Meraki

NolanHerring · ‎Jan 23 2019

Found it 😃 Upgraded my lab just now, the option only shows up when you upgrade to 26.1 My assumption is that it is equivalent to the Cisco WLC option (if your familiar) called DHCP Required, which I personally think is great. Another layer of security (so to speak).

NolanHerring · ‎Jan 23 2019

Just noticed its available as of yesterday/today: Not sure what Mandatory DHCP is yet though lol New features Initial stable firmware for MR42E/53E/20/70 Auto external antenna detection for C/D/E/F series antennas Mandatory DHCP Umbrella Integration with MR MR no longer disassociates client upon receipt of CoA packet Alternate Management VLAN. Contact Support. Maximum speed limit of “75+ Mbps” removed from Local Status Page speed test Added the ability to download diagnostic information from the device local status page for the Meraki Support team to examine Security fixes CVE-2018-16986 (MR42E/MR53E) Fixes provided for Local Status Page Vulnerability issue (MR20/MR42E/MR53E/MR70): https://meraki.cisco.com/blog/cisco-meraki-customer-advisories/ Bug fixes VoIP RTP packet loss (MR42/MR52/MR53) A corner case causes lower than expected throughput on the 2.4GHz radio (MR26/MR34) A corner case where radios become unresponsive for 5 seconds in high density networks (MR34/MR32/MR72/MR26) A corner case where radios to become unresponsive (MR26/MR72) Client signal strengths for some clients were incorrectly reported by AP (MR34) Air Marshal erroneously reported rogue for MAC 00:00:00:00:00:00 (All MRs) APs sent empty 802.11k neighbor reports (MR42) A corner case where APs reboot under certain conditions (MR32/MR52/MR74) Magic ARP no longer counted as Rogue SSID events (All MRs) Mesh neighbors no longer shown in RF Spectrum view (All MRs) A corner case where additional hidden SSID was broadcasted from APs (MR26/MR32/MR34/MR72) No longer classify mobile hotspot SSID’s as Rogue SSID in Air Marshal (All MRs) A corner case where factory reset causes the AP to go offline until manual reboot (All MRs) Facebook app not blocked by Layer 7 firewall rules (All MRs) A corner case where APs rebooted (MR32/MR52) A corner case where Cisco 8821 phones have issues roaming on certain APs (MR30H/MR33/MR42/MR52/MR53/MR42E/MR53E) APs do not correctly report TX power on Dashboard in certain cases (MR26/MR32/MR34/MR72) Group Policy not applied when client FT roams on 802.11r SSID (All MRs) A corner case where APs rebooted after AutoTX Power change (MR72) A corner case where APs reboot when large number of clients are connected to an AP (MR34) A corner case where APs would not broadcast SSIDs after firmware upgrade (MR34) Transmit power on APs is reported as 0 on Radio Settings page (MR32/34/72) APs on MR25.11 broadcasting incorrect spatial stream supported (MR34) A corner case where AP stops broadcasting SSIDs (MR32) Ability to extend 802.11r PMKID lifetime beyond the default timer of 1 hour. Contact Support (All MRs) DHCP Inform packets causing issues with Layer 2 LAN isolation (All MRs) Corner case where the default gateway mapped for Layer 2 LAN isolation would never age out (All MRs) AP failing to connect when link speed is less than 1Gbps (MR42E) AP failing to connect when link speed is configured for 2.5 Gbps (MR53E) Known issues Mesh instability (MR18, MR20, MR33, MR34, MR42, MR52, MR53, MR53E, MR70, MR74, MR84) Sporadic packet loss & instability on Layer 3 roaming & Teleworker VPN SSID’s (All MR’s) Other General performance, security and stability improvements.

NolanHerring · ‎Jan 23 2019

The only way that I know of to know if an SFP is compatible or not, is to try it. In your case, it does not appear to be supported/compatible.

NolanHerring · ‎Jan 23 2019

Like from another vendor or another Cisco device? Pretty sure that is a firm nope

NolanHerring · ‎Jan 22 2019

Doesn't sound like your blocking anything specific to the protocols Wi-Fi Calling uses. In my experience has always been a little finicky. Sometimes it kicks it automatically after being on the call for a few seconds, sometimes it doesn't. If I put the phone in AirPlane mode, sometimes it works, other times it says it requires a mobile network connection. If you try it in airplane mode, does it allow the call to initiate? This is what I do to force it (when it works that is). Also I'm assuming you have it enabled on the phone your testing with since it needs to be manually turned on first etc.

NolanHerring · ‎Jan 22 2019

I am not aware of any ability (currently) do create/update group policies for an existing network. There are API calls to update clients and what group policy they reside in, but as for the actual policy itself, I believe you'll need to create them manually. I'm not very familiar with the whole template side of Meraki. I tend to stay away from it as it confuses me and also scares me when I'm sleeping (jk lol).

NolanHerring · ‎Jan 22 2019

If your using an open authentication SSID, are you able to utilize the NAT mode for that SSID (instead of bridged). This would solve the issue with DHCP scope being too small. Or just make it larger. Once a client is blocked, they'll get that message and they shouldn't be able to do anything.

NolanHerring · ‎Jan 21 2019

Follow up : https://docs.umbrella.com/deployment-umbrella/docs/2-prerequisites-1 DNSSEC DNSSEC is a set of security extensions for DNS that provides the means for authenticating DNS records. Currently, Cisco Umbrella VA does not support DNSSEC for resolving DNS queries for internal or external domains.

