We are using the MX-84 appliances to connect our sites via auto-vpn setup.  The site that has the shared resources has 2 Internet connections:   WAN 1: 200 Mbps Microwave (our original Internet access which was replaced because it can be problematic) WAN 2: 200 Mbps Fiber (put in recently to replace Microwave as primary)   In SD-WAN settings we have the following settings: Primary Uplink - WAN 2 (the fiber connection) WAN Failover - Graceful Load Balancing - Disabled Active-Active VPN - Enabled   WAN 2 (the fiber) had no issues for the past year+ and still appeared to be working fine, however our site to site VPN tunnels fell over to the problematic WAN 1 the other day and caused a lot of issues with connecting to resources accross the WAN.  It was very hard to realize this was the issue because Internet tests ran perfectly and showed traffic going out WAN 2.  It took a little while for us to figure out it was due to the VPN failing over to WAN 1.   I assume that at some point WAN 2 had an issue and the VPN tunnels fell over to WAN 1, but shouldn't the VPN have fallen back to WAN 2 once any issue cleared up? Do I have to Disable Active Active to get to ensure the Primary WAN 2 is used? ... View more

I have seen a couple of posts back in 2018 about issues with Windows NLB and the Meraki switches but I wanted to check in to see if a solution has been developed in the last 5 years.   My configuration is 2 Hyper-V servers both running Windows 2022 Std with about 5 VMS on each host.  I have 2 VMs where I want to use Windows NLB.  The two VMS are Windows 2022 Std VM setup on different hosts.  NLB on the two VMS is in IGMP Multicast mode (Tried Uni and just Multi with same results).  Both VMs configs have MAC Spoofing enabled for the NLB NIC.  Both physical NICs from each Hyper-V hosts are plugged into the same MS120-48.   Server1 - 192.168.1.10 (on Host 1) Server1 - 192.168.1.20 (on Host 2) NLB - 192.168.1.30   All the VMs on each Hyper-V host are able to connect (and ping) the NLB at 192.168.1.30.  No physical computers on the MS120 or other switch are able to connect or ping the NLB.  I am assuming the VMs on each host can only see the NLB node on their own server.   MS120 cannot ping the NLB and when I try to packet captuer for the NLB IP or MAC I just seen ARP requests with no response.   I have been seeing that in order to use Windows NLB I need to have a static entry for the virtual IP and MAC, but can't see how to get this on the Meraki. ... View more

I have a couple of areas in my facilities where we need WiFi and just have one or two clients there, so I picked up the MR36H access points.  The built in 3 switch is not exactly what I was expecting because I thought it would operate similar to the MS switches.  I am confused by the way I have to assign a SSID to the port.   For my regular MS switches I would set the port types to Access and enter my VLAN (data) and Voice VLAN.  This allowed me to use the one port for my VoIP phone and plug my computer into the passthrough on the Phone.  On the MR36H It looks like I have to select an SSID for the port to get connectivity for that port and I can only use the port for a single VLAN.   In order to get the switch ports to work for my I had to create a hidden SSID that connects to my VoIP VLAN and apply it to Port1 on the MR23H, then apply my SSID that connects to my data network to Ports 2+3.   Is that the way these are meant to be setup or is there a way to get all 3 ports so they can have data and voice vlan access?     ... View more

Is there a way to get a report of all the active sponsored wireless devices and who sponsored them?    We have an SSID with Sponsored access for guests.  The SSID has no LAN access and uses Meraki DHCP and the guest can request upto a couple of weeks of access.   We also setup a second SSID for the employees to add their personal mobile devices.  Basically the same setup, but the employee gets 6 weeks automatically.  They just enter their own email as the requestor and approver.  This network also has not LAN access and we also throttle the bandwidth and content filter.   Currently I have to go to each device and check the settings to see who sponsored the device, but it would be great if I could either run a full report of the devices.  Even better would be a weekly email of all sponsored devices.   ... View more

So we have some high speed fiber for our primary connection, but the best we could get for our backup line was a LTE 50/5 connection.  Is there a way to limit the IPS, VLANS, SSIDs, or Services that are allowed to use WAN2 when a failover occurs.   Ideally, I would like just access to email (O365) and our VoIP system to work and block video content like Teams Meetings, Youtube, and streaming services.      ... View more

Back when I used to use the Cisco ASA, I recall being able to run a login script upon connection to the VPN. But the ASA controlled the script.  Is there anything like this on the MX setup with AnyConnect?  I did not see anything in the Profile Editor utility for this either. ... View more

Quick question on when or if the encryption starts when using the RADIUS authentication option with Certificates.  In the setup article:   https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication   The Network Policy configuration steps for RADIUS say "Deselect all checkboxes and select Unencrypted authentication (PAP, SPAP)". So is this connection method unencrypted? ... View more

I have some user where they want to be sure all their traffic flows through the VPN when they travel to places around the world that might have less than stellar privacy standards.  (Unlike the wonderful privacy standards we have here in the US - LOL)   Currently using version 5.0 of the AnyConnect client with our MX devices.  Using Radius authentication with certs.   I am using a split tunnel setup for my clients. I have my AnyConnect client configs for my MX devices setup with the following on the dashboard: Client Routing: Only send traffic to these destinations: (my local LAN network addresses) Dynamic Client Routing: Only send traffic going to these destinations: (List of web addresses)   So is there a way to configure the local AnyConnect client so they use my split tunnel config as the default, but be able to turn on full tunneling on their own?  I took a look at the VPN Profile Editor settings, but did not see (or missed) a settings to allow end users to do this. ... View more

Occasionally we have an issue where every minute or two a user/device will have a huge spike in bandwidth for just a second or two.  Even though we have our VoIP devices on a separate VLAN and QoS configured these spike can cause some noticable issues.   What is the best way to find a user/device that is causing the spike for brief moments.  I tried to using the data usage history, but it does not appear the culprit is using all that much data all together.  ... View more

I have about a half dozen sites setup with MX 84 devices with AutoVPN setup.  All site can commuicate fine.   Site 1: 172.16.10.x Site 2: 172.16.20.x Site 3: 172.16.30.x etc, etc, etc   We need to connect to a vendor's infrastructure so we setup a Non-Meraki Peer to the Public IP of their appliance and the Local ID is the external IP of the MX at Site 1. I can communicate to the vendor's infrastructure from Site 1, but I need all six sites to traverse the tunnel.   From what I understand I can setup Site1's MX as an Exit Hub so all traffic routes through Site 1, but I really only want the traffic for the vendor's subnets to travel through Site 1. Is this possible or do I have to setup Non-Meraki VPN Peers to each of the external IPs of every MX device with my vendor? ... View more