Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About whistleblower
Community Record
136
Posts
4
Kudos
0
Solutions
Badges
Oct 27 2020
8:28 AM
1 Kudo
... and what happens when Traffic is explicit configured to use WAN-2 and this link fails - will that traffic also move to WAN-1?
... View more
Oct 23 2020
4:55 AM
@GreenMan wrote: Try using a different management VLAN for all the downstream devices (for which you can serve DHCP) - with a dedicated VLAN for management of the routing switches. what do you mean exactly with that, maybe you can give me an example?
... View more
Oct 23 2020
1:58 AM
hi all, I`d like to know whether the following requirement can be implemented - a MS350 (physical stacked) should act a Layer3 LAN gateway for some IP-subnets and one of these IP-Subnets should participate as transition network in OSPF-Routing -> please have a look on the attached sketch! -> so far I hope this could be made up and is no problem... 🙂 the question for me is now, if the MS350-Stack is also serving IP-Adresses via DHCP for the other Meraki devices out of the MGMT-VLAN would this work? reading through that documentation it`s not recommended... 😕 https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MS_Switching/General_MS_Best_Practices I hope someone can help and I thank you for your support in advance
... View more
Jul 8 2020
3:37 AM
Hi, a quick question, I´d like to know if it`s possible to access a MX-Firewall which operates in Passthrough/One-armed Concentrator Mode from WANside? I can`t see any possibilty to configure Security appliance services section... thank you in advance!
... View more
May 28 2020
6:22 AM
Hi, @lomonaco wrote: But how can I specify, for example, that I want the TCP Port 80 and not the UDP Port 80 ? I know that I can include the port number (80,8080,123,53,etc) but I didn't see where I can specify the protocol (TCP/UDP) associated with the Port. any news about this requirment or suggestions whether/how this can be solved? I`d also like to know if there is a possibility - to match both --> the source- and the destination network maybe with Src./Dst. Port in one rule? e.g. 192.168.1.0/24:80 --> 10.1.1.0/24:8080
... View more
May 28 2020
6:13 AM
what i am wondering is why is the overall ratio given x/7, is there a reason for this? Specifying a traffic shaping rule as High, Normal, Low guarantees a certain fraction of the uplink to each priority level. The ratios are as follows: High 4/7 Normal 2/7 Low 1/7 @GIdenJoe wrote: I'd also like to know what happens if you both have the EF46 realtime implicit rule and a high bandwidth priority explicit rule configured for all Voice and Realtime video class. IMO a really good question which I also asked myself as well and in that context I`d like to know, how can this implicit rule/queue be seen? In general I`d like to know if/how the respective queues (/w matched- and marked packets, bufferd-packets, dropped-packets, etc.) can be viewed on the dashboard for troubleshooting purpose! maybe someone here who can answer/clarify this questions?
... View more
May 24 2020
2:40 AM
some more questions about it... the DNS Traffic-Flow: question to Step 2.) does that mean, that it doesn't matter which one or whether a DNS server is assigned in the IP parameters of the DHCP server to the client? or do they already have to be the one`s used from umbrella resolvers? for my technical understanding of how and on what basis does this interception works and make sure that all DNS-Querys would be intercepted - e.g. "any traffic with a destination port UDP/53"...?! because the MR source NAT's the packet to his management IP and redirects it to the appropriate Umbrella endpoint == the AP acts like some sort of DNS-Proxy, correct?! Is there a possibilty to see which client/real LAN IP-Adressis has open sessions to the Umbrella Resolver as well? Probably when using the Security Center to view MR DNS Events = are here the MR Management IP`s or the real Client IP-Adresses shown?
... View more
May 22 2020
4:06 AM
Hi, I´d like to ask you some questions about the following solution scenario: the requisition is, to setup a Guest-WiFi with some MR`s where the SSIDs would be configured in Bridge-Mode where the DHCP-Server is located on an Upstream Router... To get some Content/URL-Filtering I think of using the Cisco Umbrella Solution which could be integrated in/with the Merkai Dashboard. In that typical network level Umbrella deployment, pointing DNS to Umbrella alone may not be sufficient to enforce Umbrella protections. Savvy users may attempt to bypass Umbrella by changing the DNS settings on their machines, so the question for me is, if it`s possible to use the integrated MR Firewall configuration to lock down the users on the Guest-Network to prevent any other DNS service from being used to bypass Umbrella settings and protection (e.g. with an ACL-entry "deny udp any any eq 53")? I`ve read through the following documentation -> https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment but I don`t understand the marked area... how can/does the MR restrict that traffic, if it`s send to the Clients LAN Standard-Gateway (which would be the Upstream Router)? probably someone has already done a deployment which is similar or could tell me if the design approach is suggested at all 🙂
... View more
May 13 2020
7:03 AM
@PhilipDAth wrote: There is one special except to all of this. Packets with a DSCP marking of EF (which is normally only use for VoIP RTP packets) always get sent first in the priority queue. So if their was 100 EF marked packets in the queue they would all be sent before anything else. is there a specific percentage rate-limit also on the Low-Latency Queue so that VoIP-Traffic get`s policed and does facilitate other traffic as well?
... View more
May 5 2020
11:19 PM
so I´ve to configure the Authentication AND the Group-Policies the same way on all MX-Devices...? or is it enough to only configure the Group-Policies on the Spoke MXs? Another question about this is - how should be dealed with it, when only an MX at a central side is used without one at the Spoke side (classic MPLS connectivity /w central Internet Connectivity) - that would`nt work either?!
