Hi,    To what extend did you increase the Radius Timeout?    Thanks! ... View more

Configure the system to allow the IPS rule. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Allow_List_rules   ... View more

Can you not Deny at Layer 7 as below:   And add L3 Deny rules for teamviewer.com etc provided the MX has seen the DNS lookup, or if using internal DNS setup a teamviewer.com domain and resolve to 127.0.0.1 ?? ... View more

sounds great, but seems like the link is not accessible even though I should have partner access. But thx anyways 🙂  ... View more

Posting this for anyone else having this issue and is using Telstra (Australia) and searching this issue in the future.   We have hundreds of sites with backup connection via Telstra 4G Data SIM. Provided you are on the telstra.extranet APN. Things will work no issues because you get a proper public WAN IP. You need to ensure the Meraki is set to use the telstra.extranet APN. How to get telstra.extranet APN? You need to be on an enterprise or corp level account with Telstra and ask for telstra.extranet to be enabled on the service (magic code GPTEXB3 needs to be added to the service). Telstra by default will put you on a 10.x ip range as they don't give out a pulic WAN IP for  just any customer. If you are a Telstra retail customer. You will get CGNAT and you will have issues. ... View more

In your case, try changing to a different firmware, it looks like the unit is not installing the currently selected one and rebooting  ... View more

So did making sure RSTP was enabled and enabling BPDU fix the random switch/system drops?   Similar issues on my network where switches randomly show offline. STP looks solid with NO Switchloops I can find. Topology describes a straight forward link from firewall SPF port to Switch, but still have switches dropping soon after reboot.   ... View more

I appreciate each one of you taking the time out of your busy schedules to respond and assist me with this. The Cisco AnyConnect is unquestionably the best choice, but at this point, it depends on the client's willingness to pay extra for it. ... View more

@GreeNdeviCp3821 I'd get at least one genuine cable (the 40Gb ones aren't very expensive). ... View more

This KB may help to troubleshoot the issue:  https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS_Issue_Resolution_Guide ... View more

We have some MR32 but no issues. Except of the fading blue LED light. ... View more

We updated several MX-100 and one vMX100.  the vMX100 (virtual) updated to 16.16 without issue and is currently still on that version with a scheduled upgrade scheduled.  The issue we had was with our physical MX100.  When upgrading to 16.16 all of our MX100's would drop out, consistently, every hour for about 10-20 minutes, consistently.  We were able to roll them back successfully.  I tried several times but eventually updated them to version 17.6 which resolved the issue.  The issue had to do with an upstream SFP connection at the DMARC.  We have been running version 17.6 without issues for several months.  We have not had any bandwidth issues on 17.6 and will upgrade to 17.8 this next week. ... View more

Yeah we've had huge issues with NBAR, in particular misclassifying Unifi management packets and 3CX tunneled voice traffic, so it's prevented remote management of some distant sites Ubnt gear, and causing their phone calls to repeatedly reconnect when using iOS or Windows clients.   The solution was to manually update the L7 rules to exclude these false matches, but then 1) there maybe new false matches, 2) that's across dozens of sites we'd have to do this, and 3) then each month when new definitions are added we have to rinse and repeat.   The other option at one point, unsure if this works, but turning off advance traffic analytics or something disabled NBAR, however, a lot of our sites actually need this feature.   For now we're getting a pile of sites 'pinned' on MX15, and for others that are more critical eg local govt we are replacing the MX with FortiGate's which we've tested not to have this issue.   I hope that helps! -KP ... View more

I've just lodged a feedback for it.. will see if it ever eventuates I guess! ... View more

LOL, that is a lot, Sophos can do as many as there are physical ports on the device (minus 1 for LAN and one for HA if you are using it).  I'm sure Meraki will move to more (3 or 4) but it may well only be on the newer MXx5 devices... ... View more

thanks, this is great info in helping sort out the update issue, worked for me ... View more

Thanks Blake, I did find that.  Just wish you could disable it from wifi but keep enabled on LAN. ... View more

Hmmm...and this is coming from a Meraki employee...so what I'm hearing from you is to probably Not upgrade to 14.33 in a couple of weeks?? Is that correct @Make_IT_Simple ? Is there any Firmware version that is the most stable that you guys would recommend? I appreciate your response in advance. Thanks   Sorry about that @Make_IT_Simple , I misread your post. It looks like you're saying that in your experience, 14.33 did resolve these issues in your environment, is that correct?   My apologies for misunderstanding, if that's the case. ... View more

Concentrator mode only uses WAN 1 port  What's the goal with using both WAN ports on the MX? Just LAG/more bandwidth? As Philip mentioned no MX supports LAG. And the MX105 has 10Gbe capable WAN ports.   Typically in this design the MX would sit behind your edge FW in a DMZ using a private IP. The FW would have a NAT rule and access rule allowing VPN through it/to the MX. ... View more

They don't use the same ISP because there are people in other countries and they have the same issues. ... View more

Sorry, I meant to say... I am testing using the GX20 browser interface that has a speed test function for this appliance specifically to check the connection to the appliance. ... View more

Looks like two different countries (China, Russia). But the volume is just a trickle now compared to when it was on 443. I haven't seen any hits on it today for example. This client is a car dealership, so yeah, definitely no business in those countries, lol.    Also, no further flaps of course, since AnyConnect isn't getting hammered now.  ... View more

And remember that if the warranty response time isn’t inline with your requirements, e.g. you want a 4 hour advance replacement (not something you’d normally want on an access point), or if the warranty is only for a year and you want to extend it, then you can get MerakiNow which is very similar to SmartNet in that it provides hardware replacement. ... View more

“If the application on the server is secure” is the first misconception. There is no secure application. A DMZ is not that complicated, it’s best practice and you really should implement the server in a DMZ. ... View more