Cloud Monitoring for Catalyst Onboarding documentation    To utilize Cloud Monitoring, all Catalyst switches that will be added to the dashboard must have an active DNA Essentials or DNA Advantage license ... View more

Cisco Secure Connect, Cisco's SASE solution could be a great option to ensure availability of your cloud resources without the need to come back to the on-premise MX. Or you could configure the vMX as a backup server in Anyconnect maybe? (I'm not sure if this would work)     For on-premises resources, consider utilizing a secondary WAN uplink and add another internet circuit for a redundant connection. For a loss of power consider utilizing a UPS/Generator as presumably you're on-premise infrastructure wouldn't be available as well without power. For an MX failure you could utilize an MX Warm Spare in a HA pair.   By understanding a bit more about your environment, I can better offer some solutions:   Are all critical applications hosted in the cloud, on premise or both? Do you have a DR site with hot restore capability for on premise infrastructure? Is there an MX at this location? How are users connecting to cloud resources? VPN into MX and using SD-WAN VPN tunnel to vMX in Azure? ... View more

Not tested of course, but I'd imagine the LinkedIn app would cease to function so long as you were connected to the organization's network either via category or a URL block. My assumption based on my limited knowledge of app development would be that the app needs to communicate with LinkedIn.com domain to function.   If you wanted to truly block the app from even install you would have to be managing the device in SM (or other MDM)    Also, Alemabraho is correct, blocking by category may have unintended consequences of blocking sites included in that category that you DONT want to block. My assumption with the goal of blocking LinkedIn was that other professional networking sites would want to be blocked as well. If you strictly want to block one site, URL blocking is the way to go.   However, with URL blocking, you only block that specific domain and in this example LinkedIn's CDN domain, licdn.com, would not be blocked. (But is included in the Professional Networking Category!) ... View more

I'm assuming you are using RADIUS as you are a K-12 school. Do you have a session timeout or reauth period configured? ... View more

I could be wrong but, I believe that it will use the Apple VPP account associated to deploy apps via SM unless you are using Apple School Manager. ... View more

You can access the device local status page by navigating to the IP address of the device or by navigating to any of the following links depending on the type of device: MR - http://ap.meraki.com MS - http://switch.meraki.com   MX - http://mx.meraki.com or http://wired.meraki.com MG - http://mg.meraki.com Any - http://setup.meraki.com or http://my.meraki.com There are some configuration options available depending on the type of device (ie MX, MS), but they are very limited.   The username for devices that have default authentication credentials or have not fetched configuration will be the serial number (upper case letters and dashes) with no password. Authentication credentials should be changed to have a strong password after their initial use. Please see the Changing Log-In Credentials section below.   The short answer is you should really do any/all configuration in the Meraki Dashboard. ... View more

No, this is not supported. From: AnyConnect On the MX Appliance Documentation    AnyConnect on the MX does not support multiple VLANs or address pools for Client VPN users.    However, you can use group policy to restrict/permit access to VLANs/subnets based on the user. I see you are using RADIUS. In the linked documentation above it shows you how to set group policy based on the RADIUS Filter-ID. ... View more

Do the iPad's have a cell chip? If so - try turning off WiFi assist.  ... View more

Nice job all - so little unanswered topics 😁 ... View more

I was having this issue as well. Turns out it is a known issue, and the SM Engineering team is working on resolving. Reached out to support and they suggested the only workaround was to factory reset and re-enroll the device. ... View more

You need to configure captive portal detection/remediation depending on your connect failure policy. If you have: Always-on enabled The connect failure policy is closed Captive portal remediation is disabled (default in always on environments) Users will be unable to connect if a captive portal is detected. If you have: Always on enabled Connect failure policy set to open You do not explicitly need to allow captive portal remediation and the end user will be required to remediate the captive portal. If you have: Always on enabled Connect failure policy set to closed Captive portal remediation explicitly allowed in the VPN profile End user will be allowed to remediate captive portal. Related Documentation    ... View more

Yes, especially if you have always on enabled. Related KB Article    If Always-On is disabled, or if Always-On is enabled and the Connect Failure Policy is open, the following message is displayed on each connection attempt: The service provider in your current location is restricting access to the Internet. You need to log on with the service provider before you can establish a VPN session. You can try this by visiting any website with your browser. The end user must perform captive portal remediation by meeting the requirements of the provider of the hotspot. If Always-On is enabled and the connect failure policy is closed, captive portal remediation needs to be explicitly enabled. If we open captive portal we open our company to a vulnerability. How so? FWIW, always on VPN causes more trouble than it's worth most of the time.   ... View more

  Allow captive portal remediation Many facilities that offer Wi-Fi and wired access, such as airports, coffee shops, and hotels, require the user to pay before obtaining access, agree to abide by an acceptable use policy, or both. These facilities use a technique called captive portal to prevent applications from connecting until the user opens a browser and accepts the conditions for access. If always-on VPN is enabled, the connect failure policy is closed, captive portal remediation is disabled, and Anyconnect detects the presence of a captive portal, the AnyConnect GUI displays the following message once per connection and once per reconnect: “The service provider in your current location is restricting access to the Internet.” “The Anyconnect protection settings must be lowered for you to log on with the service provider. Your current enterprise security policy does not allow this.” Captive portal detection is enabled by default, and is non-configurable Captive portal remediation is the process of satisfying the requirements of a captive portal hotspot to obtain network access. By default, the connect failure policy prevents captive portal remediation because it restricts network access. You can configure AnyConnect to lift restricted access to let the user satisfy the captive portal requirements. You can also specify the duration for which the client lifts restricted access If the connect failure policy is open, users can remediate captive portal requirements. The captive portal remediation feature applies only if the connect failure policy is closed and a captive portal is present.   KB Article  ... View more

Right - I understand, but my questions still apply. How was the device added to ABM (configurator?)   Confirm in Apple Business Manager that the iPad is assigned to the correct MDM server for Meraki. In Meraki go to Systems Manager > ADE and confirm the device appears after hitting "full sync" in the upper righthand corner. Select the device and ensure it also has the correct "settings" assigned for setup assistant. If all above is correct, attempt to restore the iPad using iTunes and recovery mode and attempt to enroll via setup assistant again. ... View more

Is the iPad up to date? Have you tried restoring the iPad?    Was the iPad previously owned by another organization? ... View more

On SM v. Intune   We used to have a ton of iOS devices in Meraki SM and we recently migrated them to Intune. Our configuration is pretty basic and was far easier to set up in SM than Intune. ... View more

Me as well... Hoping that it is supported in the future. ... View more

Winner winner chicken dinner. ... View more

I'd reach out to your ISP to see what options you may have. Outside of @alemabrahao 1:1 NAT solution I can't think of anything else off the top of my head. ... View more

Can you setup IP Passthrough on the ISP's router? ... View more

If you are using IPsec, can you use the hostname in the Client VPN settings? ... View more