We are running into an issue that seemed to show up on firmware 18.211.2. L3 firewall outbound allow rules with FQDN in destination seems to now only hit sometimes and mostly skip the allow rule. The new Firewall Log confirms this showing it is hitting the allow only every few requests. Does not matter if FQDN has single or multiple A records. Anyone else seeing this as well? ... View more

Hi @JamesPickup, yes, we got access to the beta and it works pretty well. I am a bit dissappointed in the AnyConnect (Secure Client) VPN client but that I guess that's not Meraki's fault. It doesn't seem to be possible to configure it to stay hidden at all times as it still pops up a bit here and there when changing networks (especially on trusted networks such as corporate network). If someone has more experience with the client and knows if it can be done, that would be much appreciated. I haven't gotten SBL to work yet and I am not sure if it is supported or just me struggling with the profile settings for the certificates. ... View more

@PhilipDAth wrote: >How do you usually handle these requirements?   Most of the customers gave up on the capability of having SBL to meet their compliance requirements.  One client - they had me setup AnyConnect on a second MX that used simple username/password purely for IT people to use to be able to remove join computers. I see, thanks for sharing. I was thinking of doing a similar thing as that should cover the few times where it is necessary. Perhaps Meraki will support management tunnels like on ASA in the future which is a lot cleaner than SBL. Thanks again @PhilipDAth! ... View more

Just like having definitive/absolute line numbers for rules 🙂 ... View more

Thanks for the response @PhilipDAth. I am with you on SAML being the preferred way and it works great when testing it on MX (even though we're pretty happy using machine certs and Always On VPN today). However it does not cover the use case of SBL or (management tunnels which are still ASA only) to allow clients access to on-prem DC in case of remote onboarding or credential cache updates. It also seems to be impossible to have multiple/different AnyConnect VPN profiles/authentication methods on the same MX so we cannot easily setup an alternative profile just for cases where SBL is needed. How do you usually handle these requirements? P.S. I might be slow, but I do not see how you can choose Certificate-only in the Authentication Type option and the AnyConnect Authentication Methods page says that it is in beta (see screenshot). Am I missing something obvious? ... View more

Anyone got any news on this endpoint? As of 2023-06-22 it still does not work and it's still in the AnyConnect documentation, but not in the API docs. ... View more

So it is 2023-06-08. When will we get an actual device status/data history? A table of all the events which can be sorted and filtered would be nice. Perhaps even add this to the event log? ... View more

Just a heads up for anyone in the future, there is (still) no support for this as of 2023-05-24 according to Meraki support. I requested it and sent feedback. ... View more

Hi, the email I received from Meraki regarding the MX 18.105 update also mentioned support for the following: "- Added support for configuring VPN exclusion rules for non-Meraki VPN peers". This is however missing from this post and in the firmware upgrade page on the dashboard. Could you please elaborate if this support is added or not and preferably some documentation on this new feature? ... View more

@ww wrote: I guess so. Did you log a support case ?   Would use the api to backup the rulebase, then push the new one Yes. I created a case where they acknowledged that it is broken and gave the regular make-a-wish-foundation spiel: I understand and share your frustration as we see the same first 4096 characters of the entire outbound firewall ruleset. The length of any field in the change log is capped at 4096 characters. I would suggest using the Meraki dashboard to "make a wish" and submit a feature request. You can submit a feature request at the bottom of any dashboard page. Any wish that is made, sends an email to our Product Managers and Development Teams. These wishes are considered and used to help shape our product roadmaps. The most wished-for items are incorporated into product development. ... View more