advanced Settings Click on Local network addressing.  Click on you network Click on the small arrow on the right hand side of the screen.  Click on the round bubble that says Reserved IP Addresses Click on the + for Reserved IP Ranges and enter a range Click on + for Device Reservations to reserve an address in the above range. -Dave ... View more

  Hi I've linked a GP to default VLAN that block some subnets used in auto-vpn. all seems configured in the right way but I'm still able to access to the resources I want to block ... any suggestions ?   Thanks   ... View more

This is the Meraki MX sizing guide (so you can come to your own conclusions). https://meraki.cisco.com/product-collateral/mx-sizing-guide/?file    The MX needs to track the state of every device flowing through, and this requires a bit of RAM and CPU grunt.   Only get an MX68 if you like having crashes, intermittent outages, lots of grief and no support from Meraki because you haven't followed the sizing guide. ... View more

Yes, the per-port VLAN settings are the settings on each port on the MX105. As you can see all the MX ports are set as trunks (so they carry multiple VLANs), with a Native VLAN of 1, and all VLANs allowed. To get you up and running these are the same settings that you should use on all the connections between MX and MS, MS and MS, and MS and MR. ... View more

I'm guessing EE have got IPv6 to IPv4 working properly then, which is good 👍 ... View more

@Bruce    Thank you.  I just opened a support case for that!.   -Dave ... View more

It has come back up for me now.  It must be transient issues and it has happened a couple of times now. ... View more

@DHAnderson the vMX runs as a virtual appliance within Azure, so it uses a standard Azure compute instance, most likely a 'Standard_F4s_V2' (but could be a 'Standard_D2_v2' or 'Standard_D2_v3' too). This means you are paying for Azure compute charges just as you would for any other server in Azure.   You can use the Azure pricing calculator here, https://azure.microsoft.com/en-au/pricing/calculator/, to determine a rough idea of what it will cost for the compute platform, it various between country and region. You can also use the calculator to estimate data transfer costs.   Whether you use an ExpressRoute or an AutoVPN to a Meraki vMX really comes down to the expected transfer of data out of Azure - it costs less when using ExpressRoute. When you start transferring more than about 1TB to 1.5TB per month out of Azure then you need to consider ExpressRoute (that's assuming the vMX can do the bandwidth you want). That's based on my calculations, but I'd advise doing them yourself for your region. ... View more