Meraki

Raj66 · ‎Jul 10 2019

Well done and well deserved. Congratulations!!

Raj66 · ‎Jul 10 2019

@Mr_IT_Guy @BrechtSchamp @NFL0NR Agreed guys, I did further digging regarding this and apparently, this is a thing. So, the MXs are not primarily designed to work on PoE but they do work on PoE. This is the expected behavior, while this works, it is not an officially supported architecture. @Mr_IT_Guy Nice discovery 🙂 Cheers! Raj

Raj66 · ‎Jul 10 2019

@craddockc Are the APs running the latest firmware? When the client loses connectivity, they will still be connected to the AP but they can't ping their DG. Is this correct or the clients get disconnected from the AP too? Also, did you check for any interference in that area, what does RF spectrum say about utilization?

Raj66 · ‎Jul 10 2019

@Mr_IT_Guy I have never seen anything like this. Is it MX or MR? If it is MX, Did you double check the power cable is unplugged from the MX? Cheers! Raj

Raj66 · ‎Jul 10 2019

Hi @AlexGregoire , If the Sonicwall doesn't support VLANs, then we need to send the traffic untagged for the Sonicwall to be able to understand it. Make sure the port on the MX is configured as a trunk port with native vlan 2. It is also worth to check the port config on the Sonicwall side to match what we have on our side. How are they routing traffic to the 10.0.0.0/24 network? Do they have a static route configured on the Sonicwall to send that traffic to MX? If so, we need to make sure we are using the same interface IP on the MX as they have configured as next hop on the Sonicwall. Cheers! Raj

Raj66 · ‎Jul 10 2019

Hi @GaryJ You should be able to revoke the client authentication from the client's page on the dashboard as shown in the below-mentioned document. Once you revoke the authentication, the client will be forced to go through the captive portal again. https://documentation.meraki.com/MR/Splash_Page/Revoking_Splash_Page_Authorization Cheers! Raj

Raj66 · ‎Jul 10 2019

@MarcP You should be able to disable that interface. Can you please open a support ticket so that we can investigate further and see what is happening? Cheers! Raj

Raj66 · ‎Jul 9 2019

@AndrewBe The vlans will be spanned to all the switches in that particular network and the broadcast traffic will be passed over. The reason for that is to allow the clients connected to other access switches to be able to pass traffic across. For example, let's take your analogy, if S1 is doing L3 and acting as the default gateway and if you have access ports on S3 configured for VLAN 10 but not on S2, the clients connected in VLAN 10 on S3 will still get an IP address from the DHCP server on S1 (Possible because broadcasts are allowed) and they will be able to go out to the Internet. Cheers! Raj

Raj66 · ‎Jul 9 2019

@SLR The APs are not dependent on the other Meraki products. As long as they are powered and have a proper Internet connection, they will work just fine. Cheers! Raj

Raj66 · ‎Jul 1 2019

Top notch! keep it up, guys.

Raj66 · ‎Jul 1 2019

@ewolf You configured port 3 on the MX68 as trunk port with native vlan 100. Does the native vlan match on the HP switch? In HP terminology, vlan 100 should be untagged on the port where the MX68 is connected. Also, Are you running DHCP server on the MX68? If not, you might want to configure an IP-Helper for the DHCP server, Make sure you have that config in place. Cheers! Raj

Raj66 · ‎Jul 1 2019

Agree with @SoCalRacer that this is not the best of the security methods out there but want to make one correction. While configuring port forwarding we can restrict the allowed remote IPs to the IPs that we trust. Again, not the best of the security options will just get the job done if you are using it once in a while

Raj66 · ‎Jul 1 2019

@tantony Yes, configuring port forwarding on port 3389 to direct traffic towards the private IP should allow the traffic from outside to your computer in the LAN. Yes, you can use DDNS, As long as the traffic is coming to the MX wan IP and a port forwarding rule is configured to allow that traffic inbound, the traffic will be directed to the computer in the LAN. More information about how port forwarding works in MX can be found in this doc https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX Cheers! Raj

Raj66 · ‎Jul 1 2019

@aokullu Are trying to enroll using MDM profile or Meraki Agent? both of them are pretty easy to enroll in their own ways. For profile installation there are multiple ways to install, you can scan the QR code or go to m.meraki.com and enroll using the network shown on the dashboard. If you are new to Meraki systems manager, please go through this document, it is really helpful, will give you the full picture. https://documentation.meraki.com/SM/Device_Enrollment/Enrolling_Devices Cheers! Raj

