I found the solution: it's a common issue with AnyConnect DTLS negotiation. You need to open UDP port 443 alongside TCP port 443 on the MX/vMX firewall. ... View more

Not possible to my knowledge. Also you would run into issues with recursive routing.   Were i you i would look into moving this NAS to another service like cloud or maybe a synology NAS that you connect to the LAN instead.  ... View more

This is absolutely what I've done, recording the ISP, carrier class and bandwidth there for easy finding. ... View more

Wow! Thanks to all of you, for making this community a good neighborhood in the tech world. ... View more

if the Internet access is lost, the static routes to the MPLS network should continue to function without any issues. The setup allows for separate routing of traffic, so even if the Internet access is disrupted, the MPLS network still be reachable through the configured static routes. ... View more

Using SAML with inline password reset enabled resolves the issue of a user's password expiring. ... View more

Hello, I was analyzing and  the network announced in the MPLS is 172.19.249.128/27 as the  graphic show, so I need to make NAT Inside over any ip in this range,( for example: 10.67.103.0/24 -->  172.19.236.128/27) in order to be able to go out with that IP to the MPLS network.  Is this configuration possible or what should I modify to have communication with the server 172.18.10.10 in the MPLS and also have Internet through the WAN1 port??  Thanks  for yout reply. ... View more

I didn't find a straightforward solution using Meraki MX since it lacks this feature.However, I previously managed this task with legacy Cisco ASA firewalls :). The workaround involves manually creating objects at the Meraki organization level for each CIDR and organizing them into object groups for each country or region, then setting up corresponding firewall rules. For instance, you can explore IP CIDR or range by country using resources like this example: https://github.com/herrbischoff/country-ip-blocks   Another consideration for the most secure approach is to eliminate this attack surface altogether and replace direct access with VPN connectivity. ... View more

Unfortunately, the dashboard event log hasn't uncovered any significant details about this issue. Additionally, the device logs indicate that the printer is unable to connect to the server.   Given recent changes in email policies by Google Workspace and Yahoo, I'll investigate the potential impact of these updates on the scan to mail service. ... View more

50 sites - I think I would just do this manually via the Dashboard GUI.  If you want to speed it up, just open 50 tabs already open to the correct page, make the changes on all tabs, and then when ready to "commit" just click "save" on each tab. ... View more

i get a fealing that many api's for switch port profiles are missing, so it it very hard to use this nice feature. I have a bigger problem than you i first need to create the profiles on over 900 individual networks, and no way i am doing that manualy. so we just have to wait for meraki to update the API's before we can use the fucntionalty at bigger scale ... View more

That is indeed a horrible situation.   I can think of a couple of strategies depending on how many spokes you have.  I would use this method if you have less than 30 spokes - and assuming you need the spokes to all be able to talk to each other (if this requirement does not exist then things get simple).   This is how I would handle it: Create newOrg and place the new devices and licenses into it. Put an MX at HQ that belongs to newOrg into VPN concentrator mode. Initially, on the new MX in newOrg create a static route for every spoke in OldOrg, pointing to the LAN IP of the MX in OldOrg, and publish all of those static routes into AutoVPN. When you move a spoke from oldOrg to newOrg, move the static route from the MX in newOrg to the MX in oldOrg (except the next hop will now be the LAN IP of the MX in newOrg).  Make sure you publish the static route in AutoVPN. This will ensure all spokes can always talk to each other. You can do this at a larger scale by publishing supernets instead.   You won't be able to get conflicting subnets, because at all times both newOrg and oldOrg will know about every route in the combined systems.   This approach will allow you to do a slow migration. ... View more

This generally isn't possible, I'm afraid.   For limited duration testing / PoC, Meraki offer free trials, which can be claimed into a separate Dashboard Organization.   Bear in mind that some architectures pretty much require a common Organization to be used:   i.e. if you wanted a test SD-WAN branch, you'd really need it to be in the same Org as the Hub MXs to which the branch MX would inter-connect. For Cisco partners, purchase of similar equipment can be done on a Not for Resale basis, with appropriate discounts. ... View more

While OSPF is supported, as per the documentation linked previously by @Badr-eddine, note the phrase 'to advertise remote VPN subnets'.    You can't use OSPF to learn the subnets on your local LAN (from a Layer 3 switch, for example) and/or advertise the default route to it.   You would need to use static routing for this - perhaps between Virtual IPs, if you want a degree of resilience. ... View more

Thank you all for the input all.  I imagine option 2 would make the the list in the firewall quite large, but maybe easier to manage and decipher. ... View more

Hello,   SD-WAN Policies : https://developer.cisco.com/meraki/api/get-network-appliance-traffic-shaping Threat Protection : I'm unsure if we have existing endpoints for threat protection ... View more

It's a shame that outgoing packets from the LAN are captured, but SITE-TO-SITE VPN packets are not. ... View more

Anytime 😜 ... View more

Worked! Thanks 🙂 I had to declare the path as './logs/'  ... View more

Hi @JGill, I recommend opening this as an MX feature request through your sales rep. ... View more

Noted.  This should be the one more about the status of the appliance.  Let me play around it,  Thanks a lot. ... View more

Thanks @Badr-eddine, the filteredNetworks actually works and has the correct data after I fixed our environment.  One of my team members had set it to v0 as a work around to another issue we are fighting with the newer API versions (mentioned in another post).  Anyway, with it set to v0 it failed but works when I set it back to v1.   Really wish we can get this figured out without having to use the "test" to filter it further, otherwise I will be the only one to run this report for the team.  Plus as I mentioned earlier, it also affects Meraki Tools as well. ... View more

There is an error in your quoting. What works for me is https://developer.cisco.com/codeexchange/github/repo/gve-sw/GVE_DevNet_Meraki_MX_Firewall_Provisioner/ ... View more