Meraki

thomasthomsen · ‎Oct 27 2021

When copying a MX config to a new network how do you edit / handle firewall rules, VLAN and DHCP scopes, when everything you try results in an error. For example, when editing VLAN on the new network, it gives an error because the firewall rules for these networks are then not present. When I try to remove / edit the firewall rules, then its VLAN and DHCP that's the problem (because the VLAN of course do not have the new IPs in the new ACL, and the DHCP has helper adresses on autovpn (That is of course not up). Then if I for fun try to set all DHCP back to using the MX. I get this error... thats very funny Dashboard ... thats very funny. (The above networks is used in a RFC1918 Group on the firewall). So cant remove firewall because of DHCP (IP Helper), cant remove DHCP because of firewall, cant edit VLAN because of firewall (and DHCP I see in the error) .... What the *beeb* ..... What the point of being able to copy a configuration / new equipment to a new network when you cant edit ? Or am I missing something ? /Thomas

thomasthomsen · ‎Oct 23 2021

So long story short. Customer got the MG41 and set it up but forgot to remove PIN. When accessing the MG on the status page, it is not really visible that this is the issue. But when I got it online through "safe mode" it actually tells me that its the PIN on the SIM. We found the PIN, but unfortunately, PIN is not supported in the current software on MG41, so my question is, when will it be supported ? - Or do we need to get a lift and physcially access the device ? /Thomas

thomasthomsen · ‎Oct 19 2021

yes that would be a perfect solution. Everyone should "upvote" this 🙂

thomasthomsen · ‎Oct 18 2021

The documentation says : "highest-numbered VLAN" as the source. This just feels so "cumbersome" when deploying a lot of new hardware on remote sites when all other equipment , like switches and APs bascially use VLAN 1 as the default. I could of course configure a "high numbered VLAN" on the MX, and set that as untagged towards the switches, but I dont think my small amount of OCD can handle that 🙂 Is there any way of getting the MX to use VLAN1, or any vlan of our choosing for this kind of traffic (this case site-2-site tunnels of course). /Thomas

thomasthomsen · ‎Oct 5 2021

Current scenario. Some classic Cisco 3750v2-24FS - 24 Ethernet 100FX SFP ports - Yep .. that's one hundred FX 🙂 These 100FX SFP modules, will they work in a MS410 ? The datasheet does not say, so I'm guessing no. But just checking if anyone knows for sure 🙂 (PS: I can see that CAT9K switches supports them still). /Thomas

thomasthomsen · ‎Sep 29 2021

You "kinda" have some of that functionality now with "SecureConnect" - That reconfigures your AP ports, and actually authenticates the AP on the port, so win win. If only they would extend this functionality between switches, and make it so you could for example limit the number of VLANs on the secured port (or have a SecureConnect port template config you could change, one for APs one for switches, and so on 🙂 ), then it would be absolutely awesome.

thomasthomsen · ‎Sep 29 2021

Yeah we could push a GP, but on a layer 2 switch would that be "honoured" at the switch ? or would that only be applied on the MX's layer 3 interface ? - We like port isolation because it blocks all the way down between clients on the same vlan. We could of course have gone SGT's (Adaptive policy or whatever its called in a Meraki setup), but time and money. And SGT's do not yet extend all the way across MX's and AutoVPN, so just for this small scenario it was kinda overkill, the day it does (extend across MX's and autovpn), it will be a super solution 🙂 . - So our quick and dirty solution for now was port isolation, but then we "kinda" ran into this problem with some ports (devices) that might not "need" it. We use dot1x for everything, so it would have been nice if we could have toggeled that port isolation switch using a radius response. Thanks for all the suggestions and comments.

thomasthomsen · ‎Sep 29 2021

We are using CoA for other things in this setup, but it cannot solve my "layer2" port isolation problem.

thomasthomsen · ‎Sep 29 2021

I was thinking about using GP, and ACL, but I think my "problem" would explode in number of ACL's and GPs.

thomasthomsen · ‎Sep 29 2021

Can you send a response from the radius server that puts the port into port isolation (or not) together with vlan and all other "normal" settings. I cant find anything about it , so Im guessing no, but someone might know for sure 🙂 Thanks Thomas

thomasthomsen · ‎Sep 27 2021

Then let us parse it to syslog, anything.

