PlayStations (especially PS5) do not use standard HTTP GET requests on port 80 to detect captive portals and as far as I remember, Meraki’s splash page redirection only works with HTTP traffic on port 80. ... View more

It's a little older., but, according to Microsoft KB5043417, the update introduced a security enhancement that enforces stricter compliance with RADIUS standards.   KB5043417: RADIUS authentication to NPS might fail with the July 2024 security update and later updates - Microsoft Support   In this case, please make sure your Meraki devices are running the latest firmware, and if possible I suggest you open a support case. ... View more

It won't work with splash page, either you create an SSID with PSK or you do a bypass.   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Blocking_and_Allowing_Clients#Allow_List ... View more

Changing the default AnyConnect port can significantly reduce these handshake attempts, but it doesn't mean it will stop them, since you can easily find out which ports are open by running a port scan for your IP. What I really recommend in your case is to use multifactor authentication. It won't stop anyone from trying to authenticate, but it will at least make your connection more secure.   https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication ... View more

You can configure Kiosk Mode to allow access to a custom WebView application or a browser shortcut that opens docs.google.com, but manual sign-out between users is still required.   Instead of strict Kiosk Mode, you could try using Android Enterprise Device Owner Mode, but I'm not sure if it would work. ... View more

Meraki’s Kiosk Mode is designed to lock down a device to one or more specific apps, preventing access to system settings, home screen, or other apps. Android Kiosk Mode in Systems Manager - Cisco Meraki Documentation   I'm pretty sure that currently, MDM doesn't support multiple user profiles on Android tablets in Kiosk Mode. ... View more

Apple devices began using randomized MAC addresses for Wi-Fi connections starting with iOS 14 and macOS Big Sur. This affects how devices are identified at the network level because each connection could appear as a different device (even though it’s the same physical device).  Apple might also modify or limit the amount of system information (like the OS version) it includes in the HTTP headers or DHCP requests, which could impact Meraki’s ability to accurately identify macOS versions.   https://www.extremenetworks.com/resources/blogs/wi-fi-mac-randomization-privacy-and-collateral-damage ... View more

Meraki utilizes client fingerprinting to identify devices connecting to its network. This process uses various techniques, including inspecting DHCP requests and HTTP headers, to determine the device type (e.g., iOS, Android, Windows, Mac). While generally accurate, it's not foolproof and may sometimes misidentify devices, especially less common or older models.  ... View more

"Back out its WAN interface" means: After the MX decrypts the VPN traffic, if the destination is the Internet, by default it forwards this traffic directly out its WAN interface, using its own public IP as the NAT source address. The MX then acts as an exit point to the local Internet for this traffic, using its WAN interface as the path to the Internet. With No-NAT, routed mode hubs can forward decrypted spoke traffic to LAN next hops without NAT — but they retain their local routing and VLAN capabilities, which concentrator mode lacks. The main architectural difference is still about whether the MX is meant to route LAN traffic locally (routed mode) or act purely as a VPN concentrator (concentrator mode). ... View more

Just to be clear, if you try to use the same subnet you will get an error message. ... View more

You need to create a new subnet. ... View more

I think it would be a good idea to talk to your Meraki sales representative if you have any questions regarding the design. Although you have explained some details, I believe that your sales representative will help you determine the best scenario for you by gathering all the necessary information. ... View more

Meraki devices identify hostnames using NetBIOS, Bonjour, and DHCP. The hostname can be manually overridden in the Meraki dashboard if needed.    https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Rename_a_Client%27s_Hostname ... View more

Here are the main use cases in general.   VPN Concentrator Mode   Use Case: SD-WAN Hub in a DC or HQ You have branch offices (spokes) that connect to the DC or HQ using AutoVPN. The DC already has its own upstream router/firewall (e.g. a large Palo Alto or Cisco ASA). You want the MX to handle only the VPN termination and routing, but not act as a firewall or Internet edge. No NAT required   Since it does not do NAT, it is easier to maintain end-to-end visibility and preserve source IP addresses (useful for data center firewall or IDS policies). Data center with multiple VLANs routed to another location Often, internal VLAN routing is handled by a core switch or other upstream device.   Routed Mode Use Case   Branch or Edge Locations (Most Common) The MX acts as a firewall and Internet edge router. It performs NAT for Internet-bound traffic. You need to segment local LAN traffic using VLANs. You want to use local breakouts (direct Internet access) for SaaS or split tunneling. Hybrid or Small DCs When you want the MX to provide both local LAN services and VPN services (for example, small data centers without a central router).   https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide?utm_source=chatgpt.com   Sorry if there are any mistakes, I got the presentation data for a client and had to translate it. ... View more

This seems to be a problem with the device. Have you tried testing this on another network? ... View more

In this case, if I am right, the message depends on the role that the MX is playing (as you noticed). MX as DHCP server → no DHCP lease available MX relay → no_offers_received So I believe the same applies to the MR since it is not acting as a DHCP server.   Is it possible to test? ... View more

Hi,   1 - I believe the log message is always no_offers_received, it will always be that, even if the root cause is an exhausted DHCP pool.   2- To be honest I think MRs will log the error, but not necessarily with the same threshold logic as MX devices. ... View more

There is no direct setting in MDM to disable screen lock during active use for Android devices, however if your devices are in Device Owner Mode, you can use Kiosk Mode to lock the device to a specific app or set of apps.   Android Kiosk Mode in Systems Manager - Cisco Meraki Documentation ... View more

In short, you are right, in this case it would be interesting to open a support case. ... View more

Limitations Attribute filters (clothing color, vehicle color, and vehicle type) are only available on 3rd generation, non-fisheye cameras (MV13, MV23, MV63, and MV73). Stationary people and vehicles do not generate motion events, so they will not be returned through attribute filters. Attribute search can be performed on up to 4 cameras and 3 consecutive days. This is the same limitation Event Search allows. Motion events captured in night mode are automatically filtered out during attribute search. Users can choose to reveal motion events, but we do not guarantee their color accuracy. ... View more

I've used it with another IPTV service and it worked without any problems. Do you have any content filtering or AMP configured on MX? Is there any possibility that your provider is blocking it? ... View more

Traffic Blocked by Layer 7 Rule The MR access point and MX security appliance differ slightly in their processing of L7 firewall rules after the L3 firewall. On the MR, if traffic matches an allow rule on the L3 firewall, that traffic will bypass the L7 firewall altogether. On MR, default L3 rules do not act as a bypass for L7 rules. Only allow custom rules will bypass L7 rules.  On the MX, if traffic matches an allow rule on the L3 firewall, it can still be blocked by an L7 firewall rule. On the MX, HTTP traffic (TCP port 80) to Facebook.com will be blocked by the L7 firewall, because rule 1 under layer 7 explicitly blocks it, even though the traffic was allowed through the layer 3 firewall. Layer 3 Rules Matched - Traffic allowed through L3 firewall Not processed Not processed Layer 7 Rules Matched - Traffic blocked https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewall_Processing_Order   ... View more

It's supposed to work, take a look at this article.   https://www.cisco.com/c/en/us/support/docs/security/meraki-cloud-managed-security-appliances/220219-configure-mx-layer7-geo-location-restric.html ... View more

Hi, I sent you a private message. ... View more

But in the case of WLC this IP was only used for redirecting the Captive portal, in this case it would not influence the functioning of the network nor generate any type of unavailability. ... View more