If I understand correctly, you have the uplink interface with a route to the core gateway. Then you have a VLAN where the switch is the gateway for.   The issue I can see with this so far is that you do not have a route from the core gateway going back to the switch for the subnet you are setting up for. In your example, you will need a route from the Core to 10.1.1.1 255.255.255.0 to the switch at 172.10.0.2 255.255.255.252.   Depending on the switch model and topology, you might just want to use OSPF for this instead of a static route. ... View more

Here a decent article on Meraki about coverage pattern and what they mean.   https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Understanding_Wireless_Performance_and_Coverage   Basically, the horizontal pattern is how the radio signal propagates on a horizontal plane if the access point or antenna, in this case, is mounted as expected. Vertical is for the vertical plane.   In the diagram, the horizontal plane shows it is directional in its facing but has a wide-angle, with a little going to the rear. It does extend to the left and right but not as strong as directly ahead. The vertical plane shows that it extends deep but not as wide so the frequency does not extend up or down as much. This is very desirable for point to point type connections which this antenna is designed for.   Indoor access points often look doughnut-shaped which is good for omni-directional coverage. ... View more

The cheapest comparable Meraki Switch will be the MS120-24P. This will have the PoE+ capability and the dashboard as well. Assuming you're using copper for uplink, you don't really need to use the SFP ports. They both spec for the same PPS and Gbps rating.   If it is just to support guest Wireless and nothing else, this should do the trick.   https://meraki.cisco.com/products/switches/ms120-24#technology   Hopefully, this will help you. ... View more

Sounds like you missed a step in the VPN configuration but I am glad you resolved it. In the allowed protocol, Unencrypted Password (PAP) is what is used and it appears you did not have that previously. So just a heads up for the next client, use that.   While the password is sent unencrypted, its going through an IPSec tunnel which is encrypted, so you should not be worried about exposing the password. ... View more

In the solution post, the link goes to the documentation that Carlos used.   For your specific error within that documentation, here you go: https://documentation.meraki.com/MX/Client_VPN/Troubleshooting_Client_VPN#Windows_Error_809   Hope this helps you. ... View more

From Google searching, it seems the SPF-10GB-SR is Meraki fiber and SFP-10G-SR is Cisco. That is the only difference I can readily identify. ... View more

Meraki has a pretty good documentation library. The specific topic that you are asking for is here: https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Switch_Ports#Link_Aggregation   Enjoy!   ... View more

Because STP is what generating BPDU and switches that don't have STP or disable them won't generate BPDU. BPDU is basically the cornerstone of STP function. ... View more

@CarolineS   I understand why you chose the IPv6 thread and I have faith Meraki will support it, just hope sooner rather than later.   I got my pin and notebook! Looks neat and time to find a place for that pin though...   @PhilipDAth   Nice socks, too bad Winter is ending down there. Its getting a little cooler in the Northern Hemisphere. ... View more

You simply specify that the data network don't use the VPN while voice subnets do in Routing page. ... View more

Thanks! I enjoyed the community and the collaboration that we shared. Thank you for setting up the Community! ... View more

The core is a switch or a group of switch if you want that handles all traffic within the network. It connects all other distribution and access switches to each other. In smaller network, the core and distribution are the same. You typically use root guard on those switches trunk port to access switches to prevent other switches from becoming root bridge. However, if priority not done correctly, it can cause issues in your network til you resolve them. ... View more

For trunk ports, you don't really need anything. However, if you using Fiber, you may want Loop Guard, just in case you lose connectivity on one side and accidentally start a loop. Root guard cannot be used with Loop guard. Root guard is really best near the core to ensure the designated switch is always root, but it will put the trunk port in inconsistent state until resolved. This is best to make sure no rogue switch hijack the network. ... View more

Are you using the public IP block for servers behind the MX?   I use MX84 and we have a block of public IP but the next hop IP is within that IP address range.   You can have your MX with 207.1.1.1 and "gateway" or next-hop 207.1.1.2. Use 1:1 NAT or 1:Many to accept 216.1.1.0/24 address and point them to where you want.   I am not sure if that is what you're looking for or if you are required to use 216.1.1.253 on the MX. But the above proposed solution does remove the external switch. ... View more

The standard practice is you have the SFP recommend for the network device you're using. Both SFP are matching the device its going to be installed on. Since both are MMF 850 nm, they should be able to communicate just fine. ... View more

Did you do regular speed test to confirm that you are getting what your business pay for?   My company does use Comcast Business line and we do not have that problem. We have multiple users who train using YouTube and other video services. The only difference is you stated a 50 Mbps downstream bandwidth. We had 100 Mbps downstream bandwidth. Only on a couple occasions during the month we hit the max in downstream but rarely.   So no, I don't think Comcast is throttling YouTube but rather there is something wrong with the way the network is set up which reduces available bandwidth.   Make sure you're not restricting speeds and that the comcast modem is the lastest firmware or up to date. We power cycle our unit every month and only had to replace it once.   Hopefully that'll help you identify the problem. ... View more

The dashboard doesn't clean up the list immediately. It will have the mac address remain for a while, usually a day since most views are daily views. I normally do online only to ensure MAC address of a machine is its burned in rather than random.   Secondly, make sure you don't have a group policy enforcing MAC address randomization. ... View more

Assuming you did check all the settings described by Microsoft linked here: https://support.microsoft.com/en-us/help/4027925/windows-how-and-why-to-use-random-hardware-addresses   Did you restart the computers, basically resetting the network adapters and make sure they not still using random MAC address setting. Whenever you make changes to the network interface, you have to shut it down and re-enable and a restart of the computer will do that.   Other than that, I do not know. ... View more

Most of the time, the 2 or 4 SFP+ ports are called uplink ports since they often have higher rated bandwidth for "uplinking" and connect to other switches, usually the distribution switch, heading toward the core or egress device (router). ... View more

Uplink ports for all intent and purposes are just a regular switch ports like any other. Usually uplink ports are higher bandwidth and preferred for "uplinking" to distribution or core switches.   So you can have 10G access port if you so desired instead of using it for uplink to another switch. ... View more

Hopefully, but doubtful on my part, the quarterly update tomorrow will give us something on this front. ... View more

    @grimm_j Unfortunately, it is critical. The Internet infrastructure has changed so much that many service providers are going full IPv6. This becomes very important, especially organizations that are at the cutting edge pushing the boundaries of technology. IPv6 is a requirement and whats holding Meraki back is their security appliance not supporting IPv6 yet. ... View more

What does your security policy requires?   By setting it up in SSID-based firewall, Meraki AP will prevent traffic moving to other network as you desired. Add in bandwidth limitations, there is no way for a guest client to connect to the main network and overload the bandwidth.   Even if you set up a guest VLAN, with client isolation, all guest user will have access to is the Internet.   I work as a security integrator and a number of times I get request for network segmentation and end user thinks that means separate equipment but separate VLAN with firewall rule is sufficient. ... View more

You can add an SSID for guest and use NAT mode if you like. I would recommend adding a firewall rule within the SSID to prevent that SSID from communicating with the rest of your network except out to the Internet. That's all you need to do really.     ... View more