Raj66 · ‎Jul 1 2019

@Uberseehandel Did you double verify the client VPN configuration on the devices and made sure they are configured as mentioned in this document? https://documentation.meraki.com/MX/Client_VPN/Client_VPN_OS_Configuration#Windows_10 Also, if you take a packet capture on the WAN interface of the MX, do you see phase IPsec negotiations starting on UDP port 4500? I am sorry on the logging part, I am pretty sure I saw more logging than that when my connection was failing but yeah strongswan seems to be providing much better sane logging. Won't hurt upgrading it to 15 version if you want to try out strongswan. Cheers! Raj

Raj66 · ‎Jun 28 2019

@BrechtSchamp nailed it here. Just to add a little more clarity, the licenses are tied up to the organization and not to the devices. So, as long as the number of devices equals the number of licenses, you are all good. However, when the device quantity exceeds the license quantity, you either need to purchase more licenses to match the device quantity or remove the extra devices from the organization (Doesn't matter which device as long as the model matches).

Raj66 · ‎Jun 28 2019

@DillonofAnch17 Summary reports should be sent out for each network at a set time as per the network local timezone. Are any of these networks added to a template? Also, when you said set time, you mean no matter which timezone the devices are in, the summary report should come to your inbox at a fixed time, correct?

Raj66 · ‎Jun 26 2019

Thanks to @AjitKumar for the Analogy. using the same, can you ping the servers at site A from a desktop in a different VLAN in the same site? Did you verify if the servers have a correct default gateway configured with correct subnet information? Also, Can you ping the desktops at site B from the servers at site A? If you do a traceroute, where is it getting dropped?

Raj66 · ‎Jun 26 2019

@AGworkingCan you packet capture on both the MXs while the ping is going on and see where the traffic is dropping. I would take packet captures on both LAN and VPN interfaces on both the firewalls and check for the corresponding traffic in there. This will give you visibility as to where the traffic is missing and we can troubleshoot accordingly. Cheers!

Raj66 · ‎Jun 26 2019

Hello, All of them are available via the dashboard but some are available via API too Availability of the equipment (I assume the status of a device?) - Available via both dashboard and API Intrusion attempts, virus, attacks detected and rejected (API?) - Dashboard, event log and security center to be precise Bandwith per app (Dashboard:"network-wide > traffic analytics") Report per site/day (Dashboard: "Organization > summary report") Attempts to filtered URLS (Dashboard: Event log) Top users by filtered URLs, by the app, by category (Dashboard: traffic analytics), available via API too Top users (guests and private) - Dashboard: "network-wide > clients" page

Raj66 · ‎Jun 26 2019

@kYutobi An MR52/53 would be a good fit for high-density deployments like Gymnasiums. However, If you fancy Wifi6, I would recommend checking out an MR45/55. #Wifi6 #WorthTheHype

Raj66 · ‎Jun 26 2019

@Leeham That success only means that a command has been sent by the MDM to install the app. If the app is still not being installed on the device. Please check if there is any firewall that is blocking the traffic. May even try a different Internet connection like a cellular hot spot to bypass the firewall and see if that will work.

Raj66 · ‎Jun 25 2019

@StoobyDoo I am afraid it is not possible. I don't think we can set up a timer so that the self-created accounts will be deleted automatically once the timer expires. Unfortunately, an API call is not available to delete users either. Please leverage the "Make a wish" button on the dashboard to request this feature. Hopefully, we can come up with something like this in the future. That best bet, for now, would be to delete them from the user's page from time to time.

Raj66 · ‎Jun 25 2019

@paolo Not possible over API, But you can set up an SNMP traps to alert whenever a VPN connection status change. The OID for VPN connection status change is .1.3.6.1.4.1.29671.1.1.7.22 You can download the Meraki MIB under "network-wide > alerts" page under SNMP traps section More information about setting up SNMP traps https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration#SNMP_Traps

Raj66 · ‎Jun 24 2019

@-ray- Yes, The APs might come online with 802.11af but it is not recommended as some of the antennas will be turned off and you won't be able to leverage 802.11ax.

About Raj66

Raj66

Raj Yarlagadda

Community Record

Badges