Ryan, I sincerely appreciate you sharing your knowledge. My root issue is the Meraki AP's filling up our Splunk license allocation, my goal is to cut back on those deny logs. At present, I'll keep client balancing disabled. Maybe later I'll re-review this to see what other options I have to either prevent AP broadcast from reaching the firewall on port 61111 or auto deleting those logs from splunk. Thank you. ... View more

This is correct. Our AP's are on a MGMT VLAN ... View more

Hi Ryan, Still seems like a heck of a lot of broadcast traffic for Cisco AP's to be sending out. The firewall rightly blocks it as the traffic isn't meant for it but the sheer amount of broadcast... something must be off. In your experience do the AP's send out this much 61111 broadcast traffic or do they identify the neighboring AP's in it's local DB and quiet down? Edit: This is outside my current network knowledge unfortunately. I need to review how broadcast frames are sent from a device, in this case 192.168.10.23 when it's part of a trunk. If it sends broadcast to all VLAN's it has access to on the trunk or not... Because over 102 broadcast frames per minute from a single AP is not normal. ... View more