It is a good article, and it does provide links to config help.  No link to how to do it for Meraki.  Read into that what you will.   Vendor Article VMware Sample Configuration - Network Load Balancing (NLB) Multicast mode over routed subnet - Cisco Switch Static ARP Configuration (1006525) Cisco Catalyst Switches for Microsoft Network Load Balancing Configuration Example If you use VSS on Cisco Catalyst, you may experience traffic issues on one of the stack nodes. For more information, contact Cisco and mention this bug (you must have a Cisco account to access the bug). Microsoft Network Load Balancing on Nexus 7000 Configuration Example Configuring Microsoft Network Load Balancing (NLB) on Nexus 9000 Series Juniper EX Series Switches and Microsoft Network Load Balancing (NLB) in multicast mode [EX/QFX] Example - Workaround for using Microsoft network load balancing on EX4300 and QFX5100 switches HPE HP Switch 5500/5500G - How to implement Microsoft Network Load Balancing using multicasts on the Switch 5500 and 5500G Dell Dell Networking Force10 switches and Microsoft Network Load Balancing Huawei Example for Connecting a Device to an NLB Cluster (Using Multi-Interface ARP) D-Link D-Link Layer 3 Switch Microsoft NLB in Multicast Mode Configuration Example Avaya Technical Configuration Guide for Microsoft Network Load Balancing (download) ... View more

I think the question you are asking is around per-user access controls.  Is that correct?   If you use Radius you can use the Filter-Id attribute. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Group_Policies_with_RADIUS_Filter-ID   I have provided some guidance on how to do this if you are using SAML (note you no longer need to send an email). https://community.meraki.com/t5/Security-SD-WAN/AnyConnect-SAML-Group-Policy-assignment/m-p/245425/highlight/true#M54864   ... View more

Just wanted to update. Meraki replaced our switch after many different tests pointed to failed ports.  Thanks for your input! ... View more

Thank you for that write up! ... View more

Have you tested to make sure the access works internally? I.e. can you reach internalip:52115 ? and do they have the correct default gateway set on their device?  ... View more

This could easily be the end user's Internet connection.  It would be their WiFi connection. You don't mention the type of VPN you are using.   If you are not using AutoVPN, could you buy a Z4 for one of the users?  This will collect a lot of stats about the connection BETWEEN you, and also let you see the quality of the end users Internet circuit.   Below is an example of the kind of statistics that can be reported on when doing this. Of interest is MOS - which is a measure of voice quality.  You can also define performance classes when you do this. ... View more

Thanks for the input.  I appreciate it very much. ... View more

Thank you for the feedback! Much appreciated!   I will certainly add this feature to a feedback suggestion. ... View more

Meraki firewalls by default block all inbound traffic. ... View more

Ok, and yes, you need to add the MX as a Radius client.  ... View more

When you setup the configuration of the SPARE you are giving it the configuration it needs on the WAN side (just make sure the WAN is cabled up to the spare). Once you boot up the spare the configuration will be deployed to the spare. I believe the configuration is deployed to the spare via the Primary FW (assuming everything is cabled properly on both WAN an LAN side, its important that the LAN side be cabled up on both primary and spare and all VLAN's on the LAN side properly presented to both primary and spare from your switches) ... View more