Hi Jess,   We're seeing the same (same signature) It's a Webroot update; at the moment, I'm working off the assumption it's another false positive - but a response from Meraki would be great. @GiacomoS would you mind asking around and maybe raising a service notice if you find something.   Cheers ... View more

If you're talking about file i640.c2rx with sha256 d73298c7c8b8ce78f7003cf6832a8dd719ab4d240cf3e213fcf8824539c81873 yes, I'm seeing it across multiple networks currently, I'm hoping there more details to come... ... View more

+1 for n35 ... View more

Sounds like it... the only protocol selected should be PAP - see the configuration documentation To be clear, if you're running Windows 10 or 11, you're also going to need to make sure the optional update KB5010793 (W10) or KB5010795 (W11) has been applied if the regular Jan 11th 2022  patches are installed before you'll see client VPNs establish and maintain a connection; otherwise you'll see the 789 error (The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer) ... View more

It isn't (at least currently) an option on Meraki; it just happens to be that on older firmware versions it wasn't in use/sent ... View more

See this reply  from GiacomoS above. In short, Vendor ID isn't sent in 14.x but was added in 15.x Disabling Vendor ID is Microsoft's published workaround, so it'd make sense any connections terminating on an MX running 14.x continue to work ... View more

Firmware versions the same across your different Models? GiacomoS has confirmed 14.x firmware versions don't use the Vendor ID (Which Microsoft have said disabling is a workaround to the issue) whereas from 15.x Vendor ID is enabled (and thus don't play well with the MS updates) ... View more

That's an interesting find - whilst as you point out it's still a long way from ideal, the implication would be that the update could be applied, therefore patching a number of vulnerabilities, whilst still maintaining VPN functionality (albeit, I suspect, at the expense of at least some of the IKE vulnerabilities remaining unpatched, but given not applying the update at all would mean that the IKE vulnerabilities, PLUS the other vulnerabilities would be unpatched, it certainly seems the lesser evil) ... View more

@GiacomoS  Isn't AnyConnect on Meraki now subject to AnyConnect licensing though (i.e. you must have valid AnyConnect licenses to use)? I was looking yesterday and where I previously recall there was a period where it was permitted to use without license(s), the documentation now all seems to point to licenses required (though potentially not enforced) ... View more

For those looking for a direct MS download, you can find it here: http://download.microsoft.com/download/F/2/2/F22D5FDB-59CD-4275-8C95-1BE17BF70B21/wushowhide.diagcab   EDIT: some browsers (Chrome for me) may not start the download, if that's the case, try pasting into the address bar, rather than clicking the link.   In testing, I've seen a single case where it didn't show the list of updates to hide immediately after restarting post-update removal, in that instance, restarting the computer a second time then had the tool show the list of updates as usual. i.e. process steps are: wusa /uninstall /kb:5009543 (from an elevated command prompt, KB 5009543 is for Windows 10, replace with 5009566 for Windows 11) Restart when prompted Run wushowhide.diagcab and hide the relevant update (likely at the bottom of the list), if no updates can be found, attempt restarting again, and re-run wushowhide.diagcab after restart. If the update hasn't yet installed, you can skip straight to step 3. ... View more

Looks like it probably went out to all customers, but is just a copy & paste of GiacomoS' post above. FYI - you may want to remove the link in your message, as it exposes your email address/employer identity ... View more