Meraki

thomasthomsen · ‎May 19 2021

There seems to be some trouble getting online for some customers this morning. It seems to revolve around the Meraki Radius server. Did it get a new certificate ? If yes, where can we keep track of such updates before hand ? /Thomas

thomasthomsen · ‎May 12 2021

Any news on this ? I have just started to see the same thing.

thomasthomsen · ‎Apr 7 2021

The topic might be a strange question. But we found a "lot" of Meraki hardware that we had forgotten all about in one of our warehouses. We have the order number, and would just add that to our dashboard, so we do not have to add all serial numbers individually (could take some time). But we are not allowed because the license "bundled" inside that order number has run out. Is there another way to add all these devices ? We will of course have to buy new licenses for them. /Thomas

thomasthomsen · ‎Mar 18 2021

But most customer would rather like it just to be there in the UI. I mean, all the data is there in the dashboard, its just an UI change. I really wish they would fix that (yes I call it a fix, because the current solution with only 30 lines is not good).

thomasthomsen · ‎Mar 18 2021

Would just like to "bump" this. Because its really annoying for some customers, who do not have API knowledge, that they cannot just download "all" , or for a given time, only the 30 lines. I mean, all the data is there, its just an UI change that should be fairly easy for Meraki to do. So its kind of crappy atm. I wish .... I guess....

thomasthomsen · ‎Mar 17 2021

Or here is another idea. Use "Insight" to automatically select the best WAN connection for a specific service at that specific time. That would be a "flipping awesome" feature, and would sell some more "Insight" licenses Im sure 🙂

thomasthomsen · ‎Mar 17 2021

Bascially yes. Even though in my scenario, we do not use VPN, but have a dedicated WAN for Office 365. The BEST thing I would like is this 🙂 (I hope my rough drawing conveys the idea 🙂 ) If I could have a WAN link selector for Traffic shaping rules. Or If I could have all the options /definitions of traffic shaping rules , under "Flow preference", instead of just IPs and ports, those are a little "old fashioned" 🙂 /Thomas

thomasthomsen · ‎Mar 15 2021

What if you wanted it the other way around ? I would like to only send fx. office 365 traffic through the VPN. Does anyone know of a way to do this ? I really miss an update to the "flow preference" so that you could input URL's instead of just IPs. Fx. if I had a connection I would like to be used for Office 365 and all other traffic on the other connection, then there does not seem to be an easy way of doing it. Or did I miss something ? /Thomas

thomasthomsen · ‎Mar 8 2021

Yeah, sorry we cant do that in this network at the moment. Because its already also running a IpSec to Azure (that works just fine 🙂 ). And lets say that worked, what should we do then ? I dont really see a workaround 😕, but perhaps Im missing something. I have tried some packet capture, to see if I could troubleshoot the problem , but all I see is the 6 initial packets back and forth, and then just an information packet. Then it starts over. /Thomas

thomasthomsen · ‎Mar 8 2021

Hmmmm could this be the DHCP lease time on the WAN thats kicking in ? It pretty much every 6 hours. I was not aware that this customer used DHCP on the WAN. This, of course, brings the next question, is there a way to see the lease time of the WAN on a MX ? 🙂 (Im guessing no). /Thomas

thomasthomsen · ‎Mar 8 2021

When we look at the connection graph for the same period there is nothing to see.

thomasthomsen · ‎Mar 8 2021

I kinda gathered that the VRRP process would still be running, because the secondary is still in the configuration. There does not seem to be a uplink down, BUT, when you look at the eventlog, you can see that it drops all its VPN connections, and then the DREADED : Events where not logged. This indicate that something definitely has happened. But I cant see what, this is of course very frustrating for both me and the customer. Could I get these "dropped" events by setting ip a syslog server ? The last time I tried that, nothing was registered on the syslog server. 😕

thomasthomsen · ‎Mar 8 2021

Well that part I kinda knew 🙂 Its just so strange. We simply cannot get this to work.

thomasthomsen · ‎Mar 5 2021

Im trying to setup a IPsec tunnel to a VMware NSXv but it fails. We have tried IKEv1, IKEv2 but it just fails. Has anyone ever tried to set this up ? The config options are very limited in both ends (and the debugging options are horrible on the MX end), so we are kind of at a loss. We think that it might be because the MX sends the configured nets as 3 packets (one for each net, proxy ID something), as to where the NSX sends one with all nets ? Im at a loss.... /Thomas

thomasthomsen · ‎Mar 5 2021

We have a site that has been configured with two MX. The secondary has only been online once, and is now offline without power and so on. Why do I get these VRRP transitions when the secondary is not even there ? Its very strange.

thomasthomsen · ‎Feb 22 2021

But how did you do this ? Did you use Flow preferences ? (because here I can only select WAN1 or WAN2 in the prefered uplink). Or did you do the NAT thing as described somewhere above here ? Im curious. Thanks Thomas

thomasthomsen · ‎Nov 17 2020

Sorry to wake this old tread 🙂 Im interested in what you did here (because to me its not quite clear). But does your solution give you the option to route a guest vlan out another public IP then the one the MX has for itself ?

thomasthomsen · ‎Nov 17 2020

he he .. I will then 🙂

thomasthomsen · ‎Nov 17 2020

Hi all Cant seem to find the answer to this anywhere (that being yes or no). Can you do dynamic VLAN assignment on MX or Z3 wireless part ? And when I say dynamic VLAN assignment, I mean that my radius server returns a VLAN ID to the MX / Z3 with the access-accept like on the normal AP's (Of course the VLAN would have to be created on the MX / Z3 manually first, that I do get). But is that possible ? /Thomas

thomasthomsen · ‎Oct 20 2020

I looked at the API, and I thought that one only worked for the MX (since its called WAN1 🙂 ) If this works, then its the way to go. Thanks. PS: I have not tried it, because there where "only" 50+ APs and I just "grinded" my way through them.

thomasthomsen · ‎Oct 19 2020

Its a good suggestion, and I did think of it, but it is unfortunately not possible in this situation. I will configure them all one at a time, and make a wish. PS: The good thing is that for the physical mounting, we might not actually need to pre-provision the APs, mesh might "save" us here... I mean , AP gets PoE, cant connect to the dashboard, but can hear another (already configured AP), and from that one get its config from the dashboard. We are just testing 🙂

thomasthomsen · ‎Oct 19 2020

Well the use case is replacing a already excising solution from another provider. And the customer tags the management VLAN to the AP. He would be "sad" if he had to go reconfigure all his switchports (not Meraki switches ..... yet 🙂 ). The customer sees no problem in provisioning the APs before they are physically mounted. But , as you mention, there does not seem to be an easy way, so, ill go through these APs one at a time. A good thing there are only 50 something ..... 🙂 Thanks /Thomas

thomasthomsen · ‎Oct 19 2020

Hi all. Is there an easy way to set the management vlan id for all APs in a network ? For example if I want the APs to tag their management traffic with vlan 10 for all APs ? I cant quite seem to find a way, there does not seem to be a dashboard field fo all APs (like there is for switches), and I cant quite seem to find an API way (maybe there is) ? Does anyone know, or is the only way to go through them one at a time ? Thanks Thomas

thomasthomsen · ‎Aug 17 2020

Its nice to see that something is being done about the wired MR30H ports. There are still some strange issues, perhaps this fixes it.

thomasthomsen · ‎May 20 2020

WPA3 and iPSK does not "mix". I think they are trying for a solution (at least on the Cisco Classic side with ISE), but because of the way you do the new authentication it might not be possible (as far as I remember). Thats properly why there is no WPA3 option there (yet, hopefully).

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges