Hi All,   It looks like it's possible to disable Advanced Malware Protection (ie. HTTP file download inspection) at a group policy level, but not Intrusion detection and prevention (SNORT) - does anyone know if it's possible to do this somehow?   Use case is a firewall with lots of guest internet users connected to one subnet that we're not interested in protecting, but we are interested in protecting admin users on a separate subnet.     Thanks,   Jonathan ... View more

Hi All,   Long, scattered post, I'll start by saying I think this will end up being an ISP issue, I'm wondering if anyone has seen anything similar.   I have a client with an Ethernet delivered Internet service, (layer 2 radio link back to ISP) terminated into a Cisco switch at the ISP.  I know it's a Cisco switch at the ISP because until recently they were sending us CDP... The service was plugged into a Cisco 1941 at the client end and working fine (no vlan, though the ISP switch has native vlan xyz configured - I could see from the CDP).  The ISP enforces 100/full rather than auto/auto. I'm trying to replace the 1941 with a MX64, so I configured the MX with the same IP / mask etc. and set the Internet port to 100/full, no VLAN tags, just as it is on the 1941.  I was surprised when it got to site and didn't work.  The link LED on the Meraki Internet port was off, as was the link light on the ISP's CPE.  I got the client to connect to the Meraki's admin page and set the Internet port to auto/auto.  The link came up (at 100/half, to be expected as the ISP end is 100/full).  Changing the Meraki to Internet port to 100/full, the link drops again.   The ISP can't / won't change their equipment to auto / auto, so i'm a bit stuck.  They have disabled CDP on their port facing us, I assume it's still configured link 'switchport trunk native vlan xyz' - not that it should matter.   Not sure where to go from here, except leaving the 1941 and putting the MX behind it, double NAT, or using a couple of switch ports to 'bridge' between the Meraki's internet port and ISP's CPE.  I can't really do much troubleshooting on the MX and can't do a packet capture as i'm not on site.  I've had the client grab the support .dat file from the local status page and I've sent that to support.    Any theories?  The ISP haven't been able to assist very much and there is a bit of a language barrier.  I'm wondering if the ISP or Meraki is reacting to BPDUs and shutting the port down, though I think it would just go into blocking rather than shutting the port down.  But this seems like more of a speed / duplex negotiation issue.  We've tried a two-pair ethernet cable in case gigabit negotiation is happening, made no difference, as well as new patch leads.  I will also try using LAN4 instead of the Internet port.   We occasionally see no settings on the MX's Ethernet page as well, I think I've seen that once or twice in the past but also a bit odd.     I'll be pushing the ISP to assist more next week but welcome any suggestions!       Jonathan ... View more