Best practices for small Meraki network

[JMY34]

Hi everyone. In a few weeks I am going to be implementing some changes on our small school system's Meraki network. We have 5 school facilities networked together with Meraki switches and an MX at both our High School and Middle school. For starters, I am going to get Middle School vlan traffic off vlan 1 and make it a separate vlan, and then change the native vlan on all the switches at that school to match. Is it best practice to change management vlan to something besides 1 as well? If so, do I then need to go elsewhere in the Meraki dash and change other things? Lastly, do I need to create a separate "Management" vlan to tag on switches and access points? Thank you.

[DarrenOC]

Hi @JMY34 

These are worth a read if you haven’t already read them:

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/...

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/...

[JMY34]

Thanks! Will I have to add the management vlan to trunk ports on all my switches, or just specific ones? And last question, creating a vlan for management on my MX with the same number I set my management vlan in config is still necessary, correct?

[DarrenOC]

Hi @JMY34 , I’ve always used a none routable VLAN as the Native VLAN which I set across all uplink/Trunked ports across the networks.  I then define a Mgmt VLAN for device/dashboard mgmt.

Others will of course have their own opinion.

[JMY34]

Interesting! What makes a non-routable VLAN? And once I make an mgmt VLAN, do I need to set any ports/switches to use it? Or is it automatic. Thanks.

[alemabrahao]

One VLAN without a default gateway.

[JMY34]

What advantage is there in doing it that way?

[alemabrahao]

In my opinion it has no advantage, there are other smarter ways to restrict access, such as restriction by ACLs, access policies via Tacacs+, and a multitude of other ways.

In your case, I think you should hire a consultancy, since you don't have mastery of technology.

[DarrenOC]

How is it smarter to add additional configuration when I can simply add a vlan number as the Native, job done, no further configuration required.  

[alemabrahao]

Using a non-routable VLAN is not the best option, it won't improve your security, ACLs aren't a guarantee either but at least you can make some restrictions.

What will guarantee the security of your network are a series of features, my favorite in particular is using authentication on the wired network, because at least that way you prevent anyone who connects a cable to your network from being able to use it.

Not even a firewall guarantees 100% security, it is enough for a user to access something improper that your entire network can be compromised.

So in my opinion, the more security features you use, the more restricted you can make your network.

[JMY34]

We have no more budget for the year, so we won't be hiring a consultancy. I have mastery of plenty of technology, just not networking yet, but that's going to change soon. Thanks for your help.

[alemabrahao]

You answered all your questions.