I'd try the MS 14.x firmware - yes, its beta, but then as someone else mentioned in another thread, the MS390's seem to be pretty much beta... ... View more

Not sure there’s an easy solution to this one. RADIUS as a protocol doesn’t include any encryption, other than some password ‘hiding’. When you use it over wireless there is a secure tunnel created all the way to the RADIUS server and credentials are passed through that - hence why you need to ‘accept’ the server certificate if it’s not from a trusted CA. The Meraki MX doesn’t create such a tunnel to the RADIUS server.   I’d suggest using a very long RADIUS secret, and restrict administrative access to everyone you can, both to prevent them seeing the secret and to prevent them doing packet captures.   Not sure on the practicalities of getting the MX to use a TLS tunnel to the RADIUS server, but probably worth making a wish. ... View more

@ghud312 any reason why you want to use a WAN port for your MPLS connection? Why not use a LAN port and configure routing on the MX for the appropriate addresses?   Just remember that unless you enable No NAT on the WAN port all traffic on the MPLS link will appear to come from one IP address - you may also need the inbound firewall rules enabled if you’re expecting inbound connections over the MPLS link to the WAN port. ... View more

In that case there isn’t any problem with your network, sounds like it’s all operating fine. ... View more

Best place to start troubleshooting then is connect to, say VLAN 300, make sure you get a valid IP address for VLAN 300 (assuming you’re using DHCP), and then make sure you can ping the gateway for VLAN 300. ... View more

You’re correct it doesn’t support IGMP or any multicast control features, but it will forward multicast traffic as if it was a broadcast within the same broadcast domain (I.e. within the same VLAN).   I can’t say whether there is anything in development for the MX with regards to multicast, and Meraki is unlikely to say so in a public forum. I’d say there most likely isn’t, it’s more an MS feature, but you’ll need to check with your local AM/SE for a definitive answer. ... View more

If you can’t ping between clients on the same VLAN then it’s most likely a client issue. Check the IP addressing on the client (make sure it’s all correct for the VLAN), check the client for firewalls (they may block pings), and try pinging the gateway instead of another client (the gateway will almost always respond).   Don’t worry about not being able to ping websites, a lot of websites don’t allow pings, so long as you can connect to the website all is good. ... View more

The Cisco Webex Room Kits do support 802.1x, so they should be able to connect to a Meraki SSID using 802.1x. However the issue will be whether there is a supported EAP type that both the Webex device and Meraki authentication have in common. It looks like they should (Webex device support EAP-MSCHAPv2, EAP-TTLS and PEAP, https://www.cisco.com/c/dam/en/us/td/docs/telepresence/endpoint/ce912/room-kit-administrator-guide-ce912.pdf, page 22) so you probably just need to add the username and password to the Webex device - I can’t recall if I’ve done this before because mostly I connect them by cable. I’d be surprised if the Webex device didn’t already have the correct CA installed by default, or you can find the xCommand to disable certificate verification (not ideal, but could prove if the certificate is the issue).   EDIT: check the details for xCommand Network [1..1] IEEE8021X TlsVerify ... View more

If you can’t ping devices in the same VLAN then you’ve enable port isolation (unlikely), put in an ACL that is denying the traffic, or there is something on the client stopping it.   If it was working before, and the only thing you’ve changed is ACLs, then I’d make sure your ACLs are defined correctly for the required subnets. ... View more

Just noticed it doesn't say (disabled) next to the name, so you should be good there. So next thing, have you tried to configure the Visibility or Availability under Wireless -> SSID availability? It should be set as the following for the SSID: Visibility: Advertise this SSID publicly Per-AP availability: This SSID is enabled on all APs Scheduled availability: disabled ... View more

@Thanhhai good to hear. I know this is basic, but its a starting points and I just want to check, have you enabled the SSID on the Wireless -> SSIDs page in the Dashboard - it's a drop down below the SSID name. ... View more

Nicely done all, great to have such an active community - and good to see @PhilipDAth back on top 😀 ... View more

@JimmyPhelan good question, and like @PhilipDAth I had to check. As Philip notes, creating a user in one network makes the user available in others, but you do have to authorise them. I also checked with a MX65W, and any users you create are available on those devices too if you set them to use Meraki authentication (again, they just need authorisation).   There shouldn’t be any compelling reason to put all your access points into one network, but as Philip notes you can if you want for reporting purposes. ... View more

Are the subnet masks and gateways configured correctly to ensure that the PCs are attempting to forward traffic to the MX. As you state, it does seem a bit odd. ... View more

So for example, VLAN 300 to VLAN 1 works, VLAN 2300 to VLAN 1 works, but VLAN 300 to VLAN 2300 doesn’t?  ... View more

Your description sounds like the VPN tunnel is up, and that your ping tests between the Meraki devices show that traffic is passing. Is it possible there is a firewall (e.g. Windows firewall) or something on the client device you are trying to ping, which is dropping the packets? ... View more

What’re you trying to ping between? If you’ve only got the default ACL it should be working fine. If you’re pinging between Windows hosts then their firewalls may be blocking it. ... View more

ACLs are processed from the top down, and processing stops when the first match is found. In your example, if you want to block traffic from VLAN 200 (10.15.16.0/20) to VLAN 2300 (10.15.224.0/23) then you'd need an ACL that is Deny IPv4 Any 10.15.16.0/20 Any 10.15.224.0/23 Any Vlan 200. ... View more

Doing a ping uses the ICMP protocol, not the TCP protocol. You'll need to change the Protocol in the ACL to Any. Also, be aware that the ACL will stop traffic from 10.15.32.0/19 to the 10.15.0.0/20 network, not just the 10.15.15.253 IP address. ... View more

If you can ping 10.15.15.254 okay, but you can't ping 10.15.15.253, then its the same issue you had before. The device that has the 10.15.15.253 IP address doesn't have a route that tells it how to return traffic to the VLAN 300 subnet. ... View more

As @PhilipDAth said, and based on my experience too, that feature doesn’t work overly well. You’ll always get some devices which are incorrectly identified.   If you really want to identify the devices then I’d suggest that you look at Cisco ISE (or one of the other third party offerings). Yes there is a price, but they’re a lot more accurate and you can tune them (and they can also offer other features too, e.g. guest workflows, RADIUS), and they’ll likely have REST APIs you can use too (I know ISE does). ... View more

It’s not uncommon to see ‘Request time out’ in a traceroute. As you suggest it’s the ICMP messages being dropped. The traceroute works by doing a ping, but with a limited hop count (which increases), but this relies on every device in the path responding to the ICMP messages - and some devices (that you don’t control) may be configured not to, but they will pass ICMP messages on to the next device. I’d guess Meraki decided there is little point being able to traceroute from an internal interface as you’d normally understand your internal network, and wouldn’t need to discover a path - but that could be up for debate. If you think it’s needed then I’d make a wish.   ... View more

@sbcoms for every Meraki network (a Meraki network is essentially a container for all the devices at a site/location) you specify the Timezone, all the reporting for that Meraki network is then shown in that Timezone. The configured Timezone for a site is also used when setting schedules for SSIDs, etc., so that you don’t need try and do any conversions. ... View more

That’s great @Thanhhai, now you just need to configure the ACLs ... View more