Meraki

Mloraditch · ‎Oct 25 2021

We have and despite the various bug descriptions, the 802.1x bug we have with voice vlan clients is NOT fixed in 14.32

Mloraditch · ‎Oct 8 2021

It appears 14.32 is becoming available with the relevant fix. Just got a push notice for it for a client. It’s not showing up in all my orgs yet but I think that can be a propagation delay.

Mloraditch · ‎Oct 6 2021

Talked to tech today, he indicated the next stable release was the goal. Didn't give a timeline.

Mloraditch · ‎Oct 5 2021

I have an open case. No eta yet but I got asked for more info yesterday and told: "we have identified some backend issues for this firmware that are likely causing this behavior." Haven't provided the additional info yet or been able to talk to the tech.

Mloraditch · ‎Sep 24 2021

I like your model breakdown of the bugs. Maybe someone smart at Meraki will start doing that!! You do have the second to last MS390 bug listed wrong. Its a 355 bug. This is a fun one when you are in the middle of an ISE Rollout: Clients on a RADIUS authenticated port that ages out of the MAC table due to inactivity will fail to be relearned until a port bounce has occurred (present since MS 14.28) At least it's identified now.

Mloraditch · ‎Sep 3 2021

Got a few email notifications today that an MX I manage is using AMP and/or Threatgrid and I need to update. Was aware of the overall need to update. A comment for whomever did this mail merge.... maybe just maybe include the Org and Network where this is! I manage over 100 orgs with over 400 MXs... I can find them, but it sure would save some time.

Mloraditch · ‎Apr 13 2021

Seems they skipped a few versions 14.17 Fixes Bug fixes MS390s could show the incorrect root port in dashboard Fixed an issue where large configuration changes could encounter issues updating properly on MS390s Various performance and stability improvements 14.18 Fixes: Bug fixes Viewing a MS390's routing tab would result in a reboot Various performance and stability improvements 14.19 Additions and Fixes: Additions MS390s now support RADIUS accounting Bug fixes When a port's configuration is changed, all switch ports that use dynamic VLAN assignment are deauthenticated and require reauthentication MR44s and MR46s with the MAC address in the following range, 68:3A:1E:FF:F9:63 - 68:3A:1E:FF:FA:46, will not be detected by SecureConnect Fixed an issue where switches would repeatedly send out an excessive number of router solicitations Fixed an issue where under rare circumstances, MS425 fans will stop running which can cause the unit to overheat and power down MS390 dot1x events will now be logged Known issues once you get to 14.19 Known issues MS390s may show a client's VLAN as "native" instead of the correct VLAN number MS390 port traffic in the UI on occasion can show negative traffic for a client MS390 series switches Max MTU is limited to 9198 bytes MS390 series switches will not display packet details in the DHCP Servers page MS390 series switches do not support the 'next-server' or 'bootfile' parameters in DHCP messages Rebooting any MS390 stack member via the UI will result in the entire stack rebooting LLDP frames from MS390 series switches will use a single system name instead of the Dashboard given name MS390 series switches will not display the advertising router ID for OSPF MS390 series switches with OSPF enabled will default to an IP MTU of 1500 bytes on every OSPF enabled interface MS390 series switches do not support the multicast routing livetool MS390 series switches do not support tagged traffic bypass for voice on ports with a Multi-Auth access policy MS390 stacks on rare occasions will require a manual reboot after the upgrade has completed Dynamic VLAN assignment from a RADIUS server on MS390 series switches must already be an allowed VLAN on the port for it to function MS390 series switches do not currently support the following features: VRRP, SM Sentry, Syslog server, SNMP, Traceroute, IPv6 connectivity to dashboard, Meraki Auth, URL Redirection, MAC Whitelisting, Loop Detection, UDLD, MAC Flap Detection SM Sentry does not support Windows based clients (predates MS 10.x) MS425 series switches do not forward frames larger than 9416 bytes (predates MS 10.x) MS350-24X and MS355 series switches do not negotiate UPoE over LLDP correctly (predates MS 10.x) MS355 stacks upon reboot have a chance that the uplink port will go into STP blocking state (predates 12.X) Switches on 12.28+ will sporadically drop DHCP Offers when a relay is in use L3 switch stacks with multicast routing may fail to route streams through all members MS120s can experience packet loss when forwarding from a 1Gbps to 100Mbps port MS320s may experience reboots when in large L2 domains (predates 12.X)

Mloraditch · ‎Mar 10 2021

As the VMXs only work as concentrators they don't have anything beyond the ENT sku. See all SKUs here: https://meraki.cisco.com/product-collateral/mx-family-datasheet/?file

Mloraditch · ‎Feb 9 2021

FYI, I've had no issues with 15.x, but it appears they are now pushing it out. Got notices for several clients to get pushed from 14.53 to 15.42 over the next month.

Mloraditch · ‎Jan 21 2021

That reboot bug was killer. We had MS210/225 stacks that we needed the 14.5 fix for routing in and we deployed it and then we discovered the reboot bug. Not a fun time with those customers. Have deployed 14.12 to two test sites and keeping my fingers crossed we've found the one ring...

