Hello all,   So I have an interesting situation I am working on. I work for a school district and we have 4 schools (a HS, MS, and two Elementaries). I am attaching a pdf network map with this post to try and assist with what I am about to describe. The two Elementary schools each have a 10g Fiber connection back to both the HS Core and MS Core. HS/MS cores are MS425-32's and the Elementary cores are MS425-16's. We have two internet connections in the district. One in the HS and one in the MS. These internet connections connect into a MX250 that is in each of these buildings. The MX250's connect back into the respective MS425-32 Core stacks. We have OSPF routing enabled which is how we are routing all of our VLANs between all the buildings.   What we are trying to accomplish is to have OSPF route our traffic out both Internet connections to sort of load balance our Internet traffic so we are utilizing both ISP connections at the same time. I know this isn't true load balancing. Now so far we have been able to get most of the way there. Both the HS and MS Cores have a static default route whose next hop ip points to the firewall in that building. Those static routes are advertised over OSPF and preferred over OSPF. Doing this caused the HS Internet traffic to go out the HS ISP and the MS Internet traffic to go out the MS ISP. The Elementaries seem to be evenly split using OSPF with one going out the HS connection and one going out the MS connection.   The issue we ran into is when we did some failover testing. We pulled the connection from the MS Core to the MS MX250. The HS continued out the HS connection and both Elementaries adjusted to route out the HS connection for Internet traffic. However, the MS just lost internet access and never routed out the HS connection which is what we expected to happen. What was odd is that the switches themselves seemed to adjust their routes because they retained their connections to the Meraki Cloud controller. The only way to fix this was to change the default route on the MS core to say "No" for preferring the default static route over OSPF routes.   I am trying to figure out a way to make this automated so that if one of firewalls goes down, connection to our cores goes out, etc. everything automatically fails over to the other functional default route. Has anyone here ever configured anything similar to this? Am I missing something here in my configuration that could be causing this? I am going to open a TAC case next week during Winter break to try and troubleshoot this but I figured I would ask here in case anyone else has dealt with anything like this.   I know this was a lot of text and I apologize. I appreciate any help or suggestions you might have. Thank you for your time.   ... View more

Hello everyone,   I wanted to ask you all about the log monitoring on the MX appliances. We have MX250's in our network and we are having a real hard time tracking down firewall/filtering situations. For example, we really need to be able to see what rules are triggering for content filtering, app blocking, layer 3 blocking, country blocking, etc. and it just seems near impossible to get this information from the Meraki Cloud Console. Many events also seem to be dropped. The console said this is due to performance limitations on the MX.   I was reading through some posts here and on other sites (reddit, etc) that the best way to accomplish this is through Syslog. I tried sending syslogs to Solarwinds and Syslog Watcher but didn't like the interface. It was still difficult to comb through. I think I may have allowed the wrong events though. The even I allowed was URLs which just gave me a list of urls being accessed by different clients but didn't tell me anything about whether they were blocked, by what policy, etc.   I was thinking of possibly using something like Graylog but I wanted to reach out to see what others are doing for this. My first question is what roles do you guys use when sending to syslog? I saw netflow there as well? Is that something that would give me what I am looking for? What software do you guys use that you like that gives you a nice ui/interface to comb through these events?   Our previous appliance was a Palo Alto which made it easy to kind of track these sort of things down. I know I am not going to be able to get back to that but I am just looking for a way to get me closer as right now every time I have troubleshoot some firewall blocking issue I feel like I am just taking pot shots in the dark trying to do pcaps and such. I appreciate your time and suggestions. Thank you. ... View more

Good morning,   I am having a really odd issue right now with one device. We are a full Meraki house with MS350 access switches, ms425 core switches, and a MX250 firewall. Our AP's are also Meraki and they are all MR46's. We are a school district and probably have around 230 AP's districtwide.   I have one Dell Windows 10 laptop that when I connect it to any SSID that is not a splash page SSID, it connects but with no internet. All internal services are working (DHCP, DNS, File Shares, etc.) but it won't go out to the internet. When I try to go to the internet, it redirects to a Meraki splash page that asks for a username and password and says "Welcome to High School - Appliance". We don't have any SSID's with a splash page setup like this. For reference, our MX250 is named High School - Appliance.   Now here is the weird part. By default, Windows does not turn on MAC randomization on the WiFi profiles. The SSID I am using to test here is a standard WPA2 PSK network with no splash pages or anything custom. It tags to a specific VLAN but thats it. If I turn on MAC randomization on the SSID profile in Windows, the device connects with no issue and is able to go out to the internet. Once I turn randomization off, it goes back to doing what it was doing before with the splash page information I listed above. It is for this reason, I think there is something on the Meraki end that is causing this. I have no issues connecting other devices to this network districtwide.   I have searched the Meraki dashboard high and low and I can't find anything that would show this device being applied a special policy or blocked or anything like that. I have a TAC case open and the TAC support engineer yesterday was doing packet captures on it and couldn't really figure out what was happening. He saw it reaching out to our domain controllers and other internal services but then saw the redirection to the splash page. Has anyone ever run into anything remotely close to this? I am about to call TAC back to try and troubleshoot more but I am running out of ideas on this. I would prefer not to have to drop this client in a special OU in AD just to apply a WiFi profile that has MAC randomization turned on. Thank you for your time. ... View more

Hello everyone. I am an IT Engineer who works for a school district that just put in Meraki Switching and is currently putting in the Wireless APs and MX Firewalls. I am trying to create a Splash Page Sign-On Wireless SSID that authenticates against my Active Directory Infrastructure. This SSID is a guest style network that is for the Staff to connect their personal devices. We do not want the students being able to connect to this. Students do have AD accounts. Setting up the SSID with the AD auth was easy but it’s the scoping I am having trouble with getting to work. For reference, I am following the official Meraki Documentation here (scoping part at the bottom). The AP’s we have are MR46’s.   Now after reviewing that documentation, I have denied the service account being used on this SSID read access to the OU’s where my student accounts are located. The OU structure looks like below:   Building OU -> Users OU -> Students OU (This is where I denied the service account access) -> Grad Year OU (this is where the actual accounts reside)   I made sure the security permissions apply to the Students OU object and all descendent objects. I have been able to confirm this account has no read access to the Students OU or anything under it by using the Sysinternals tool Active Directory Explorer. However, every time I test this, I am still able to connect as a student. I can connect as a staff account as well, but I don’t want the student accounts to be able to connect to this SSID. I have been scouring Google, Reddit, Meraki Community, etc. and I can’t figure out what I am doing wrong here. Based on everything I read, it should work the way I have it configured. Is there anyone who has set this up successfully who can offer some advice?   I ran out of time on Friday, so I couldn’t submit a ticket with Meraki. I am going to try to do that this week. I am also looking at trying to setup RADIUS via the Splash Page via this Meraki documentation, but it requires Firewall rules to allow the Cloud Controller to reach my RADIUS server via the Internet. I’d prefer not to poke holes in my Firewall if I don’t have to. On our current Wi-Fi setup, we do WPA2 Enterprise RADIUS with NPS Policies, but I like the splash page option more because it is more user friendly. It is device agnostic and doesn’t matter which device you connect from. This SSID has all kinds of devices connecting to it and they are all personal devices so MDM is not an option here.   I appreciate your time and help. Thank you. ... View more