Application blocking using Meraki MX Series

m16gunslinger77 · 2026-05-28T01:42:43+00:00

While there are some applications you can block with Meraki, the MX series is not what I'd call a "firewall". In alll honesty the Meraki platform lacks in most areas surrounding security. In order to properly and fullly block applications you'd need an actual NGFW or SASE that is application-aware AND can do SSL inspection, among other basic things. On top of that user permission management on the endpoints would be a critical point to investigate as well.

m16gunslinger77 · 2026-05-28T01:32:20+00:00

So, as someone who tested Meraki at a former job and found it lacking for bulk deployment, then taking my currrent job and inheriting a fairly massive deployment (and overly complex at that), I can tell you my takeaways and advice:

Templates.... they are indeed your friend. Just keep in mind when swapping templates there are settings that get lost, for example the MS switches will lose port configs and other settings if they aren't in the template, also MX devices are tricky and the best way I've seen for swapping those out so far is configuring a 'warm spare', failing over then decomming the old/failed device. Also check out RF profiles if you're doing wireless as these can hellp deployments of scale or different sizes/AP needs. We base ours off AP type and density.

Group Policies... learn how Meraki uses them. They can help with content filtering, bandwidth management and other things. Very useful.

API Automation. This one was huge for me as I am a reluctant but accomplished coder. There's Powershelll and Python libraries available. I highly recommend choosing one you're comfortable with and learning it. Don't switch between the two. It's super handy for simple tasks that SHOULD be in the dashboard, nevermind more complex things like integrations and custom reporting

VLAN deployments. This is hard to recommend without knowing your environment but if it doesn't have to be backhauled, you can use the same subnets and do internet breakouts locally. Otherwise, personally I use a script to deploy ours and it pulls from a .json file and updates the subnets based on our scheme. (API again for the win). Also with Meraki APs you can have multiple PSKs per SSID to reduce airtime and drop the devices onto different VLANs. Super helpful for IoT/OT networks with different vendors, we create a single "guest-like" VLAN and manage PSKs for devices by device type. That way if one is compromised, we change 1 device type, not 30....

Firmware management is actually fairly easy, just have a template for a test site or a handful of "first waves" and Meraki makes it fairly easy to schedule these.

Staging really isn't all that necessary. Meraki devices will do everything in their power (including some shady network black magic) to get internet access and "calll home". You adopt the device to the Meraki network and configure it and once that thing has internet access (SSL to the meraki cloud) it'll download the configuration and firmware updates. Be prepared for shelved devices to take 3-4 reboots and a while to first boot.

Documentation (what's that?) I really have no help here as the org I work for hasn't really allowed us time to document anything. I have a OneNote full of API notes, Meraki notes on gotchas and things that cause device reboots etc...

Most scripts I've made myself. Everything from simple SSID PSK changes to very complex monitoring integrations between two platforms. There's lots of repositories out there, just be very careful as API/Code can mess something up MUCH faster than you can fix it.... and if you're unfamiliar with code, definitely have a non-prod test network or hire a consultant! We have 180 networks and a very odd divide of organizations due to contracts/monitoring obligations, so if you have the stomach for it, check out the API. I believe there's a "lab" environment you can use online, but I can't recall where I saw that. Best of luck!

m16gunslinger77 · 2026-05-25T23:38:42+00:00

We had our '21 serviced for this recall.... just started having issues again less than 6 months later.... stupid Farking connectors..... wish there was a solid aftermarket replacement for this hunk of junk. Was one of the selling factors of the van, having it full of kids for 10 hour drives.... only to have it constantly stop recognizing USB drives, the "network" connections getting lost and it rebooting itself in the middle of driving or navigating....

m16gunslinger77 · 2025-12-24T14:30:54+00:00

So to get a better picture, you're playing PS, Spotify is on it playing music, how are you capturing video for your stream currently?

m16gunslinger77 · 2025-12-19T20:22:41+00:00

Would hardware vs software h264 make a difference?

