This isn't best practise as the MS has no intrusion prevention or any other security features built into them because they are not designed to be public facing.  ... View more

Datasheet for MS120,   https://documentation.meraki.com/MS/MS_Overview_and_Specifications/MS120_Overview_and_Specifications?file   Supported L3 models can be found here:   https://documentation.meraki.com/MS/Layer_3_Switching/MS_Layer_3_Switching_and_Routing ... View more

Yes exactly that.   Reserved IP is taking those IP addresses out of the DHCP scope. ... View more

Yes, all the traffic will go through spare MX ... View more

Just one LAN IP ... View more

I understood your original post that these IPs are from an additional subnet and not the interface IPs. If these are the interface IPs it can work, but your peer has to reconfigure the tunnel to the Spare-IP in case of failover. Interface IPs are fixed to the device and don't swap as it is done with the ASA for example. ... View more

Meraki client VPN is available on all tiers of MX license. Anyconnect client VPN on the MX requires purchasing additional licenses https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance ... View more

The release notes don't mention anything, but I already saw some issues in version 17.10.2 that were resolved with the update. ... View more

Just be aware that all MXs in the same Dashboard Organization must have the same license level.   If you start with SD-WAN+ then all subsequent MXs will also require SD-WAN+    SD-WAN+ does have some massively useful features though (Smart VPN exclusions, SD-Internet, Insight...), so it's a pretty good choice, if you're using dual Internet links at your site and rely heavily on a mixture of cloud IaaS and SaaS applications. If you do buy Advanced Security or SD-WAN+ don't forget to enable some of the key provided features;   IDS/IPS, malware protection, content filtering etc. ... View more

Hi,   Thank you for sharing the details.   Regarding point 2, Yes user are able to access internet and SSID is not open. Tried by upgrading the client network adapter also.   Any other possibilities causing this issue ? ... View more

its Ethernet cable  ... View more

Not getting an any clue behind site is opening but preview not. Below is my Content filtering configuration   Category i have blocked : Streaming media   Url filtering blocked rule  : www.youtube.com *.youtube.com gvt1.com r3---sn-ni5f-t8gz.gvt1.com r2---sn-ni5f-t8gs.gvt1.com ytimg.com r3---sn-ni5f-t8gs.gvt1.com ytimg.l.google.com   Group policies allowed url : www.youtube.com *.youtube.com ... View more

Yes, just remember that you have to adjust some DNS entries for IP changes of the main server. The SDWAN will wirk out of the box as the dashboard is handling the addresses. ... View more

What is the design do you want to use full tunnel or split tunnel? Are you advertising a default route in the vpn? Did you select on the spoke site the default route box behind the hub?     https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#Default_Route ... View more

For your first query the answer is no. If your MS250 switch is acting as the default gateway of that LAN then you should configure DHCP server on the VLAN Interface on the switch.  In this case the MX is not even connected directly to that VLAN because it will be connected to a point to point link and routing to that subnet.  Alternatively you can have the switch be a DHCP relay agent, which would mean you need to point it to a DHCP server in an MX or server.   For your second query: it depends what you want to do. If your MS250 is acting as default gateway for all local VLAN's with a transit network to the MX you can have two scenario's. 1) You have a separate VLAN directly on the MX that severs as management VLAN for the switches.  You can either pass that VLAN over the same port to the MS using a trunk link or use a secondary link that only allows the management VLAN.   2) You grow the transit subnet between MX and MS to a /29 and have the MS250 management IP be in the same subnet as the transit IP.  then you can have a management VLAN that terminates on the MS250 for downstream switches.  This one is a bit weird but is valid. ... View more