500-220 Engineering Cisco Meraki Solutions (ECMS) v2.2 Questions and Answers

You can enable intrusion prevention by setting the Mode drop-down to Prevention under Security & SD-WAN > Configure > Threat protection > Intrusion detection and prevention. Traffic will be automatically blocked by best effort if it is detected as malicious based on the detection ruleset specified above. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection

By default, iOS apps provisioned through Systems Manager that are found in the App Store will self-update if automatic updates has been turned on in the Settings. For custom iOS apps, or to manually push down updates, check the following steps. https://documentation.meraki.com/SM/Apps_and_Software/Updating_Managed_iOS_Apps

When band steering is enabled on an SSID, APs will stop advertising that SSID in 2.4GHz beacons. Since 2.4GHz-only clients that rely on a passive scan will not “see” that SSID in beacons, they might not be able to join this SSID unless they do an active scan or have been pre-configured with the SSID name and security settings (for example, a pre-shared key). https://documentation.meraki.com/MR/Radio_Settings/Band_Steering

SM Sentry enrollment can be enabled on any MR network via the Splash page section of the Wireless > Configure > Access control page. https://documentation.meraki.com/MR/MR_Splash_Page/Systems_Manager_Sentry_Enrollment

See Permissions by Network Tag section To simplify the assignment of network-level permissions in an organization with many networks, permissions can be granted to users for a given network tag. https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Managing_Dashboard_Administrators_and_Permissions

The Organization > Configure > Manage Tags page allows Administrators to configure a combination of Network and Device specific tags to create Summary Reports filtered for specific devices across multiple networks. https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Organization_Menu/Manage_Tags

"Inbound and outbound flows will generate a syslog message showing the source and destination along with port numbers and the firewall rule that they matched. For inbound rules, 1=deny and 0=allow." https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration

This can be determined by looking at the concentrator routing table and finding the entry for the destination IP 10.116.32.4. The next hop for this entry is the Auto VPN peer “Store 1532 – appliance”.

This question is related to the topic of Implementing Dynamic Routing Protocols in the Engineering Cisco Meraki Solutions (ECMS) official training documentation. You can find more information about this topic in the ECMS v2.2 Course Overview or the ECMS1 v2.1 Course Overview.

The performance probe is a small payload (approximately 100 bytes) of UDP data sent over all established VPN tunnels every 1 second. MX appliances track the rate of successful responses and the time that elapses before receiving a response. This data allows the MX to determine the packet loss, latency, and jitter over each VPN tunnel in order to make the necessary performance-based decisions.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_SD-WAN#Performance_Probes

https://www.ciscolive.com/c/dam/r/ciscolive/latam/docs/2019/pdf/BRKCRS-1579.pdf

• More hardware devices than device licenses: An organization needs to have enough device licenses to cover all the hardware devices in its network. A device license is consumed by each device that is added to the network. If the number of devices exceeds the number of licenses, the organization will be out of license and will lose access to some features and support until it purchases more licenses or removes some devices4.
• Expired device license: A device license has an expiration date that depends on the license term purchased by the organization. If a device license expires, it will no longer be valid and will not count towards the license limit. The organization will need to renew the expired license or purchase a new one to avoid being out of license4.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/Wireless_Layer_3_Roaming_Best_Practices

This is a feature of distributed Layer 3 roaming, which maintains layer 3 connections for end devices as they roam across layer 3 boundaries without a concentrator1. The first access point that a device connects to will become the anchor access point1.

See Behavior - Firmware MX 15.11 or Lower section For MXs running firmware MX15.11 or below, the source IP that MX uses while pinging a destination is the MX IP of highest VLAN ID. If the destination is across a VPN, the MX uses the MX IP of highest VLAN ID participating in VPN. For MXs running firmware MX 15.12+, additional ping options have been added to the live tool. The ping tool now has a drop down to select the source IP address for pinging destinations from the MX. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Ping_Live_Tool

Verbs in the API follow the usual REST conventions:

GET returns the value of a resource or a list of resources, depending on whether an identifier is specified.

POST adds a new resource

PUT updates a resource

DELETE removes a resource

https://documentation.meraki.com/General_Administration/Other_Topics/Cisco_Meraki_Dashboard_API

If you only need traffic statistics from your spoke site clients then you only need to enable insight on the spoke network as the hub site will not gather data for remote sites. https://community.meraki.com/t5/Wireless-LAN/Meraki-Insight-Licensing/m-p/152684

A license is only required for those networks where Meraki Insight functionality is desired. One license is required per network, regardless of whether that network has a single MX or HA pair. Licenses can be moved between networks, but historical data for the old network will be lost. https://meraki.cisco.com/lib/pdf/meraki_datasheet_mi.pdf

A screenshot of a computer screen Description automatically generated

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies