I agree, filtering to just your products would be a great idea for sure!   And yet, because we have a bunch of MS390s... I like the "shame" factor of showing ALL THE BUG the MS390 still has. Especially when they put in the notes that the issue has been around since version 12. It makes me wonder / worry, will Meraki ever resolve these bugs? Do they care? Will they only resolve these bugs when they discontinue the MS390 and move on to something else?   It feels like Meraki's heart is not in the MS390... And I get it, it's a new unique model / platform (taking a Cisco switch and slapping Meraki code on it), so yeah, writing code for it is probably more challenging for sure. But to have 10x the amount of bugs vs other Meraki switches is hard to accept as a customer, especially ~3 years into the deployment now. ... View more

Also MS does not have a limit to the number of clients in a network that can have a group policy ACL assigned, the limits stated in your initial post are based on static assignment done in dashboard that is applicable to MR and MX. If you were to assign group policies by RADIUS on MR and MS there would be no specific limit.  ... View more

Thanks for the invite to talk @merakisimon !  Fun topic to discuss. ... View more

Connecting an appliance to both DNAC and Dashboard is not supported today. We are investigating a means to provide the functionality but have some firmware limitations we have to investigate further.  ... View more

And don't Kudo me for sharing this... Kudo @WirelesslyWired on his comment for making it especially if you appreciate it. ... View more

Has Meraki produced documentation for this yet?  We just turned on a number of alerts for our network and are tweaking them to see what works for us.  I read this thread earlier and we decided to get weekly alerts.  For this week we have 3 alerts at 3 different offices.  One is here at our HQ and I was able to find who it is and verify there was no issue.  But the other two are clear across the country, and one of them is on wifi so I can't cycle the port as suggested above.  How do we troubleshoot these alerts to determine whether it's a false positive or a legit concern, without physically going to the device and looking for vmware (which shouldn't be on it based on group policies anyway)? ... View more

Meraki has not implemented MST at all.  It has implemented RSTP.   You use MST on Cisco Enterprise switches in a mixed Meraki environment because MST is compatible. ... View more

Is it a possibility you just have alot of STP TCN BPDU's in your Cisco network that the Meraki switches are just complaining about? If you have many TCN's in your Cisco network you should ensure all endpoint ports are running in portfast/edge mode so a pc shutting down or booting does not cause a TCN throughout your entire network. Only switchports running between switches or switchports to an MX should not be in portfast/edge mode. ... View more

after checking no user (connected to a port) of our network is connected to the radius ... View more

Thanks!! ... View more

This feature is for Named VLANs to VLAN ID mappings for RADIUS. We definitely do want to leverage this further down the road for more than just simplifying RADIUS deployments. Please use the feedback button at the bottom (that we for some reason renamed from make a wish) and let us know there if you wouldn't mind.  ... View more

Hello!   I've been doing some more testing and thinking about this and I've run into a design consideration issue.   I've concluded (unless I'm mistaken) that it's not possible to reach the IP address the MS390 use for communication with the cloud via the route which I distribute through OSPF. It is possible to reach the IP address of the interface I've setup as an additional interface on the MS390 which is part of the same subnet as the IP used for cloud communications which is setup so that I may redistribute the subnet throughout the OSPF domain. Is this behavior specific to MS390?   EDIT: Since MS390 isolates the control traffic from the data traffic it is not possible to reach the mgmt IP via the OSPF route (even if the SVI created in the MS390 to enable the route to be propageted throught OSPF lies within the same subnet), you're essentially creating a dual-purpose subnet/VLAN with some form of segmentaion invisible to the user, it would make more sense not to allow it at all I think. This also creates a little bit of a problem regarding management since you have to resort to static routing for the mgmt features to work as expected. I can see the benefit regarding security, but it should be an option to let the designer of the network take proper measures to secure the mgmt plane themselves.   Imagine we'd like to use the subnet which is used for cloud communications for some internal service, for example SNMP. This means that we have to setup an additional IP address for every MS390 used as a L3 device on the subnet which means that we have to use 2x IP addresses per device if we want to achieve this, is this correct?   We could also define a new subnet which is used for internal management services such as SNMP, but if we consider that we might want to expand to using MR devices which can only hold a single IP address. Then we'd have to use different designs regarding management of these devices based on what the hardware is. So for example 1 subnet for cloud communications and another for the internal services on MS390 (or dual IP addresses) and then a single subnet for cloud communications and internal services for MR type devices. Would this be the correct assumption? ... View more

Oh cool, does that mean the MS390 is utilizing the device sensor feature from the catalyst underlying switch? ... View more

I don’t believe there is a way to disable the wireless radios on the MX-W devices. The best you can do is under Security & SD-WAN -> Wireless Settings set all the SSIDs to Disabled, this means the MX won’t be advertising anything but I don’t believe it actually powers off the radios. You may want to check with support to see if they have a backend way to turn them off. ... View more

We are working towards bringing adaptive policy to the MX and should support most of the current platforms out today from a hardware perspective. Official support has yet to be determined but we are hoping for a beta of SGT being carried over AutoVPN on MX sometime Q1 FY21.  ... View more

ISE is not required but does make assigning SGTs to an Access_accept incredibly easy. You can assign tags in a few ways. 1. Statically to a switchport or an SSID, dynamically via RADIUS av-pair, and in the near future, you will be able to create Network Object Groups and map them to SGTs as a fallback tagging mechanism. ... View more

I found the gnome!   ... View more

By way of introducing an element of future proofing, I run Cat 6A cable ( 10GBASE-T up to 100 metres). It is noticeably stiffer than Cat 6 and requires a larger turning radius, which took some unexpected implementation adjustments, which may render the contractor's objections to 3-inch conduits nugatory.   Virtually all WAP vendors advertise fictional speed/capacity specifications. They have a system for calculating it. They calculate the maximum simplex speed for each radio under ideal and theoretical laboratory conditions (WiFi is Simplex) and then add the values together. However, the link between the AP and the switch is Ethernet full duplex. Then when you make adjustments for real world conditions you tend to find that a WAP rated at a 2.53 gbps radio rate is not limited by a 1 Gbps link in the real world.   Having had to audit the December 2016 ITU conference report,  I would be overly concerned about 5 GHz use by WiFi; access to that part of the spectrum is sought by a lot of industry sectors and special interest groups, I look forward to obtaining uncontested access to the 60GHz portion of the spectrum. The Koreans and the Japanese are making huge advances in overcming distance limitations. We are probably just as much overdue for a switch from copper to fibre as we are changing from IPv4 to v6. ... View more

Try downgrading to 24-12. I have a customer where this is happening and a downgrade to 24-12 fixed it for the time being.  ... View more

Thanks for the input PhilipDAth. ... View more