yes, correct! @GreenMan @maybe you‘ve a suggestion how the cabling should look in such a case too? ... View more

You will not receive a warning if you use a SAML account, something to keep in mind.  Yes, they shut your entire account down, even the devices with valid licenses.   ... View more

Glad to help and thank you! ... View more

I'm guessing EE have got IPv6 to IPv4 working properly then, which is good 👍 ... View more

Hey @blind3d , No worries 🙂    So, I'm not sure if it's a naming convention problem, but there were a couple of things that nagged me on the config you sent me.    On the Meraki side, you have a remote ID set to "empty", yet on the Palo Alto's side, your local ID is set to the Palo Alto's IP. I would normally recommend using the ID fields when one of the two sides is behind NAT; on the side where you have NAT you'd want to put the private IP on your uplink interface as your local ID, and you'll need to match it on the remote side with the Remote ID field.    The other thing that I'm a bit confused about is the "IPSec GW" configuration on the Palo Alto side. Is that the essentially a subnet pair? Do you happen to have a screenshot of that section (even a mock one)?   @CCL_CO , in the majority of instances it seems to be a mismatch in either phase 2 configuration or the establishment of the SAs (possibly because of the KB I mentioned above), so there's no one-size fits all solution yet. Could you please share some more details around your configuration (please replace the IP addresses with fake ones!)?    Many thanks!   Giac ... View more

One caveat though. You cannot implement cert-based auth alone. You have to use cert + user creds on Meraki. ... View more

Hi, just did the last firmware update a couple weeks ago and now we have this issue also. Clients all show up "grayed out". Sometimes when I first hit the clients page for a split second I can see who is connected. Under appliance status: Up to date Current version: MX 15.42.1   Is there a way to back off this update? This is important functionality to lose.   ... View more

Hi,   I know I'm bringing a thread back from the dead here, but did you ever get to resolve this?  We seem to be running into a similar issue ourselves and at our wits end on how to get the Phase 2's to complete properly - neither end has great logging to determine the exact issue! ... View more

I like how the ASA decouples NAT from everything else. It does make it alot more complex to configure if you have an involved config but you can get by most use cases.   Cisco remains an aeroplane cockpit with loads of buttons and possibilities while Meraki is more like a remote controlled car with a stick and a few buttons. ... View more

Yes, that's what the docs say, but why am I loosing connection if switching now between v1 and v2? Something could be wrong in the code.   @MeredithW any date when this was released? I need to know whom am I going to blame for the support invoice 🙂 ... View more

in my case it was the "Xbox Live Networking Service" on the desktop having issues.   I disabled that service and it connected instantly. ... View more

In sonicwalls, there's an identifying string internal to the sonicwall firewall that's used in site-to-site vpns. In the VPN Settings, it would be "Unique Firewall Identifier". ... View more

i can see ACls and crypto map in the asa with a source of the asa subnets and destination of the MX subnets with ip service set to permit. ... View more

@Uberseehandel  I don't have a flash enough phone to have USB-c, a quick Google search doesn't list any USB-c modems either.   Some vendors still supply equipment with COM ports, I think what it comes down to is what is the basic requirement of the port, why spend extra money for a port thats not needed.   ... View more

Whole the solution above may work, it needs to be noted that Meraki MX does not currently support true Source NAT.  ... View more

I appreciate you re-opening the thread @CarolineS.  ... View more

I would love AnyConnect to be bought to MX as well.  Mostly because AnyConnect works so well.   I would prefer something that supports both tcp and udp on port 443, like AnyConnect.  This combination means it will work in a wide variety of scenarios, while still giving great performance (if udp 443 works in particular).   Second choice it would use IKEv2.  IKEv2 seems to be more robust than IKEv1, and in particular L2TP+IKEv1.     Also I really really want the ability to assign group policies to VPN users.  I would especially like the Filter-Id RADIUS attribute to be supported so I can dynamically assign the policies. ... View more

Hi @JasonCampbell. It will only use it in reply traffic. Any connections initiated from Inside will not use the 1:1 NAT IP.     ... View more

checked, VPN is marked Yes but unable to ping MX to MX devices.. ... View more

Does this mean that if you split the camera network into a separate network, you can still have them using an uplink MX even if that MX is part of a different combined template network? ... View more

Hey Nedy, So just bring the switch online and add it to the dashboard network. Make sure you don't couple it to the other switch yet. Then wait until the switch has the same firmware as the other future stackmember. When that is done, power down both switches.  Cable them up (stack cables)  don't forget to cross them.  So stack port 1 on the first switch connects to stack port 2 on the second and vice versa. Then power them back up and wait a few minutes before going into the dashboard and then click in switch->switch stacks. In that menu you'll see possible stackmembers where both switches will be on one line and then just click provision and give the stack a name. Example:  first switch is SW-CORE1-01 and second switch is SW-CORE1-02 and then the stack is named SW-CORE1 ... View more

One Possible Solution is for them to have a personnel account on their own Network that does not have any lockout.    I have two accounts one for my personnel home Org and another for MSP for work. Both my work and personnel accounts are registered under my Home Org as admins.   Whenever I get locked out of my work account I login to my personnel Org and unlock the work account.   If you have a main Org (your personnel environment for example) and they are all added there you can just unlock them there. That way you don't have to go hunt doen the Orgs they are associated with. You should be able to unlock from any Org they are associated with.   ... View more

Just FYI you can do this currently, you just need an additional firewall. We have a couple setups utilizing Sonicwalls for 3rd party VPN in this setup because Meraki's 3rd-party IPSEC implementation is straight garbage that will disconnect randomly and not reconnect until you manually reset the tunnel. I'm hoping the IKEv2 beta release will be more stable. https://www.willette.works/merging-meraki-vpns/   ... View more

yes thank you very much means  3 from each ISP connection, (2 VIPs and 4 IPs for MX 1 and MX 2 WAN links)   ... View more