@PhilipDAth wrote: >How do you usually handle these requirements?   Most of the customers gave up on the capability of having SBL to meet their compliance requirements.  One client - they had me setup AnyConnect on a second MX that used simple username/password purely for IT people to use to be able to remove join computers. I see, thanks for sharing. I was thinking of doing a similar thing as that should cover the few times where it is necessary. Perhaps Meraki will support management tunnels like on ASA in the future which is a lot cleaner than SBL. Thanks again @PhilipDAth! ... View more

Just like having definitive/absolute line numbers for rules 🙂 ... View more

Thanks for the response @PhilipDAth. I am with you on SAML being the preferred way and it works great when testing it on MX (even though we're pretty happy using machine certs and Always On VPN today). However it does not cover the use case of SBL or (management tunnels which are still ASA only) to allow clients access to on-prem DC in case of remote onboarding or credential cache updates. It also seems to be impossible to have multiple/different AnyConnect VPN profiles/authentication methods on the same MX so we cannot easily setup an alternative profile just for cases where SBL is needed. How do you usually handle these requirements? P.S. I might be slow, but I do not see how you can choose Certificate-only in the Authentication Type option and the AnyConnect Authentication Methods page says that it is in beta (see screenshot). Am I missing something obvious? ... View more

Anyone got any news on this endpoint? As of 2023-06-22 it still does not work and it's still in the AnyConnect documentation, but not in the API docs. ... View more

So it is 2023-06-08. When will we get an actual device status/data history? A table of all the events which can be sorted and filtered would be nice. Perhaps even add this to the event log? ... View more

Just a heads up for anyone in the future, there is (still) no support for this as of 2023-05-24 according to Meraki support. I requested it and sent feedback. ... View more

Hi, the email I received from Meraki regarding the MX 18.105 update also mentioned support for the following: "- Added support for configuring VPN exclusion rules for non-Meraki VPN peers". This is however missing from this post and in the firmware upgrade page on the dashboard. Could you please elaborate if this support is added or not and preferably some documentation on this new feature? ... View more

@ww wrote: I guess so. Did you log a support case ?   Would use the api to backup the rulebase, then push the new one Yes. I created a case where they acknowledged that it is broken and gave the regular make-a-wish-foundation spiel: I understand and share your frustration as we see the same first 4096 characters of the entire outbound firewall ruleset. The length of any field in the change log is capped at 4096 characters. I would suggest using the Meraki dashboard to "make a wish" and submit a feature request. You can submit a feature request at the bottom of any dashboard page. Any wish that is made, sends an email to our Product Managers and Development Teams. These wishes are considered and used to help shape our product roadmaps. The most wished-for items are incorporated into product development. ... View more