Previously it worked like this: L3 roaming with concentrator = non-encrypted tunnel to MX VPN tunnel data to concentrator = encrypted tunnel to MX   At some point Meraki changed it to this:   L3 roaming with concentrator = encrypted tunnel to MX VPN tunnel data to concentrator = encrypted tunnel to MX   I'm not sure why Meraki made the decision to basically make them the same. When Meraki did this, we had older MRs (MR53) that took a huge performance hit with L3 Roaming. Seems that older models used hardware encryption for wireless client connections, but not on the connection to the MX. Newer models didn't have the performance hit (MR56 & MR57). We had to contact Meraki and ask them to disable encryption on certain SSIDs so we would run again with no encryption to avoid the performance hit.     ... View more