Hi all,   I'm looking to optimize my configuration of a CW9166 AP that I recently purchased. The purpose for the AP is to provide the fastest possible wireless throughput to WiFi 6E-compatible clients.   The CW9166 AP is using the out of the box configuration and is currently connected to a 10 Gbps switch (auto negotiating at 5 Gbps, which is the max port speed). I also have wired clients connecting to the switch that are negotiating at 10 Gbps. My throughput tests between various wired 10 Gbps clients shows that I can almost max out on each port (9.5+ Gbps in iperf3).   The setup for my 6 Ghz wireless testing is as follows:   My laptop is WiFi 6E capable (Killer(R) Wi-Fi 6E AX1675i 160MHz Wireless Network Adapter) and has a 2.5 Gbps (Killer E3100G 2.5 Gigabit Ethernet Controller) wired port.  My workstation has a wired 10 Gbps (Intel X540-T2 PCI-E) port.   Here are some tests that I've ran using iperf3, where the laptop is the client, and the workstation is the server:   On a 5 Ghz wireless connection, I'm getting 250-300 Mbps from my laptop to the wired workstation. On a 6 Ghz wireless connection, I'm getting 500-700 Mbps from my laptop to the wired workstation. On a wired (2.5G) connection, I'm getting 1 Gbps from my laptop to wired workstation (10 Gbps link).   Since this is my first time working with WiFi 6E, I'm curious if the speeds on the wireless 6 Ghz connection are normal or below what they should be. I'm looking to receive some input regarding any recommended configurations, tests, or tweaks that I should be exploring to get the most out of this new AP.   Thanks! ... View more

Hello,   I'm looking to verify and/or get feedback on a proposed network design for a hub site that I have at which we use 2 MX-105 in an HA setup (warm spare config), 2 MS-250-24P (each on a different VLAN), and a single MS355-X2 (also on a separate VLAN, for internal 10 Gb clients).   The current design uses CAT5E connections between the switches and each switch uses a management IP from its own VLAN. This was done initially to simplify the design and avoid spanning tree issues/loops. I'd like to optimize the current design in order to: Free up the 1 Gb ports that were used for uplinks and use higher speed Twinax cables (MA-CBL-TA-1M) for the uplinks and switch to switch connections. Properly configure a management VLAN across all devices. Make the design more redundant with less single points of failure. I've attached the proposed design and would like to know if it would work as configured. The config would be as follows: Each uplink trunk port from the MS-250's would have the native VLAN set as the MGMT VLAN (10) and allowed VLAN's as all internal VLAN's (1072, 1082, 1092).  Each switch to switch trunk port would also have the native VLAN set as the MGMT VLAN (10) and allowed VLAN's as all internal VLAN's (1072, 1082, 1092). Each remaining switch access port would have the VLAN set to the respective VLAN of the switch (1072 for SW-A, 1082 for SW-B, and 1092 for SW-C).   Would the design function properly from a spanning tree standpoint or would it introduce issues/loops/other problems? I haven't dealt with STP in a while so I wanted to make sure I wasn't missing any glaring issues.   Thanks!   ... View more

Hello,   We're using Okta with SAML to authenticate our users into our Meraki VPN through the Cisco AnyConnect client. We followed the configuration guidelines here.   Our user base consists of a combination of Mac's (Monterey 12.5+), Windows (10+), and Linux (Ubuntu 20.04+) machines.   When users try to connect to the VPN, an AnyConnect browser window pops up and directs them to enter their Okta credentials (screenshot 1 below). After they enter their password, they receive a 2FA prompt via Okta Verify on their registered device (screenshot 2 below). After they finish this step, they successfully connect to the VPN.   Some users, however, are having the AnyConnect browser window freeze after they do the 2FA challenge (screenshot 3). Although the logs in Okta show that they are successfully authenticating, they still cannot get on the VPN until they get past this step.   This used to happen less frequently but seems to be occurring more consistently for some users. Some attempted fix actions:   Restarting the machine Reinstalling/updating Cisco AnyConnect Restarting the MX-105 HA pair   Any ideas would be appreciated here. Thanks!   ... View more

Hello,   I'm trying to configure an MX68CW as a backup cellular gateway in case the primary and backup internet connections fail on a HA MX105 pair. I plan on using the USB connection on one of the MX-105's to connect to the MX68CW (functioning as a cellular gateway) as internet failover. Therefore, the MX68CW is configured in Passthrough mode.   I've factory reset the MX68CW prior to configuration and followed the steps outlined in this document under the "Setting up Cellular Failover" section.   The status light on the MX68CW is solid purple, which means it should be working fine on cellular. The attached screenshots confirm that as well.   However, the device is not able to connect to the Meraki cloud over cellular, but only works  when it's connected to the wired connection. Does anyone have any idea why that's the case here?       ... View more

Hello Meraki Community,   We're pushing Cisco AMP, AnyConnect, and Umbrella to our macOS users that register their devices to Meraki SM. In some cases, these users are unable to connect to internal networks residing on the VPN, or their internet traffic is super slow altogether.   One of the fix actions we've come up with is to uninstall Umbrella. When we do that, the issue goes away. Here are some notes about our setup.   Only affecting macOS 12.2+ users that have the following installed: - Cisco Umbrella Roaming Client 3.0.5 - Cisco AnyConnect 4.10 - Cisco AMP (SecureX) 1.16.2.853   It appears that the AnyConnect installer that has the Umbrella enabler/module in it by default is conflicting with the Umbrella Roaming Client. Is there any way to include the Umbrella configuration directly into our AnyConnect installer on macOS? ... View more

Hi all,   We have a setup where our employees do user enrollment to register their devices with Meraki Systems Manager (SM). Once they enroll, they get profiles and packages pushed to them, including Cisco AnyConnect, Cisco SecureX (AMP), and Cisco Umbrella. Our testing prior to deployment of everything worked fine, so we started sending laptops to new employees and having them self-enroll in order to receive the required packages.   The users access our internal network using the AnyConnect Client VPN via an MX-105 HA pair in a split tunnel configuration. Once connected to the VPN, we assign custom internal nameservers to be able resolve our local hostnames.    In one of our very first deployments on an out-of-the-box 14 inch MacBook Pro running MacOS Monterey 12.1, the user successfully enrolled into SM and received the three packages listed above. Once they connected to the VPN, they couldn't resolve any internal hostnames. Checking the DNS configuration in the network settings, it appeared that the nameservers weren't updating to our custom ones -- rather, it only had the localhost (127.0.0.1) showing in the list (matching what's in /etc/resolv.conf).    After a few hours of troubleshooting, we had the user uninstall Cisco Umbrella and then everything started working. The custom nameservers were now showing up under the DNS settings (and resolv.conf) and user could resolve internal hostnames.   Some additional notes: -  Our Umbrella system is not integrated into our Meraki system. We're using default Umbrella policies for DNS layer security. - In Umbrella Dashboard -> Deployments -> Configuration -> Internal Networks, we have the two /24's (where our hostnames reside in) added. - We're running Umbrella RC 3.0.5. - This exact setup works on other similarly-spec'd MacBooks and on other Windows 10 machines. I'm unsure if the sequence of when each package is installed has something to do with this.    I'm hesitant to integrate Umbrella into Meraki as I'm not sure if that could impact DNS resolution across the board over the VPN.   I also saw that someone else posted about this but didn't see a resolution: Umbrella Roaming Client and Cisco Meraki MX Firewalls - The Meraki Community. Any thoughts or help on this would be appreciated! ... View more