Meraki

CarolineS

Thanks for this answer, @GIdenJoe! I'm marking it as the solution. @M_Faizal - if this does not answer your question, please let us know what further clarifications you need. Cheers!

Mloraditch

Disable MAC Randomization is a per ssid setting in MDMs, so you are not disabling privacy for devices when they are used on other networks and as you are saying they don't leave campus, I'm not sure what the concern is. They are your devices, on your network. What makes them any different in that scenario from a wired desktop? They just happen to be on wireless.

Stephen_P

The RMA swap did not resolve our issues. We swapped out our original MX450 with the RMA replacement on Sunday. Two days later (today) the new MX450 just rebooted interrupting internet across our campus. I'm contacting support yet again, but this is unacceptable. We need a reliable firewall, not one that is now rebooting every two days. We are running 18.211.4 on the new firewall as well.

Mloraditch

Per the schema: https://developer.cisco.com/meraki/api-v1/get-organization-clients-search/ recentDeviceMac is supposed to provide this, which you could then cross reference.

Wahidullah

Thanks @DarrenOC for sharing the link, some stuff are not changeable but it is very good environment to deep dive and work/practice. Thanks again.

PhilipDAth

Another memory just came back to me. Subscription licencing is applied network by network. I did a company recently that was managed as a single organization, but each site was financially separate from the others. I sold each site their own seperate subscription for their own network. They can even have different length subscriptions.

chakshu

This is a known bug on 18.211.4/.5, rolling back to 18.211.3 should fix the issue.

Hiren101

i have opened the case. they are working on scope with tag issue. they did admit that it's not working.

chakshu

First things first! Is this affecting wired devices as well or just the ones over WiFi? Can you test it with a PC on a vlan(other than 1) without RADIUS auth? What happens after 5 minutes of inactivity, does the PC goes to sleep?

Mloraditch

CDP/LLDP info in the dashboard doesn't clear instantly like on IOS devices. I've seen in the past it take up to 48 hours for the old info to clear out.

Mloraditch

Just had another related issue where an order didn't generate licenses because the MX licenses on the order were SEC but the VMX was ENT. My disti had to open a CS case which then generated the licenses and then had to go through the mentioned support process to claim then. Might recommend partners putting VMX (and Z4) licenses on a seperate PO for now to avoid the intermediate step.

lmt737

the issue was not multicast at all. the page system had to have a settings change.

PhilipDAth

Going sideways, if you use SAML authentication, you can't be locked out. https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_Single_Sign-on_for_Dashboard

Mloraditch

If I'm understanding the translation I got correctly you want your wireless clients to be able to talk to your AD servers without routing through the MX. You would need to set your SSIDs to drop traffic onto the same VLAN as the AD server or if you had a layer 3 switch available you could move the relevant routing there. Do you have a specific goal in mind? Like lowering the load on the MX or ? If everything is working right now without performance issues, I'm not sure I'd be making any changes in the same circumstances, but I may be missing something with the translation.

Rahali

yes looked it up seems to be working only with the switch(wired devices), couldn't make it work with SSID's

RaphaelL

No. Cases are opened since early 2024 and bugs are still not fixed.

DarrenOC

Syslog, syslog, syslog……

DarrenOC

Love that comment @RaphaelL “iam young and looking for the nightlife”. Enjoy and make the most of it.

Mloraditch

Those look like valid logs. If your system isn't parsing them properly you would have to take that up with them. The only note I see on that page about formats says timestamps are required and the entry above does have that. I will point out that documentation page is for Firewalls and doesn't mention any compatibility with wireless or switch logs. The example you've provided is wireless. The system may not support things besides firewalls. In general, Meraki doesn't offer formatting options for their syslogs so your tool has to be the one translating them into something user friendly.

SimonReach

Think we've managed to solve it, we need an RD Gateway for it and a certificate. From what appears to be happening, the new Server 2022 RDS server is seeing every machine on the local LAN, meaning within the Data Centre, as being fine but anything that is across the SDWAN, despite being on the same domain and part of the same network, is external so a certificate and an RD Gateway is needed. Even VPN users connecting to the client vpn the Data Centre MX is being seen as external. Our Server2016 server doesn't require any of this and picks everything across the SDWAN as being internal.

PhilipDAth

I'll take a punt - it might be mac address randomisation. If you disable this, so clients always use the same MAC address - does it solve the problem?

prabhulkars

Yes, /29 would work for you. VRRP is by default sent over LAN and it uses the LAN VLANs for VRRP traffic. Please check the following documentation on more details regarding High Availability pair: https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair

PhilipDAth

Meraki can't tell you what your requirements are. You have to form them based on what applications you need to run and what they require.

PhilipDAth

This. You need to enable QoS in Teams first. Afer you do that, there isn't much to do if you have Meraki's default traffic shaping enabled.

JNetworkMan05

Hello, I tried the Layer 7 firewall rule and it seems to have not worked (same errors this morning with the failed VPN logins). Reading into your second suggestion now.

About Mloraditch

Mloraditch

Matthew Loraditch

Community Record

Badges