Mloraditch · ‎Nov 25 2020

Cisco did recently release SFP-10G-T-X= for their regular products. I've heard it's supposed to work in Catalyst 9Ks soon. So that should mean something will be available for MS390s eventually. Lots of speculation but it is a logical path.

Mloraditch · ‎Nov 10 2020

At a good number of sites we have third parties that also need connections to the DMZ so we need to be able to monitor them. Hence the MS120s. It appears dumb switches are smart and smart switches are dumb in this scenario!!

Mloraditch · ‎Nov 10 2020

I've experienced this numerous times, but when I do, it's almost never in a state where I have time to deal with support. We use MS120-8s as DMZ switches. Sometimes when they or the MXs do a reboot/firmware upgrade the WAN Ports do not come back online. If somehow your MS120 is still online you can change the ports to 100/full, which "kicks" them online and then once online change back to auto and you are good to go. Interestingly enough: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu65369/?rfs=iqvred this bug was recently filed on the main Cisco side of the house. Has anyone else seen this? Did you come up with a solution? It's only MX100s I've seen this in. I can't hardcode to 100/full as my bandwidths are larger than that and while the MS120 allows a hardcode to 1gb, the MX doesn't.

Mloraditch · ‎Nov 8 2020

What does 50 Tunnels mean, connection to 50 other MXs or actual tunnels? I.e. if you have 25 spokes each with active dual wans, that would be 50 tunnels?

Mloraditch · ‎Sep 12 2020

I think it's this: https://documentation.meraki.com/MX/Deployment_Guides/Cisco_Meraki_MX_Branch_to_Azure_Virtual_WAN_Deployment_Guide Which is using scripts hosted on what appears to be an employees personal github account? Doesn't exactly make me super confident. I suppose it'll be quite a bit cheaper than a vMX license but with quite a bit more complexity.

Mloraditch · ‎Aug 6 2020

Hmm, it says it can apply to inbound rules but that doesn't appear to be active yet. Also somewhat disappointing that services can't be grouped yet. Hopefully that's on the roadmap. That in combination with inbound rules are our biggest need.

Mloraditch · ‎Jul 28 2020

So thanks all. Option 2 that @JimmyPhelan mentioned is what I believe this vendor is saying. I much prefer vMX and have used it before and will stick with that if at all possible. I don't control the Azure environment in question so some negotiation will be necessary.

Mloraditch · ‎Jul 22 2020

Yes thank you, I'm aware of that, but what did not work previously and I'm being told by a third party vendor may work now is the ability to have multiple sites in the same org peer to the same Azure Virtual network gateway.

Mloraditch · ‎Jul 22 2020

Has anyone successfully setup a policy based VPN to Multiple Meraki sites in the same org? Did you have to go to 15.x firmware? So essentially you have one third party connection listed in your dashboard and it works for all enabled sites?

Mloraditch · ‎Jun 7 2020

A product page has been posted: https://meraki.cisco.com/product/security-sd-wan/license/secure-sd-wan-plus-license/ And Licensing info: https://documentation.meraki.com/zGeneral_Administration/Licensing/Meraki_MX_Security_and_SD-WAN_Licensing Right now it's essentially just adding MI to Adv Security but to every unit in your org. But down the road it will include more powerful SD-WAN smarts. If you look at the recent announcement of Thousand Eyes being bought by Cisco I have a feeling that might be related. It's priced at basically Adv Security plus MI so if you already have MI for all your sites I'd suggest switching. Per the license page MI will remain available for those orgs that only need limited coverage of that feature set.

Mloraditch · ‎Oct 30 2019

That's what I figured, it's just written oddly. Thanks for the confirmation.

Mloraditch · ‎Oct 30 2019

Can someone clarify this caveat: Do not use Cloud Track in a dashboard network where the MX's WAN ports are connected to a Meraki switch in the same Dashboard network. If you need to use a Meraki switch in between your ISP and the MX WAN please separate this switch from both the dashboard and physical network. Source: https://documentation.meraki.com/MX/Monitoring_and_Reporting/Client_Tracking_Options I can understand the dashboard network, but don't understand the physical part. We use MS120-8s as DMZ switches which I imagine is common for HA pairs. I can certainly move all my DMZ switches to their own network, but I can't physically separate them?? Any idea? This feature appears to be very fresh so not sure if anyone has tried yet.

Mloraditch · ‎Dec 17 2018

Thanks both of you for the replies, it appears neither option will exactly work in my scenario. May just have to get the customer to get a vMX.

Mloraditch · ‎Dec 13 2018

Is there a way to do this? Have multiple sites connect to the Same VPC? It appears not, but figured I'd ask as I know there are some wizards around here.

Mloraditch · ‎Aug 28 2018

Check with support, it's not clear in what I've read so far.

About Mloraditch

Mloraditch

Matthew Loraditch

Community Record

Badges