Meraki

from_afar

Trying to determine if the built-in Layer 3 firewall at Security & SD-Wan > Firewall would be preferable to Umbrella's firewall offering, I set up some rules to do some testing. I created a bunch of TCP allow ports for standard stuff like http and https and a blanket deny at the bottom of the Output rules section (Inbound just has one Default deny/deny any/any rule). Once I saved the configuration I did some testing on several machines on our LAN only to discover that nothing was being blocked as expected. However, a few minutes later, I started getting complaints from users connected via Secure Client/Any Connect that they couldn't reach any of our internal http/s services or SMB shares. Turns out I forgot to add 53 for DNS. Once added, their connections started working again. However, this told me that for some reason, the firewall rules were only applying to connections coming through the VPN. This is especially strange because the documentation says that the layer 3 firewall rules will NOT affect VPN: We are using Hub and Spoke with only 1 spoke but I've been only testing with AnyConnect so far. A) Does anyone know why it would be better to use Umbrella for our firewall stuff? We don't have any DMZ or public-facing services, just want the extra security of being able to block all outbound traffic and selectively let through only what is necessary. The challenge with Umbrella is it needs to be set up via tunnel which I'm afraid would impact our users negatively (we need all traffic including Spoke SD-Wan, AnyConnect, and LAN to always come from the same WAN IP) if it was tunneling traffic away from or obscuring out WAN IP address (need to maintain cookies for users or else they would face MFA prompts all day when trying to do their work). B) Am I missing or miss-configuring or missunderstanding how the built-in Meraki layer 3 outbound firewall should be working? Why would the firewall be blocking outbound connections coming from the AnyConnect Secure Client but not connections coming from the LAN itself?

from_afar · ‎Sep 30 2024

Thanks for the reply. by Idp do you mean identity provider? I have configured Azure SAML for admin login and that seems to work fine: I can log in to the admin dashboard via Azure. I have also configured SAML settings in deployment: and when I "test" that configuration it says it passes. However, I can't find or see anything that identifies whether or not if a user authenticates via AnyConnect Azure SAML whether or not they will be authenticated to Umbrella and thus can have policies etc. applied to their Azure account. Does this Idp allow this? Is there somewhere I'm missing where this would get configured? Appreciate the help.

from_afar · ‎Sep 29 2024

If a user signs in to the VPN via SAML and Admin > Authentication > SAML authentication is configured and working, does a user signing in to the VPN authenticate them to Umbrella as well? I can't seem to find an answer in the docs and testing seems like it is not working that way.

from_afar · ‎Sep 29 2024

I have had issues before when trying to connect to VPN when multiple people were trying to connect from the same network. I.e. the first connection would work fine, but then when someone else tried to connect from the same WiFi network, that connection would fail. These were Mac's, but it happened on iOS as well. I think Meraki does some magic that doesn't work well when multiple connections are coming from the same location. They probably don't expect that to be normal behavior or something. The only solution I found was to move over to Cisco Secure Client AnyConnect app.

from_afar · ‎Sep 28 2024

Thanks. Unfortunately, I'm leasing the system from AT&T which has been an absolute nightmare. As such, Cisco/Meraki just sends me their way and they have been abysmal when trying to get help hence I try to fix things myself first, then come here if I can't. At any rate, it fixed itself which is frustrating but at least it's fixed. Thanks for the reply.

from_afar · ‎Sep 28 2024

The issue seems to have fixed itself once again which is super frustrating as I'd rather know what went wrong so I could fix it but the problem seems to be resolved.

from_afar · ‎Sep 28 2024

I'm on MacOS 14.5 using Cisco Secure Client 5.1.4.74. I'm connecting to a MX95 via SAML. I can authenticate fine, access network resources, and my public IP is correct (using tunnel all). However, when I check the MX95 Network Wide > Clients table, I do not see this laptop listed anywhere. I searched for the laptop name, the ip address (which has the correct address) but it is not listed. When I go to Appliance > Tools, I can ping the laptop fine via ip address. Any idea why it wouldn't be showing?

from_afar · ‎Sep 26 2024

Not sure how/why, but the next day it started working fine. The blank page goes away and I get the familiar "You are connected" message and the VPN works. No idea what caused or fixed the issue...

from_afar · ‎Sep 23 2024

Sure thing, it looks just like this except with our company branding etc. Standard part of the Microsoft 365/Azure auth workflow.

from_afar · ‎Sep 23 2024

Got it, thanks, that is super helpful. Seems to be working too, so I appreciate the help!

from_afar · ‎Sep 23 2024

I started getting the dreaded 516 Upstream CN Mismatch error this afternoon for a few users. It is odd because on the page itself, there is no SSL error. Checking the certificate itself, the CN matches fine. I re-installed the Umbrella root CA just in case, but still get the error. The connection is "secure" according to the browser: Found this help article https://support.umbrella.com/hc/en-us/articles/16794331853588-How-do-I-resolve-the-error-516-Upstream-Certificate-CN-Mismatch-error-when-browsing-to-an-HTTPS-URL and the SAN matches as well: I did turn intelligent proxy and ssl decryption off for a short while ~5 hours ago or so trying to diagnose a website issue, but other than that didn't make any changes. Am I missing something obvious here? I did re-download the root CA since re-enabling ssl decryption and imported it on the machine I'm testing on (and took the above screenshots from) and imported to the trusted root CA store, but I think the cert was the same.

from_afar · ‎Sep 23 2024

Testing Azure AD SAML auth with our Meraki Secure Client and I have configured Azure as well as the test Meraki MX68 according to thist guide https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration. We are using a custom FQDN which is a CNAME pointing to our <host>.dynamic-m.com domain. I did this so I could purchase a SSL certificate which I have done and uploaded to Meraki admin. When testing the setup in Azure, it passes with no errors or issues. Same for when I try to log in to the VPN with Secure Client. The problem is that after authenticating to Azure in AnyConnect Web Helper windows, I get a "Stay signed in" window with "do not show again" Checkbox and Yes/No buttons. No matter what I click or choose here, the auth window just goes blank and nothing else happens for about 3-5 minutes. Eventually, it will time out with a "This page is not working right now" error. In my research, I found one other user with a similar issue and they were able to work around the problem by hitting F5. Unfortunately, that doesn't work for me--I just get a "resend information..."warning and back to the blank white page. In my Azure SAML config, the Entity ID is set to https://vpn.example.com/saml/sp/metadata/SAML the Reply URL https://vpn.example.com/saml/sp/acs I have Secure Client Ui 5.1.1.42, AnyConnect 5.1.1.42; MX devices auto-update over the weekends so should be running latest stable. I tried clearing out all Cisco Cookies from Edge and Chrome. I tried changing default Browser to Chrome. Other forums say the Cisco Web Helper should be using WebView2 Runtime anyway which is installed. Any ideas what could be causing this? Or where I should look for hints as to what is going on?

from_afar · ‎Sep 18 2024

Thanks very much for the reply. So this is a bit confusing to me (sorry) since the SD-Wan location is *supposed* to be part of the LAN. We are using "single LAN setting" as well, but I think as you said they are still technically separate networks? It looks like it because I see what you mean about needing to authorize the cloud users separately.

from_afar · ‎Sep 17 2024

We have a small setup with one hub and one spoke SD-Wan location. We tunnel all and people also use AnyConnect to VPN into the hub when working from home. We use the inbuilt Meraki Cloud authentication for users for VPN auth. We also have Umbrella up and running. I wanted to do some experimenting with Active Directory integration. I have set up client VPN on both devices (MX98 LAN, MX68 SD-Wan location) as I have to remote in to the SD-Wan location sometimes to help debug stuff. I'm the only one who uses that connection; everyone else is either on the LAN, SD-Wan or AnyConnect -> LAN when working from home. I noticed that when I set things up, when I added a user, it automatically was also created at the SD-Wan location. i.e. when I added a user in the MX98 > Security & SD-Wan > Client VPN > AnyConnect Settings > User Management, it would automatically appear in the User management on the MX68. My question is: would it be possible to test Active Directory settings just on the MX68? Or if I turn on/configure AD on the MX68, will those settings automatically propagate to the MX98 like the users do?

from_afar · ‎Sep 12 2024

In the DNS Policies for Application Controls, in the list of applications you can check or uncheck categories and/or specific items. By default they are all set to "block" but you can click the gear icon for applications and change it to "Allow". What is the difference between unchecking an application vs checking it and changing it to "Allow"?

from_afar · ‎Sep 12 2024

After 4 days of downtime and ZERO help from AT&T (HUGE mistake getting this through them, been an absolute nightmare and after 8 months STILL does not work correctly and they keep going in and changing things without talking to me as in this case), I finally saw that they had re-enabled Umbrella at the SD-Wan location and did not add any domains (including local) to the bypass input in the Umbrella section of the Threat Protection page where it says: "Specify one or more domain names below (one per row) to be excluded from being routed to Cisco Umbrella." Once I added the local domain in there things started working again.

from_afar · ‎Sep 11 2024

Trying to figure out what is going on, I started disabling WAN interface (I have/had 2 connections at each location; fiber and cable at LAN and fiber and cable at SD-Wan location). After disabling one of the WAN interfaces at the SD-Wan location, I was unable to VPN back in there to continue testing. Looking further, I saw that the SD-Wan VPN tunnel is for some reason trying to connect to the backup/failover/WAN 2 IP address at the LAN location. I also noticed that the IPv6 status is "failed" for WAN2 at the LAN location. I'm going to try to unplug the LAN WAN2 interface and see what happens.

from_afar · ‎Sep 11 2024

Turns out it was the router IP address at the SD-Wan location. Trying to figure out what is going on, I started disabling WAN interface (I have/had 2 connections at each location; fiber and cable at LAN and fiber and cable at SD-Wan location). After disabling one of the WAN interfaces at the SD-Wan location, I was unable to VPN back in there to continue testing. Looking further, I saw that the SD-Wan VPN tunnel is for some reason connecting to the backup/failover/WAN 2 IP address at the LAN location. I also noticed that the IPv6 status is "failed" for WAN2 at the LAN location. I'm going to try to unplug the LAn WAN2 interface and see what happens.

from_afar · ‎Sep 11 2024

Thanks for the reply. That IP address does not appear in the ARP table on either appliance (the SD-Wan spoke nor LAN hub).

from_afar · ‎Sep 11 2024

I'm trying to track down an issue where local DNS is not working for any of our SD-Wan users. It's been happening since last Friday afternoon and there's no fix in sight (Have a ticket open with ATT who we get Meraki through). While troubleshooting, I tried running a traceroute from SD-Wan location to a device on the LAN via IP address. Our LAN is 192.168.111.0/24, Anyconnect 192.168.112.0/24, SD-Wan 192.168.113.0/24 and I have VPN set up so I can remote in to the SD-Wan location to try to figure out this issue and that ip is 192.168.114.0/24. However, when I run a traceroute to something on the LAN from SD-Wan location, the first hop is to 192.168.100.1 which I do not recognize at all. Is there some way to figure out who/what this address is? I cannot ping/ssh/http to it from either the LAN, SD-Wan location nor either appliance. The second hop is the server I'm tracing so the trace completes, I just don't understand where this IP is coming from. Could it be an internal address Meraki uses for NAT or something? Since we are leasing from ATT, I unfortunately don't have full admin access to the Meraki interface, so apologies if it is something obvious.

from_afar · ‎Sep 10 2024

Thanks for the reply. Yes, these clients are set to use the Umbrella appliances for DNS via DHCP. Although, setting DNS to any of the other DNS servers manually (or using them for nslookup) yields the same result. However, all of the DNS servers including the appliances return answers to non-local queries (e.g. google.com), they are only failing to return internal domain names. I can reach the internal resources via IP address though (e.g. internal file share and https server; I can even ssh to the dns appliances from the clients using their IP address). Tried both FQDN and short. nslookup for the domain itself fails as well (these are all Windows 10 machines domain joined).

from_afar · ‎Sep 9 2024

Thanks for the reply. I am able to ping the dns servers via ip address but not via dns name. However nslookup does not work at all neither with server name nor IP address. Specifically, I keep getting UnKnown: can't find <name>: Non-existent domain errors when trying nslookup. Looks like there was an update over the weekend (I have the MX's set to auto-update (stable) on weekends). It's now running 18.211.3. Doesn't sound like the update/reboot fixed the issue; everyone in the office is reporting the same problem. They can connect to WiFi and VPN in, but the SD-Wan is only allowing them to access the internet. I'm watching the firewall log and there isn't anything being blocked. Is there something specific I should be looking for? I can also see traffic to the DNS server being allowed. On the Tools page, on DNS lookup, I can lookup the local domain with DNS server set as ip address, but not domain. Any other tips would be appreciated.

from_afar · ‎Sep 6 2024

I was just informed by a couple of our SD-Wan users that things were not working. I remoted in to one of their machines and indeed dns is not working correctly. Before I remoted in I had them reboot and they still had problems. In remote session, I can ping assets on the LAN via IP address; can get to web server on LAN via IP address, but all nslookup's fail with Server Unknown nxdomain. I tried nslookup with both dns server name and hard-coded IP address. We have 2 Umbrella dns appliances; neither are working (nor are the dns servers they forward to--Win 2022 DNS servers). I can ping their laptops from the Appliances (MX-68 at their location running through ms-120; MX-95 at Hub). Nothing indicating an issue in the event logs. I had one of the users that was experiencing issues disconnect the network cable, join Wifi and connect via VPN. They said doing that allows everything to work as expected. Any ideas what I might try to diagnose the issue?

from_afar · ‎Aug 6 2024

It seems like it's an issue with people being on the same WiFi network--something with the way Meraki SecureClient handles the networking--for some reason the first one to connect wins then anyone else trying just fails. It also seems like once multiple people try, if the first disconnects, they cannot connect again. I never did find a solution. I was trying to use IPSec, but had a lot of trouble with that on our Macs too which is why we were forced to use AnyConnect, but if you can get IPSec working, that might solve the issue. Just curious: what equipment are the WiFi users connecting through? Here we are using Ubiquiti. Wondering if it might be them. Sorry couldn't be more helpful.

from_afar · ‎Jun 27 2024

They authenticate via Meraki Cloud username and pass. Again, that doesn't seem to be the issue because as mentioned, the first user to connect connects fine. I'm wondering now if the issue was that they were all using the same WiFi. If for some reason because they were on the same wifi thereby the same public IP, if Meraki does some magic behind the scenes for NAT'ing or something that would cause multiple connections from the same public ip via L2TP to not work? Thanks for the help.

About from_afar

from_afar

Community Record

Badges