thomasthomsen · ‎Sep 24 2021

I rebooted, downgrade , and so in, Nothing helped until I removed Hong Kong from the blocked country list. I think Meraki should make a "current status" page of their nodes, AND their partner services, so we can keep up in an online and "realtime" way.

thomasthomsen · ‎Sep 24 2021

Uhhhh nice, didnt know you could get support to do that. But that would fix his problem, absolutely 🙂

thomasthomsen · ‎Sep 24 2021

Dont worry, already done. But Im just one man 🙂 @everyone , please use that "Give your feedback" button ... absolutely use it.

thomasthomsen · ‎Sep 24 2021

Ahhh there is the problem. https://community.meraki.com/t5/Security-SD-WAN/Google-com-incorrectly-Geolocated/m-p/129810/highlight/false#M32352 But you are COMPLETELY in the dark here on a MX. So please, development, make this visible in eventlog or security center when things are blocked by geo.

thomasthomsen · ‎Sep 24 2021

So that might explain my problem. https://community.meraki.com/t5/Security-SD-WAN/No-quot-google-quot-services-all-of-a-sudden-What-the-beeb-is/m-p/129808#M32350 Now my wish is to have the eventlog or security center represent when something is being blocked by Geolocation, because you are completely in the dark as to what is going on.

thomasthomsen · ‎Sep 24 2021

So all of a sudden none of the Google services where working on my lan here. So I started troubleshooting , I thought it was my local (PC) firewall that was doing something(tm), but when i did some packetsniffs on LAN and WAN I could see the packet reacing the MX on LAN but nothing on the other side ...... I then tried from the "tools" of the MX to ping google.com and youtube.com just because they are both google services. This is the result. There is nothing in the evenlog abut blocking google.com or youtube.com There is no ACL that does this. There is nothing in the security center. So kinda hard to troubleshoot any future ... Does anyone want to venture a guess ? I have also disabled content filtering , amp and IPS, just to test. Same thing. Downgraded from 16.x to 15.x , same thing ....

thomasthomsen · ‎Sep 24 2021

But between two versions in the same release train there should not be that many "new features". Sure I understand if you upgraded to 16.x or 17.x when it arrives, but within 15.x and no new configuration done on the box, that just indicates to me that something else is going on.

thomasthomsen · ‎Sep 20 2021

Just the same graph, without me drawing on it. and the normal network graph for the same days. There does not seem to be a higher amount of traffic passing through.

thomasthomsen · ‎Sep 20 2021

A customer of mine upgraded from , and Im guessing here, because the change log does not tell us what software you where running before, 15.x (fairly new) to 15.42.3 most likely because the system was forcing /telling him to, and then again to 15.44 (most likely again, because the system was forcing him to, or told him so). After this, his utilization spiked. 1: first update during the night 2: second upgrade during the night (not much change here in utilization). Have anyone else seen something like this ? I am also chasing other reasons why the utilization has spiked, but it just fits the software upgrade. (no change have been made to the configuration) /Thomas

thomasthomsen · ‎Sep 15 2021

Hmmm one more thing I cant find in the documentation. Does a SSID tunnel to MX count as a site-to-site tunnel ? towards the maximum number of site-to-site tunnels a certain MX HW appliance can handle ?

thomasthomsen · ‎Sep 15 2021

Thanks, it was just not very clear from the Documentation I think.

thomasthomsen · ‎Sep 15 2021

I cant seem to find this information. I know that the AP creates a tunnel to the MX. And I know that when the MX is in "NAT" mode, I can select the VLAN from the dropdown list. But when the MX is in concentrator mode it just says : (Enter a VLAN id, or leave blank) If I enter lets say 100 here, will the contrator mode MX (thats only connected on the WAN port) tag packets from this SSID out with VLAN 100 on that WAN port ? /Thomas

thomasthomsen · ‎Aug 31 2021

So ... I'll just mark my own answer as the solution ... *DOH*

thomasthomsen · ‎Aug 31 2021

I found my mistake: The devil WAS in the what I called : "it's just a "stupid" switch with not port security or anything configured on it." Used an MS for that, default configured. In that default configuration : "Flood unknown multicast traffic" is not enabled". So ... of course VRRP is having a semi hard time. That fixed it. Thanks for listening to my worries / rants.

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges