We are using AnyConnect for Azure Hybrid domain joined devices.  We have a request to allow a few Intuned iOS iphone devices onto client VPN so they can view cameras.  Has anyone worked on a similar request? If so, what is the path of least resistance?   My original thought was reserving IPs to specific devices on client VPN and just use some ACLs but I don't see how to do that in Meraki.   Should I consider creating separate VPN profiles for these devices and setup split tunneling?   Thank you for your input.  ... View more

Hi Community, I have a frustrating issue at on offsite data center:  Did a firmware upgrade on my switches from 17.1.3 to 17.2.1.1 and after the reboot my Cohesity cluster has two nodes that are not getting link.  I've tried rolling back the firmware and then when that didnt work I reinstated it.  Called Meraki support and they recommended we go on site, try other cables and swap them around.  I have a handful of these cables and not a single one worked.  I did however get link when I connected the non-working nodes to the two SFP ports that were up. That of course led me back to the switch.  I have 8 available ports on two different switches and non will accept the connection.  What gives!  I also overnighted two new DAC cables from FS with luck.  Meraki of course is recommending their approved cables via the documentation.  Anyone else have these challenges.  They have been working for 2 years, and I have 4 working with no issues at another datacenter.  Cohesity does not care what cables you use.  In fact, they have no guidelines telling you what to use.  I spent two hours on a call with them, and they said t was nothing on their hosts. I would greatly appreciate some guidance.  Is the next step to buy Meraki certified SFP modules?  They don't exactly have recommended DAC cables.  I would love to know if others have had issues like this with Meraki switches.   Here are the cables we have: Amazon.com: 10Gtek 10G SFP+ DAC Cable - 10GBASE-CU Passive Direct Attach Copper Twinax SFP Cable for Cisco SFP-H10GB-CU3M, Meraki MA-CBL-TA-3M, Ubiquiti UniFi, Netgear, Fortinet, 3-Meter(10ft), 4-Pack : Electronics   FS: https://www.fs.com/products/30862.html?attribute=8722&id=2354432   ... View more

Does anyone have experience implementing NLB from a Windows Server in IGMP Multicast mode in a Meraki environment?   We have a partner that will be coming into our network to communicate with two Windows Servers running NLB.  There is a ton of information out there with Microsoft's website and from the Meraki side.  I have not tested it yet but since Meraki doesnt support static ARP entries, I am thinking I need to configure IGMP Multicast for this to work.  Before going too deep into the environment, does anyone have experience with it and successfully turned it on?  Essentially the servers reside on Meraki MS225s, through an MX105 then uplinks through a MS120 WAN switch to the ISP gateway. ... View more

I know this comes up a lot, but I still struggle with making sure our services will work.  With Meraki blocking all inbound traffic by default, how can I go about making sure a long list of FQDNs wont potentially get blocked?  We are implementing a new cloud voice contact center solution and the provider gave us a list of 70+ FQDNs that they say must be allowed.  I called Meraki support and we discussed the new Early Access feature called NAT Exceptions with Manual Inbound Firewall.  Aside from some new feature set that I am not familiar with, what do other admins do in these situations?     ... View more

Hello! We have a vendor that needs to come into our network to reach a LAN device on port 52115 and they requested to use an inbound SSL connection.  The concept I put together is create a public DNS A record to one of our internet ports on our MX. I secured an SSL cert from Digicert and installed in on the LAN server.  Then, I created a port forward rule using the uplink WAN address used in the DNS record, TCP as the protocol, the public port as 52115 to our internal LAN IP and port 52115.  I also included the Allowed remote IPs in the port forward rule too.  The vendor has tested and is getting timeouts.  They are essentially typing in https://DNS_NAME.mydomain.com:52115 when they program a POST request to URL.     Does anyone have any experience with these types of configurations?   Thank you so much. ... View more

Hello Everyone,   We've been dealing with lots of QOS issues to our remote workers.  I am down multiple rabbit holes trying to figure out a means to gain more stability in the connection.  I have my ISP involved as I believe it is the ISP.  The end users who is remote are typically customer support folks on the phones. They will let us know their connection to the phone system indicates it dropped or they lose a call etc.  When this happens we are noticing in many cases the primary uplink is changing. We've also noticed our uplink statistics show small packet loss .5, .8,1,1.5,2.  This morning I have seem 8 instances of packet loss.  We were measuring to 1.1.1.1 and 8.8.8.8 but have since change it to our ISP's gateway and Umbrella's DNS. Called Meraki 3 times and said they believe i need to get in contact with the ISP to run tests on our circuit.  That was scheduled last night but have not head back from them yet.   One thing I've noticed is our uplinks are not load balanced and I asked my manager why and he said they never enabled it because our primary uplink is a 500mbps circuit and secondary is 70mbps with burstable options.  The circuit that has been the problems for us is the 500mbps.  There is no saturation of the link, it is under utilized.  Also the change over from primary to secondary is so quick, that I wish that it wouldn't switch over because i wonder if it would at least keep our phone calls and VOIP server established and just create a little bit of noise on the line. ... View more

Good Morning,   This should be a straight forward question.  We have been using Client VPN with IPsec Settings configured and users are using Windows Always On VPN and is using its own subnet.  We have a desire to get AnyConnect working while our users still use the Always On VPN.  When I go to enable AnyConnect, it asks for a subnet.  Do i have to create a new subnet or can I use the same subnet our traditional VPN has been using?   Thanks! ... View more

Probably a simple question so here goes.  We just configured a site to block everything except the US and Canada and learned that a specific IP in Australia needs to be allowed.  As a quick fix, I added Australia as an allowed country.  How would I go about prohibiting Australia but allowing a single IP from the country? ... View more