NolanHerring · ‎Jan 21 2019

I'm going to say no based on what I've found/not found. (feel free to correct/educate me if I am wrong anyone) Meraki is starting to incorporate Cisco Umbrella if that helps you in any way, as well as being able to specify your own DNS etc. https://meraki.cisco.com/blog/2018/08/meraki-mr-umbrella-a-match-made-in-the-cloud/

NolanHerring · ‎Jan 21 2019

lol it's the simple things in life. This is what happens on a Monday morning with no coffee >.<

NolanHerring · ‎Jan 21 2019

Actually I just tested, looks like it does not matter if you have read-write or read-only. Both can see that option. Not sure why it isn't showing. That's odd. Assuming you have a map added, and access points placed on the map etc.?

NolanHerring · ‎Jan 21 2019

What devices do you have (how many) and are you an admin for that network (or read-only)?

NolanHerring · ‎Jan 19 2019

Are you waiting for that device page to auto-update because I don't think they do. I think you need to go back to the device list and click on it again and see if the config changes status. Otherwise I think that timer just keep going up.

NolanHerring · ‎Jan 18 2019

SAML here, no issues seen (yet)

NolanHerring · ‎Jan 18 2019

MX would be per-network You 'could' tunnel everything to one but depending on your setup, might not be the best option.

NolanHerring · ‎Jan 18 2019

HA ! So that is exactly what I was referencing in my first response lol So basically that group policy you have on the access control settings for that SSID is going to have false positives as you've clearly seen. I have to deal with this myself, where it thinks that a MacBook Pro is an iPhone and it blocks it. I probably get a client a day for this type of thing. Two solutions: 1. remove that feature 2. use EAP-TLS with certificate/machine based authentication and then remove that feature

NolanHerring · ‎Jan 18 2019

Ok so now that we know which SSID, show a screenshot of how you have the access control page configured for LXRandoCo HQ - wireless WiFi SSID Also that SSID name is super redundant lol 😃

NolanHerring · ‎Jan 18 2019

Show me those results and that will help determine the root cause. Also, show us a screenshot if you don't mind, of the access control settings for that specific SSID as well please 😃

NolanHerring · ‎Jan 18 2019

So when it changes to custom, drop down the menu to see what exactly it changes to. I'm assuming the option in red below is selected and it chooses something?

NolanHerring · ‎Jan 18 2019

Assuming the MX can reach the Internet without issue? Also assuming your using the Internet port on the MX in the data center when your connecting it to your core or wherever you have it connected. Are you using a static IP for the MX at the data center? VLAN set correct etc. https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide Routing The MX acting as a VPN concentrator in the datacenter will be terminating remote subnets into the datacenter. In order for bi-directional communication to take place, the upstream network must have routes for the remote subnets that point back to the MX acting as the VPN concentrator.

NolanHerring · ‎Jan 18 2019

When the device changes from NORMAL to CUSTOM, what exactly changes. When you choose the drop down menu to change it back to Normal, what is it specifically that is different on the policy. Does it move them to Blocked or something? For a specific SSID? Screenshot if you got it 😃

NolanHerring · ‎Jan 18 2019

Also keep in mind their are two different license types for the MX appliance. Which ever one you choose is ORG wide, so any future MX you purchase you will have to purchase the same license. (advanced security being more expensive for obvious reasons). What is the difference between the Enterprise and Advanced Security licenses for MX? Enterprise The Enterprise license includes all base functionality, including but not limited to: Statefull Layer 7 Firewall Site to site VPN Client VPN DHCP Branch routing Intelligent path control Application visibility and control Web caching (MX84 and higher only) Advanced Security The Advanced Security license includes all Enterprise license features, plus the following advanced threat management capabilities: URL Content Filtering Google SafeSearch enforcement Youtube EDU enforcement Intrusion Prevention Advanced Malware Protection (AMP) with Threat Grid support Layer 7 Geo-IP Firewall Rules

NolanHerring · ‎Jan 17 2019

Any logs showing specific errors for those Z3 not being able to talk to vMX? Also, you don't by any chance have any firewall rules allowing those specific sites only (assuming they have static IPs on the MX68s, where as the Z3 are going to be dynamic IP) and blocking anything else etc.

NolanHerring · ‎Jan 17 2019

Sounds like someone else might be making the changes. Or you might have a group policy that changes it based on OS type for example. Check the change logs to see if its another admin doing it under Org settings

NolanHerring · ‎Jan 17 2019

If you want to do this via API I believe this command will do it. curl -L -H 'X-Cisco-Meraki-API-Key: <key>' -X GET -H 'Content-Type: application/json' 'https://api.meraki.com/api/v0/organizations/[organizationId]/deviceStatuses' Successful HTTP Status: 200 [ { "name":"My AP", "serial":"Q2XX-XXXX-XXXX", "mac":"00:11:22:33:44:55:66", "status":"online", "lanIp:"1.2.3.4", "publicIp":"4.3.2.1", "networkId":"N_1234" } ] Or possibly this one here curl -L -H 'X-Cisco-Meraki-API-Key: <key>' -X GET -H 'Content-Type: application/json' 'https://api.meraki.com/api/v0/organizations/[id]/inventory' [ { "mac": "00:18:0a:12:2d:da", "serial": "Q2AT-Z8Q8-7TPH", "networkId": "L_646829496481095660", "model": "MC74", "claimedAt": "1483748363.47231", "publicIp": "198.27.198.2" } ]

About NolanHerring

NolanHerring

Nolan Herring

Community Record

Badges