On the Network template if you navigate to Security & Sd-wan. Then select Content filtering type https://dns.google/ in the URL box at the top and check. It will show you DoH and DoT are blocked under Category blocking.    Adding in case anyone else has the issue  ... View more

Hi Chris,   Thanks for the update. I have a couple of questions though.   1. Is the User Authentication via the Splash page for Entra ID only available with MR Advanced licenses? If so, could you clarify why this is the case, considering that the Google authentication via the splash page is available as part of the Enterprise license?   2. Based on our experience with the Meraki Splash page, clients have difficulty getting redirected to the splash page, primarily due to encrypted traffic (HTTPS). Users often have to perform extra actions to trigger the splash page, which feels a bit clunky. While I understand this is a common challenge with captive portals in general, has Meraki looked into improving this user experience to make the redirection process smoother?   3. I'm also intrigued by the EAP-TLS authentication method. It seems that customers would need a RADIUS and PKI infrastructure, where the identity from the certificate (such as name or email) is checked against Entra ID to validate the user. Or are we looking at a much simpler setup? ... View more

We're getting this behavior now with an MX450 on 18.107.8.  Anyone else experiencing this now? ... View more

I notice you are using WPA3 (wpa3-802.1x).  I have not found WPA3 mature enough to deploy into production environments.  I would drop back to WPA2 and wait 12 more months.   Windows itself has WPA3 issues.  Microsoft is scheduled to release the fix for that in April 2024. ... View more

That makes complete sense to me.  🙂 ... View more

See here:   https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Troubleshooting_Packet_Loss_Between_Devices   ... View more

We are a school that just this past summer converted to all Meraki equipment.  We have a high density environment with 196 MR57s scattered across 11 buildings and are seeing all the same things everyone has been seeing ( massive unexpected disassociations, constant roaming of devices that are standing still, repeated disconnects and inability to reconnect making it impossible to have zoom calls, constant eapol timeouts, repeated connections to an AP "for a few seconds").     We have upgraded to 30.5 and it seems to have made dent into the connection problems we've been having.  It's not perfect by any means.  We still get some disconnections and looking at our connection log, there are constant authentication failures due to eapol timeouts.  Has anyone else tried 30.5? ... View more

Hi We had the same issue and it was because we reused an old SSID. Disable the SSID with the problems and create a new one with the same config. ... View more

We're using WPA3 and our radius server is NPS on Windows Server with a local AD. ... View more

I also know with Windows devices, it's always best to make sure you have the latest drivers for the WiFi NICs. Those have fixed many issues I've had with Windows devices not behaving as expected when connecting. ... View more

Behaviour similar to what you’re seeing:   https://cantechit.com/2015/07/06/meraki-mx-the-block-page-and-dns/ ... View more

This is 802.11v refusing the association (therefore, trying to get the client to try another AP as its current utilisation is too high). If you have your WLAN designed correctly, the client should be able to find another AP to associate, so it shouldn't be a problem.   802.11v is great, and you should use it as it'll try to balance out your clients, and your clients will use the info to choose the best (rather than the loudest) AP to connect to. The issue you'll have with 802.11v is when it's used without a good WLAN design. I design with at least 3 APs at any time for a client to use, especially if it's a Wi-Fi-first environment with many users trying to use real-time applications. This is even more important if you have QoS enabled, as you restrict the available contention window. For instance, Cisco recommends only having 12 active voice clients per channel. ... View more

Just checked in my dashboard and it seems fixed as well for me.  I still haven't gotten any response to my case from them however. ... View more

Esto se debe a que manejas Rutas estaticas, a todos los usuarios que pertenezcan a segmentos de rutas estaticas no podras visualizar el trafico de red, las politicas de grupo no aplican para rutas estaticas por consiguiente solo le aplican las de Content Filtering. Intenta conectarlo directamente al mx configurando el pto como access y valida  De esa manera veras las url que bloquea el MX ... View more

It looks like the webpage is either doing a redirect or loading an iframe which is blocked - itfbodn.com ... View more

Thanks for the info.  We do have the proxy avoidance filter being used.  We're trying to monitor and block students from getting around our content filtering.  If the MX is really blocking DoH and DoT then shouldn't everybody not be able to get to any website?  I'm going to have to review how DNS works again.  I thought I understood it. ... View more

Sucks not knowing why it doesn't work.  I was hoping to learn more about vpn technology and protocols but going to AnyConnect worked. ... View more