We have had some issues with the clients connecting, but it appears to be unrelated. While looking into the issue, it was technically observed.   I would imagine more sources of interference would be visible to the MR56's rather than smartphone.  ... View more

Got it. Thank you for the explanation. ... View more

Thanks @indra. I would assume those devices are officially validated by Meraki, but I would imagine they would work with any SPF+ device? For example, I can use a ethernet cable I buy from Meraki anywhere to connect to anything as long as the device on the other end has the right port. I would assume this would work the same way? Or is there more too it? ... View more

Thanks for the suggestion to use object-groups. Those are going to be extremely handy and save a ton of headache! Do you know if they will be coming to the group policy and MR firewall rules, rather than just the MX firewall rules? However, I still need to block clients from within the subnet from communicating with each other, or block "any" and find a way to allow access to the internet. I effectively want to recreate NAT or Layer 2 LAN isolation and deny anything to the local LAN at the MS, rather than MR.  ... View more

Thanks for bring that to my attention. I was able to use ACL to block clients from talking to each other. However, I have run into the same problem as before where they can not communicate with the internet.  I have rules to allow the VLAN to connect to the MX device, then block traffic to any other destination.   @KarstenI mentioned needing to "Deny all of our networks". Is there a way to do that without doing each individual VLAN? We have over 10 and shift them around. Managing a rule for each would be complicated. ... View more

Ah, I see now it has 1 for WIDS/WIPS, and 1 for bluetooth. I just saw the total 4 and assumed it was 2x for 2.4 and 2x for 5. Thanks! ... View more

Thank you for explain and clarifying everything. I feel like I understand it all now. I was really overthinking the NAT DHCP.   Thank you so much for all the help, it went a long way. ... View more

I agree that we definitely won't be able to get near 512 per radio, even so, the AP's we have contain 4 radios (2 for 2.4G and 2 for 5G), we should be able to use both spectrums. Would 300 clients per radio be reasonable to assume? That's just under 60% of the theoretical limits. That would put us at 1200 clients per AP. I definitely understand where you are coming from and now share your concern, I just am not getting how you are arriving at 100 clients per AP.    My concern over hash collision stems for the idea that once your device connect to any Meraki system, if that IP address is "reserved" just for that first device. Say 5 years ago, someone's laptop at coffee shop in Japan made the same hash as a device we are setting up, would we be able to use that address? That's what I was referring to with the whole 15 years thing. I am sure we will have swapped out our gear by then. I was just trying to point out that if addresses are saved globally, how quickly we could "exhaust the global Meraki NAT IP Address pool".   Thank you for your help and patience while I am trying to understand everything. ... View more

Hey, thanks for the reply.   Yes, you are correct, NAT mode is enabled on the MR rather than the MX, like in the article you linked. While 16.7 million is a lot of addresses, that is a lot less then there are MAC addresses out there. At our current rate, we ourselves could use all that up in around 15 years. Are IP addresses able to used again?   The reason why the device would get the same IP address is because the hash of its MAC address would be the same. If another device attempts to connect to the network and produces the same hash, and the original device is not connected to the network, the new device would be able to connect correct? That address would not be "reserved" for the original device. Just want to make sure I am understanding all this correctly.   Thanks for brining up the concern about our limited number of APs. I was unaware of the 512 clients per radio with Wifi 6. Each device sends a very limited amount of data, its pretty much just a handshake with the enrollment server. With that limited amount of data flowing though the AP's would that allow for us to get closer to the theoretical limits? ... View more

Thanks for the detailed response. It has helped us out a ton.   Even looking into the future, we can't foresee needing any control over the addressing. The one thing we might do is block all traffic but the enrollment servers on the production SSID, but that could easily be done from the wireless firewall on that specific SSID.    You were right about hashing the MAC address to get an IP address. It looks like the lease time is 1 day, so the chances of running into another address is astronomically small.     To clarify what you said, each SSID and each AP has its own /8 pool when in NAT mode? So, if we have 4 AP's for production, we have like 66.8 million addresses? Then if we also have a guest SSID on that same AP, it has its own /8 pool?   Thanks again for the help! ... View more