@AnythingHosted wrote: This is my issue as well. We have a mix of MR33s + some older MR24s/MR16s for a client.   I have tried the 25.5/6 on our office network (two MR52s) and found that MacBook Pros and some iPads will simply not connect to the wifi. We reverted back to the latest production version and no problems.    Not sure I really want to take that risk for production kit not at our office.  @AnythingHosted - Interesting. We are running MR52's here on version 25-7 with no issues. Im on a mac posting right now from the Wifi. ... View more

You weren't able to just update all the AP's to 25-7? I was able to upgrade both my MR72's and MR74's on the network to 25-7.  ... View more

A power cycle by physically unplugging is what allowed them to come back online, with the new firmware.  ... View more

So Id assume then that these switches are configured with static IP's then?   In general it sounds like you need a MX instead of a MS and install USB cellular cards for failover.    If its one device - this would probably do the trick - https://meraki.cisco.com/products/appliances/z3  ... View more

A MX  WAN port  needs to be changed locally unless it already has a network connection, then it can be changed from the dashboard.  A MS can be changed as long as it has connectivity to the cloud, no local page.    If that didn't answer your question - can you explain a little more in detail the network design and what IP is changing.  ... View more

@confuzzled Ok so this drawing is with alot of assumptions BUT the general jist I want to show is, 10.x.x.0/8 is being used for all internal connectivity only and from a security standpoint - wouldn't be allowed out to the internet, mostly because it wouldn't need to be.   The hang up with the Meraki is, Meraki needs to be able to access the internet or it will not work. Normally with a MX this is never an issue since its usually the device directly connected to the internet, however, in your environment, your "internet" in the eyes of the MX since you are configuring the WAN interface is actually a larger LAN segment and on top of that, that network space isn't allowed to the internet.   Why can your computers in your offices network access the internet, because they are a separate network being advertised  and routed via the 29xx   This is probably achieved via sub interfaces on both the ASA and the 29xx - information here - https://www.networkstraining.com/how-to-configure-vlan-subinterfaces-cisco-asa-5500-firewall/ ... View more

@confuzzled   Im going to draw up a network diagram of what i expect the rest of your network looks like, i think that will help us figure it out but a thought on a quick a dirty work around, hook up a Cellular connection to it with a ethernet converter, something like . a cradle point ( https://cradlepoint.com/products/cor-ibr350 )  - This will allow you to get connected to the Meraki cloud and then just under traffic shaping, send all your network traffic to your other WAN connection.   Standby on the network map.  ... View more

@lpopejoy wrote: Ok, so apparently if you want to see what version of firmware you are actually running, it will, in fact, require support to verify this information for you.    On this particular network, the appliance was running v10.  That's right.  Yes, v10.  Yes, deprecated firmware.  No, nothing was telling me this.  The dashboard was saying 12.24 "firmware up to date" AND allowed me to update to 13.24 and showed that it was also up to date.   The reason for the excessive bandwidth use is that the MX has been trying to download the latest firmware update since last week when I pushed 13.24.  Before that, I can't say what was going on, unfortunately.  Well thank you for clearing that up - Guess i'm going to contact Meraki support and have them verify firmware versions as well as going forward after I perform them.    Im going to bring this up with my Account rep and i suggest you do to, get this sorted so we can actually know firmware has been applied.  ... View more

"Now that I think is exactly what I was looking for. The difference I can't seem to get anyone to tell me "why". So if that is correct, then I ask this question - "WHY"? Why? Why does an ASA "pass along" traffic to .17 and the MX says "noooo"?"     The answer to your why is, You are giving the Meraki a network 10.x.x.16/29 with IP 10.x.x.18/29 on the WAN port, this is taken as the network the Meraki uses to access the www (Meraki cloud) to get its configuration, confirm it is online and licensed and  once all that is done, it can be on its merry way of working for you. The hang up, 10.x.x..16/29 does not have access to the internet. So your solution is to Request that 10.x.x.16/29 have internet access or use a different subnet that does in fact have access to the internet, something your Sys level 3 admins can help with. Since this is a larger project i think you said, probably a sit down meeting with them do design it out.  "So in basic networking terminology; the MX is designed to basically ignore TCP/IP principles, and the ASA isn't?" - Negative - this is not the case.  ... View more

@confuzzled wrote: @Tat0rt0t,   "Your verbiage is correct. Thats exactly how they describe their 10.x network, internal only and "they aren't routing it". But if thats the case, then why on earth can the ASA get to the www and the MX can't?!"   This is because the ASA doesn't need to access the internet from that network(10.x.x.16/29) where the Meraki does, the unfortunate difference - All the ASA is doing is routing to your devices behind it and that IP space is being advertised out via the 29xx (dont know what your internal space is), I think you said before - The ASA had a 0.0.0.0 0.0.0.0 10.x.x.17(29xx model IP)   Basically the ASA is taking whatever traffic it gets from its specified inside interface and dumping it to the 29xx which is i'm sure advertising out your giving internal IP space.    ... View more

From this whole thread - it sounds like they aren't routing 10.x.x.x /whatever subnet they re using to be allowed internet access and used for internal only. Thats your problem. What is the purpose of the 29xx model router? Can that be replaced and what is its interface configuration to the 3750 switch? 10.x.x.16/29 you are using for the Meraki/ASA is serving as a connection between that device and the router only and advertised out over some routing protocol most likely.   Need to know more about the upstream and what the 29xx router is doing.    All this is with the acting though of:   Change the Interface facing the MX to a IP space that is allowed internet access and update the 29xx and the MX accordingly, some /29 Advertise that network over X routing protocol.       ... View more

@lpopejoy Thanks for the update, This makes me want to verify with support what version I am in fact actually running since from your point a view, you did update and the dashboard claims this.  ... View more

Wow Ok, thats wonderful, does the device show it is running on 13.24 under firmware? ... View more

@gparach So your post got me thinking and I spoke with out exchange admin as well about it. It does seem that we have no way to block specific IP's on a NAT statement. You can blacklist IP's however via exchange according to out exchange admin, but he did warn, if it is a attacker, They will just attack from another IP. His recommendation to solve this issue was the change the users account username for authentication.  ... View more

Good to know! Thats for bringing that up!    Unfortunately I haven't experienced this, but I don"t have data limit issues currently. Im curious what you find out though, sorry I cant help 😞  ... View more

We have had this as well - Ive just made it a point to make sure someone is available to go on site if i'm not able to.  ... View more

Some questions because i've dealt with something like this before with AP roaming but it was related to a swirtch stack which might not be the case here.  If it is a switch stack, are the AP's connected to different switches or the same?    FWIW - The decision to switch AP's is both client and AP side normally. To my knowledge Meraki currently doesn't allow a manual configuration to set a signal threshold on when a AP drops s client due to signal, the amount is unknown to me. On the flip side - you can sometime configure that information on the client.    The general solution right now is add another AP or potentially reduce the transmit power of one AP and play around with it are my suggestions.  ... View more