I got it sorted and wanted to say thanks for your support. The issue came down to the Mac Wi-Fi certificate setup. Initially, the profile pushed to the Macs was missing the intermediate and root certificates, and simply setting the device cert to "Always Trust" did not work as expected. After uploading both the intermediate and root certificates, the device certificate was successfully trusted, and AnyConnect was able to recognize and use it correctly. now i just need to work with the WorkSpace one guys to create a new profile that we can push out to get everyone these certs! thanks   ... View more

so this is only for the Certificate authentication. the secure connection between the mx and anyconnect is useing the dynamic DNS hostname and the auto-generated server cert. and if i remove the cert Certificate authentication requirement the macs can join no prob   ... View more

  Set up a VLAN for the /30 subnet: Assign one IP from the /30 subnet to the switch. This VLAN will handle the traffic between your ISP and your network, acting as a point of ingress and egress. Create a default route: Set a default route on the switch pointing to the ISP’s gateway within the /30 subnet. This ensures that all outbound traffic from your network that doesn’t have a more specific route will go through this gateway. Configure a second VLAN for the /29 subnet: Assign another IP from your /29 subnet to the switch. This setup will serve the devices that require external access or are part of a DMZ, like servers or firewalls. Assign IPs to firewalls: Give each firewall an IP from the /29 subnet. The default gateway for these firewalls would be the /29 IP on the switch. This configuration allows the firewalls to communicate directly with the external network and manage traffic accordingly. redundancy: To avoid a single point of failure, it would be ideal to use two switches in this configuration. This way, if one switch fails, the other can take over, maintaining network availability. this all assumes that your MS 250 is not doing any l3 routing currently      ... View more

yeah getting a /29 on the wan Easiest. but since you have /29 for the Lan IP, you can have your /30s terminate on each DMZ switch / edge switch. Then route your /29 behind that so DMZ will have 1 ip from the /30 and one ip from the /29. your 2 firewalls will use the DMZ /29 as there default gateway and each firewall will get a ip from the /29 and use one for the VIP if you want to use that. ... View more

looks like its api ... View more

Iv seen logicMonitor but never dove in to it but yeah this looks like its Covers my requirements. Do you know how it integrates with Meraki Is it via the api Or is it snmp? ... View more

I can totally relate to your struggle with the Zabbix API integration. I tied to get it working and was unable, and the documentation doesn't always provide the clearest instructions. I remember encountering the "uplink not found" error. Checkmk's also has a Meraki API integration, but iv encountering problems with it too but they say its a new thing and there working on it. Sometimes, these integrations can be a bit challenging until they mature. SNMP v3 polling across the tunnels is what im working on now. However,it might be causing some strain on the CPU load. ... View more

Never mind no need to check if its right the scrip should just correct.   I'm now just doing a  +++++++++++++++++ try:     dashboard.networks.createNetworkGroupPolicy(         networkId=network_id,name="Guest", scheduling={'enabled': False},         bandwidth={"settings":"custom","bandwidthLimits":{"limitUp":25600,"limitDown":25600}},         vlanTagging={'settings': 'custom', 'vlanId': '80'},         firewallAndTrafficShaping={'settings': 'custom', 'trafficShapingRules': [], 'l3FirewallRules': [{'comment': '', 'policy': 'deny', 'protocol': 'any', 'destPort': 'Any', 'destCidr': '10.0.0.0/8'}, {'comment': '', 'policy': 'deny', 'protocol': 'any', 'destPort': 'Any', 'destCidr': '172.168.0.0/16'}, {'comment': '', 'policy': 'deny', 'protocol': 'any', 'destPort': 'Any', 'destCidr': '192.168.0.0/16'}], 'l7FirewallRules': []},         bonjourForwarding= {'settings': 'ignore', 'rules': []}     ) except:     dashboard.networks.updateNetworkGroupPolicy(         groupPolicyId="106", networkId=network_id,name="Guest", scheduling={'enabled': False},         bandwidth={"settings":"custom","bandwidthLimits":{"limitUp":25600,"limitDown":25600}},         vlanTagging={'settings': 'custom', 'vlanId': '80'},         firewallAndTrafficShaping={'settings': 'custom', 'trafficShapingRules': [], 'l3FirewallRules': [{'comment': '', 'policy': 'deny', 'protocol': 'any', 'destPort': 'Any', 'destCidr': '10.0.0.0/8'}, {'comment': '', 'policy': 'deny', 'protocol': 'any', 'destPort': 'Any', 'destCidr': '172.168.0.0/16'}, {'comment': '', 'policy': 'deny', 'protocol': 'any', 'destPort': 'Any', 'destCidr': '192.168.0.0/16'}], 'l7FirewallRules': []},         bonjourForwarding= {'settings': 'ignore', 'rules': []}     )   for each GP and adjusting per GP ... View more

do you want each guest to have access to 50 or do you want the guest network to only get 50? sounds like per ssid and not per client ... View more