Thanks, SFP - Fiber - SFP is the route we ended up going and it seems to be working much better. ... View more

Thanks.  We got some refurbished Meraki/Aruba transceivers and that resolved the issue.  Now just waiting on the new ones to arrive in a month or so. ... View more

It's been a year and a half, and I still get upset thinking about it!  I also tell everyone that will listen.  Hopefully enough people take notice that Meraki will change their business practices.  They could easily disable unlicensed devices without impacting the rest of the network.  They could also have the account rep reach out before taking such drastic measures.  I really hope they change this policy! ... View more

I contacted support and it sounds like if we moved our VPN to the MX, the (IDS/IPS) powered by Snort would be able to respond to this sort of attack on our behalf.  That seems like a good option for us.  Does anyone have high level advice on moving VPN from the Firepower to the MX?  Any pros or cons I might be overlooking? ... View more

Yes, a 1:1 NAT is configured for the FTD.  Thanks for that tip, that is not how it was explained to me.  Let me reach out to the engineer, that would give us quite a few more options on the FTD. ... View more

thanks, yes I do have outbound traffic blocked on the MX. ... View more

The FTD does not see the source IP because it's behind the MX.  That is what I was told my the network engineer helping us anyway. ... View more

Conditional access on our MFA provider is a good idea, thanks.  We can't implement some of the Cisco FTD features because it's behind the MX and doesn't have visibility to the source IP.   ... View more

It wouldn't solve the issue, but it would allow me to block the highest volume of attacks and prevent a denial of service.  We originally put in the FTD so we could use AnyConnect, which I understand is now supported by Meraki.  I'm interested in how Meraki would different in our ability to respond to the spray attack, but also overall differences between using MX and FTD for VPN. ... View more

I have the source IP list and it's primarily two countries.  The inbound geo-blocking doesn't work because the port forwarding rule supersedes the layer 7 rule.  Looking for more general advice on if moving VPN to the Meraki would be a good idea.  Yes, we have MFA in place. ... View more

Thanks, yeah we are switching to co-term and getting rid of SAML accounts.  I don't love the idea of managing 125 independent licenses, but it's the safe route.  Co-term would be my preference, they could easily fix it if they wanted to.  This is nothing more than heavy handed DRM meant to maximize profits while putting honest businesses at risk of outages.   ... View more

I’ll add something for any small/medium business reading this.  We enabled SAML because we thought it made us more secure, especially having duo for two factor auth.  After this event, I don’t think any small or medium business should use SAML.  It added unnecessary complexity to the notification system (we can’t be the only ones that overlooked that confusing checkbox).    But most importantly, when Merkai decided to lock us out of our entire network, they effectively killed SAML auth.  So we were no only locked out of our network, but also the Meraki dashboard.  I now understand you’re supposed to have break glass Meraki cloud accounts, but for a company with two admins that pretty much defeats the purpose of SAML. ... View more

And most importantly, if they had just removed access to the two devices with licensing problems I would not be upset.  That would be a reasonable response.  Removing functionality from completely unrelated devices is not acceptable.  I do think this should be escalated, awareness should be spread, and Cisco should respond with why they have this very extreme policy. ... View more

Yes, mistakes were clearly made on our end I and did not deny that.  We are a smaller company, and internal staff cannot be experts in every single product we have.  That’s why Meraki is so appealing, because it’s easy to use.  I was very impressed with the vendors I worked with on the two switches, but clearly they made a mistake too.  And yes, the vendor that helped us setup SAML over overlooked a notification setting.   But I strongly disagree that Meraki is blameless.  Their policy is horrible and should be changed.  If a single human at Meraki had made an effort to reach out to me personally, this would have been avoided.  If they had posted a warning in the dashboard, this would have been avoided.  There are a ton of ways Meraki could make this a better experience.  Over the years, I have had a license or two lapse in coverage.  I have never had a company remove my access to hardware that is paid for and under a support contract.  I have also never had a company cause a network wide outage because of a minor billing discrepancy.    Like many companies, we are not staffed to understand every nuance of the products we use.  We rely on solid partners to help us with our infrastructure.   In my opinion, Meraki failed as a partner today. ... View more

You will not be notified if you use a SAML account.  Don't let it expire or they will shut down your entire network.   ... View more

We just went through this today.  They shut down our entire network because our support partner forgot to license two switches added to a remote site.  They were fully paid for, he just forgot to add the license to the portal.  To add to this, my company did not receive a single notification because we use SAML login, and for whatever reason those accounts are not included in the licensing notifications.     I cannot believe anyone is defending this policy.  Removing access to specific devices would be understandable.  Removing access to an entire network absolutely blows my mind.  In our case, we have about 500k worth of equipment, and they deactivated everything over a $2,000 switch that wasn't properly installed.  This policy should be changed. ... View more

I already contacted my account rep.  He apologized for the outage and said he does not agree with the policy.  What's the next escalation?   ... View more

Thanks Ryan, I do appreciate the technical explanation of how this went wrong and the fast responses from everyone.  I now have a good idea of how to prevent this in the future.   I would like to hear a company statement on why Meraki has this policy?  Meraki sent some automated emails, then shut down our entire network for a minor infringement.  This had a significant impact our company for the day and we deserve an explanation of why this is your business practice.   ... View more

Thank you, I will also be switching to per device licensing.  ... View more

Thanks for the reply, Ryan.  We will be getting rid of SAML at the first opportunity.  I receive other Meraki notifications all the time with my current account, I don’t see why licensing notifications should be any different.   Yes, I had the license from an order confirmation sent from our support partner.  I rely on partners for setup and support, and the tech clearly forgot to install the license.  I doubt they watch the email alerts very closely either, they probably support hundreds of companies.  Mistakes happen, a missing license key on two switches feels like a small mistake to me.  It did not need to escalate like this.   Frankly, I don’t see how you can legally shut down our entire network for noncompliance of two minor devices.  I will really struggle to put any additional Meraki equipment in our data center knowing that it can be disabled so easily.   Why is this your policy?  Send me an email, give me a call, something!  I am not trying to cheat Meraki out of any money here.  There is no reason to completely lock us out of a network when 1% of it is missing a license key.  I didn’t even realize you were capable of shutting down our local, fully paid for hardware.  I would revisit this policy, it is terrible customer service and unlike anything else I’ve experienced with Meraki.  ... View more

Do you know if per device licensing prevents Meraki from shutting everything down when one device is not compliant? ... View more

I think I see what you are referring to now.  We use SAML administrator roles for all internal staff.  The privilege assigned to my group is organization admin.  The licensing alerts are set to go to all organizational and network admins.  But because I'm in a group, Meraki doesn't include me in these alerts?  How is anyone expected to know that?   This is a failure on Meraki's part anyway I look at it.  It was a small oversight from the network tech that Meraki escalated into a networkwide outage.  They can't send me a personal email before shutting down several hundred thousand dollars worth of paid for hardware?  Very frustrated. ... View more