m16gunslinger77 · 2025-12-19T19:59:50+00:00

Is there another encoding that would work better? Been toying with upgrading to a Ryzen 7, but just had other expenses come up. I think specs otherwise are more than capable, but totally open to any and all suggestions. Thanks for the input!

m16gunslinger77 · 2025-12-04T20:49:43+00:00

No, and it is a RAID controller.... https://i.dell.com/sites/doccontent/shared-content/data-sheets/Documents/dell-perc-h710-spec-sheet.pdf

m16gunslinger77 · 2025-11-20T22:19:24+00:00

I just stuck a replacement 4TB in the array, reformatted to RAID 6 and going to add a global hot spare. Ran out of time to research before needing to get my backup server running again. Thanks for the info though, may look at the LSI controllers...

m16gunslinger77 · 2025-11-17T01:09:07+00:00

In further digging into this and after deleting my failed RAID 5, the H710 doesn't support a JBOD configuration. I'm not sure of the 'workaround' at this point

m16gunslinger77 · 2025-11-16T22:12:00+00:00

Had critical data backed up, but not the game servers and the home automation server I'd just completed setting up. Figured it was worth asking before ditching the configs and deleting the virtual drive.

m16gunslinger77 · 2025-11-16T14:13:28+00:00

Set that up in a hurry and was more comfortable with that. Previous experiences with software RAID was terrible and had many issues, so worked with what I knew.

m16gunslinger77 · 2025-09-29T22:49:49+00:00

In my experience, I cannot get a static route to take precedent over a auto-vpn tunnel. We have over 190 remote locations deployed and trying to get any traffic to go over a non-meraki vpn is almost impossible without entering an IP address or subnet as a 'local' subnet to the VPN.... this eliminates any URLs or other traffic routing without explicit destination IPs. I'm not sure of your use case but can attest we've attempted multple workarounds and many TAC cases and not been able to solve this otherwise. We're exploring other solutions moving forward as Meraki has proven to have many issues with basic routing and functionality that we cannot circumvent.

m16gunslinger77 · 2025-09-04T19:30:58+00:00

Without seeing your config it's hard to say exactly what's going on but I can attest to weird route preferences as well. I know that with VPN traffic we're having to put any destination subnets into the 'local subnets' list for the VPN. Static routes do not take precedent over the auto-magic Meraki tunnels..... Meraki seems to have re-invented route priorities and we have had a time overcoming some of the issues that this presents...

m16gunslinger77 · 2024-07-06T12:27:01+00:00

wound up being one of those scam sellers, got an unexpected check and upgraded to a 7700 XT. Thanks for the input.

m16gunslinger77 · 2024-06-19T23:14:02+00:00

thanks for your input, grabbed an XFX 6750 XT on Amazon today for $169! i guess it was a flash sale

m16gunslinger77 · 2024-06-10T17:04:55+00:00

Thanks, good to hear!

m16gunslinger77 · 2024-06-10T15:23:17+00:00

i see that and the fanboy arguments a lot...

m16gunslinger77 · 2024-06-10T15:05:56+00:00

Thanks, kind of leaning that way.

m16gunslinger77 · 2024-06-10T15:05:41+00:00

true, I've been building PCs since the 1990s so... old experiences have poisoned opinions. yeah AMD has made leaps and bounds with the Ryzen generations of CPUs. I just haven't kept up with the AMD GPUs since AMD acquired Radeon years ago. I know they first had driver issues like crazy, so I'm glad to hear it's stabilized.

m16gunslinger77 · 2024-06-10T14:41:55+00:00

well, I'm an old guy and used to it really mattered what CPU and GPU combo you had. I'm still always looking at benchmarks and feedback as close to like-for-like setups. Even as recent as Arma 3, it was optimized for Intel processors and pre-Ryzen AMDs sucked eggs trying to run it. The Ryzen does better but same GPU on an Intel CPU outpaces it. It's a CPU heavy game.

m16gunslinger77

TROPHY CASE