... View more
May 5 2020
11:36 AM
Hi, unfortunately I do`nt understand the following documentation about "Configuring Active Directory with MX Security Appliances... let`s assume I`d like to setup "MPLS Failover to Meraki Auto VPN" while the MPLS connections terminate on the LAN side of the security appliance! Would the AD integration work on the central Hub side or not?
... View more
May 4 2020
1:08 PM
so you`re talking about the design called "Routed mode Concentrator"... or in other words a HQ/DC where no routed-Core exits?! because the Link you referenced in one of your previous answers is showing the VPN-Concentrator as one-armed...
... View more
May 4 2020
12:59 PM
OK, I understand that! And how do I imagine the configuration for this on the "one-armed" VPN concentrator and/or the upstream device (e.g. Layer3 switch)?
... View more
May 4 2020
12:41 PM
@PhilipDAth I personally do my deployments using 2 interfaces so I have greater control over SD-WAN functionality at the DC end. what do you mean exactly with greater control? Is there any specific configuration/routing needed with 2 Interfaces on the VPN-Concentrator MX?
... View more
May 4 2020
12:23 PM
Hi @PhilipDAth thanks again for your reply 🙂 May I have your assessment of how you`d setup a Non-Meraki VPN-Peering for IP-Subnets which are learned from Spokes via Auto-VPN and are`nt connected directly/locally on the Hub-MX?
... View more
May 4 2020
11:16 AM
Hi all, I`m trying to find out where the local IP-Subnet (interesting traffic) can be configured for the Non-Meraki VPN tunnel? In the local settings you can set whether the respective subnet should participate in the vpn, as I know these settings are also relevant for auto-vpn - if these settings also apply to the non-Meraki VPN peerings - how can a distinction be made here?
... View more
May 1 2020
1:00 AM
@cmr wrote: Why not use firmware 15.x and enable no NAT? We use it for our 1500 user site to site SD-WAN over MPLS? can this issue be fixed with the declartion from @cmr? I mean, that a WAN-Interface configured with NO-NAT reaching over MPLS (central Internet-Breakout) the Meraki Cloud for the Control-Traffic, etc.?!
... View more
May 1 2020
12:44 AM
Probably someone can point out the differences/advantages when using NO NAT on a WAN-Interface... for example: will statistics, content filtering, etc. may also work with it?
... View more
May 1 2020
12:33 AM
Hi @PhilipDAth, thank you for your answers on this so far! I´d like to ask one more question about > Q1-) when using the LAN Interfaces for the MPLS connection... I assume that when I statically route IP-Networks via a LAN Interface for to an e.g. MPLS Upstream-Router --> NO (traffic, etc.) statistics for that tinterface, no matter where on the Dashboard can be viewed - e.g. correct? If so, would this be possible when using the NO NAT/NAT Exemption on the WAN-Interface? by the way -- As far as I can remember there has already a meraki documentation site exited... which pointed out to that it is currently recommended to use the LAN interfaces (for the time being) for native MPLS... maybe you know this link and can provide it to me? > Q2-) With that question I meant whether it is possible to route IP networks that are not directly connected to the MX, but e.g. with static routes are known to NAT them via the WAN interface (central Internet-Breakout) and use at the same time this WAN interface for auto-VPN tunnel termination as well... > Q3-) when setting up the the "AutoVPN over MPLS solution" I`d lose all of the advantages of the MPLS Network (Any-to-Any Communication, etc.) so that could be a drawback?!
... View more
Apr 29 2020
12:56 PM
I think there has been already a link to the meraki documentation site exited, in which it was recommended to use the LAN interfaces (for the time being) for native MPLS! Maybe someone does have this link and can provide it? I`d like to ask also a question regarding the use of the LAN Interface vs. the WAN NO NAT/NAT Exemption feature in BETA... Is my understanding correct that - when I use a LAN Interface for routing traffic to a MPLS Router no statistics e.g. shows up on the appliance dashboard? If so, is this possible when using the NO NAT on a WAN-Interface? Probably someone can also point out the differences/advantages when using NO NAT on a WAN-Interface... for example: content filtering, etc. may also work with it?
... View more
Apr 6 2020
12:18 AM
ok - thank you! But do you think that this would be dramatic in todays LAN`s as well?
... View more
Apr 4 2020
4:59 AM
Hi, is Source-NAT already officially released or a hidden/BETA feature? Unfortunately I could‘nt find some documentation about it?!
... View more
Apr 3 2020
1:34 PM
Hi Guys, when I look at the following network plan (https://meraki.cisco.com/lib/pdf/meraki_whitepaper_vpn_redundancy.pdf), I don't understand - why a Layer3 switch is used/necessary in this scenario? wouldn't it make more sense to "connect" the MXs from L3 perspecitve directly on the 3rd party firewall? Assuming the layer3 switch terminates the customer vlan`s /w ip-subnets you could also regulate this traffic on the FIrewall?! I appreciate every opinion - thank you!
... View more
Mar 31 2020
10:22 PM
1 Kudo
Hi, will this (now) be possible with Addressing & VLANs/Source-based default routes?
... View more
- « Previous
- Next »
My Top Kudoed Posts
© 2024 Cisco Systems, Inc.
