A branch office is getting a new MX appliance and one MR access point. The script must switch on VLAN support, add VLAN 72 for guests, point the Branch-Guest SSID at it, and block guest clients from reaching the 10.50.0.0/16 headquarters subnet. Which sequence of Meraki API calls should the script send to finish provisioning the branch?
Select an answer to reveal the explanation.
Short Explanation
Meraki leaves VLANs switched off until you enable them, so that settings call has to come first or the new VLAN is rejected. The SSID endpoint is addressed by its number rather than its broadcast name, and a subnet block is an L3 rule, not an L7 one. It's like ringing up a sale on a register you never powered on.
Full Explanation
VLAN creation on the appliance is gated: until the network reports VLANs enabled through the settings endpoint, a request for a new VLAN is rejected, so the switch-on call must come first. The wireless SSID endpoint is keyed by the numeric SSID index rather than the broadcast name; the update payload uses the SSID's defaultVlanId field to set its VLAN. A rule that blocks one subnet from reaching another is a layer 3 forwarding decision, so it belongs in the appliance L3 firewall rules, where entries are evaluated in order ahead of the built-in defaults. Creating the VLAN first fails only because the gate is shut, so that path never reaches the SSID or the rule. Addressing the SSID by name does not match the numbered resource path, so the VLAN assignment is not applied. Sending the subnet block to the L7 rules applies application-category filtering instead of a prefix match, so guest traffic still reaches headquarters. Exam caveat: endpoint paths and payload fields can change between API versions, so learn the resource relationships rather than exact strings. Practical check: read the VLAN settings back, then GET the SSID and the L3 rules to confirm each write stuck.