Meraki

gregarican · ‎Mar 4 2024

I wonder if these outcomes had anything to do with the recent round of Cisco employee layoffs? Just seems out of the norm to see so many relatively significant bugs to make it all the way to a firmware's Stable Release Candidate milestone. For our company, v18.208 impacted numerous services running on our production NAT 1:1 hosts. Took a few days to get those services back to normal and caught up after reverting the firmware back.

gregarican · ‎Mar 1 2024

Thanks again for the leads. I think for now I might just employ a rule on our firewall that allows only corporate Wi-Fi traffic into the Citrix host. Anyone who wants to work remotely outside of that can just e-mail me to whitelist them. What I'm not used to compared to the Cisco ASA is that any firewall NAT rule changes can't be done on the fly during production hours. Since all traffic that traverses the firewall is briefly interrupted. Our SIP phone registrations, active SIP calls, client/server traffic, etc. So have to do it off-hours. That's kinda a pain but it is what it is I guess.

gregarican · ‎Feb 29 2024

Thanks for your reply! When I'm referring to remote access, currently we aren't utilizing an inbound VPN layer for this. Basically the users are accessing a Citrix login page. Once they authenticate then they can launch their published apps. I've looked on the Citrix end and cannot ascertain how I can help validate the inbound traffic. I will look into this Cisco Secure Connect to see if it would be a good fit. But even then I would like to block attempts at accessing it via some sort of IP reputation lookup. If Umbrella can emulate that then we might have a good fit!

gregarican · ‎Feb 29 2024

So our corporate network has a remote access service as a published 1:1 NAT host through our MX 75. Due to the nature of remote access, I can't just whitelist our corporate LAN's for inbound access. People work remotely, that's the idea. 🙂 Rather than play whack-a-mole by blocking specific IP subnets due to their numerous failed intrusion attempts, I was wondering if there's some functionality for screening inbound access. Cisco has their Umbrella and Talos acquired product families. Similar to their acquisition of Meraki. So logically I was wondering for the MX line if there is a way to permit inbound access based on the far end's IP reputation score or something? I know for outbound access that Umbrella can come into play, which I leverage. What about inbound?

gregarican · ‎Feb 28 2024

That's what happened when I opened my support ticket. The subject line was specifically "Firmware MX 18.208 Issues?" when I opened it. I was originally told that there were no known issues with this Stable RC. Apparently there are, as the ticket wound up confirming after specific testing and packet captures. Rolling it back brought our corporate network back to normalcy. It seems noticeable that Meraki was an acquired Cisco product line. Back in the day the old 1900 and 2500 series routers, ASA firewalls, etc. were pretty rock solid, granularly manageable, and stable firmware updates were pretty much the norm comparatively.

gregarican · ‎Feb 28 2024

After rolling back the firmware these two inside NAT 1:1 hosts are communicating outbound just fine. Previously it was spotty at best. I still am somewhat amazed that this firmware was considered a Stable Release Candidate. Even the most basic beta testing should've revealed NAT 1:1 hosts having connectivity issues. Reminds of this back in the day when I managed IT for a larger corporate call center --> https://rcpmag.com/articles/1999/11/16/microsoft-posts-winsock-hotfix-for-sp6.aspx.

gregarican · ‎Feb 27 2024

I wish I ran across this thread before updating to 18.208 this past Sunday. We have a couple of on-prem servers defined with 1:1 NAT on our MX75. They randomly lose outbound connectivity to external hosts/ports, which has caused major headaches with our apps. Most importantly, cloud data backups. Any other LAN host can connect to these endpoints without incident. It's only happening on two on-prem servers that have 1:1 NAT rules in place. Reverting the firmware back after hours tonight. If that does the trick then I'll be relieved!

Meraki

Community

About gregarican

gregarican

Community Record

Badges

Re: MX 18.208 release being pushed - Performance improvements added to the ...

Re: Meraki MX 75 and inbound traffic filtering

Re: Meraki MX 75 and inbound traffic filtering

Meraki MX 75 and inbound traffic filtering

Re: MX 18.208 release being pushed - Performance improvements added to the ...

Re: MX 18.208 release being pushed - Performance improvements added to the ...

Re: MX 18.208 release being pushed - Performance improvements added to the ...

Re: MX 18.208 release being pushed - Performance improvements added to the ...

Re: MX 18.208 release being pushed - Performance improvements added to the ...

Re: MX 18.208 release being pushed - Performance improvements added to the ...