Meraki

RaphaelL · ‎Aug 4 2022

Hi ! Have you tried messing with 802.11r ? Enabled , Adaptive ?

RaphaelL · ‎Aug 3 2022

Hi , This is the correct endpoint for outbound firewall rules on a MX : https://developer.cisco.com/meraki/api-v1/#!get-network-appliance-firewall-l-3-firewall-rules getNetworkApplianceFirewallL3FirewallRules It would have been easier to state 'outbound' somewhere on that documentation

RaphaelL · ‎Aug 3 2022

In some cases you can and can't. It depends where the DHCP server is. If the DHCP server is configured as a IP helper and resides on a different vlan , there are some nasty hidden firewall rules that will still allow the trafic ( eg: Wireless firewall , GP 'firewall' ) I find that very annoying. Also the MX firewall won't block trafic that has a destination in the autoVPN tunnel , you would need to use the S2S firewall. You can get confused real quick

RaphaelL · ‎Aug 2 2022

Hi , Your diagrams are clear. To my understanding the whole MX would flip to the failover. Upon reading the documentation : https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair and https://documentation.meraki.com/MX/Networks_and_Routing/Routed_HA_Failover_Behavior#VRRP_Mechanics_for_HA I don't see failover per-Vlan or Vlan based. Also you can't do a failover per-vlan in the dashboard so I don't think it is possible. I will let the MX guru correct me If I'm wrong. I could also test it in a lab. You would have to prune the vlans on the downstream swich so that the heartbeats on said vlan don't reach the other MX.

RaphaelL · ‎Aug 2 2022

Hi , How was the speed test done ? via the dashboard or a client connected to the MX/MS ?

RaphaelL · ‎Jul 29 2022

That actually make more sense than expected 😁

RaphaelL · ‎Jul 29 2022

Hi , We are currently using Group Policy on our MS switch via RADIUS attribute ( https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies ) Is it me or the L3 firewall from the GP is not triggering syslogs ? Our security teams are concerned about the fact that there is no logs generated.

RaphaelL · ‎Jul 28 2022

Hi , I'm 99% sure that this feature is not available via API. It would be a great addition to the API ! Clicking the 'Give your feedback' box on the bottom right of your dashboard page and do the suggestion ! It helps !

RaphaelL · ‎Jul 27 2022

Upon looking at the /api/v1/openapiSpec and our Help > API Docs menu in my own Dashboard , I do not see anything about that feature. You might need to have it enabled first to see the documentation. Features that are in Beta are rarely included in the official API V1 documentation on the cisco developper page. You usualy find them in Help > API Docs menu in Dashboard

RaphaelL · ‎Jul 27 2022

Please let the community know ! Feedback about new firmware is always a great help to others !

RaphaelL · ‎Jul 26 2022

That is pretty much all the syslog events that are sent by Meraki devices. Not sure to understand your question. The detail is already in the documentation that you linked

RaphaelL · ‎Jul 26 2022

@cmr you lost the race to the changelogs 😋

RaphaelL · ‎Jul 26 2022

To my knowledge you have to do some kind of tennant restriction which can be quite a challenge. https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictions

RaphaelL · ‎Jul 26 2022

Hi , Those are the IEEE 802.11 codes . They can be found on google or that link : https://community.cisco.com/t5/wireless-mobility-knowledge-base/802-11-association-status-802-11-deauth-reason-codes/ta-p/3148055

RaphaelL · ‎Jul 26 2022

Ohhhhh ! That would explain. Is there a way to confirm that it is used ? Either client side or via a packet capture ?

RaphaelL · ‎Jul 26 2022

Hi , I'm really really really confused about 802.11R. It is currently set as Enabled on a SSID that leverages 802.1X EAP-TLS as auth. Our Windows 10 machines ( HP 860 G6 ) are currently running the latest Intel drivers AND a ''supported'' NIC ( AX201 ) do not show as '802.11R capable' in the dashboard. According to the documentation on the Intel website ( https://www.intel.com/content/www/us/en/support/articles/000021562/wireless.html ) No set up is required on the client (Wi-Fi adapter) side. Fast roaming is automatically enabled on the client with a supported Intel Wireless Adapter on Windows® 10, when connected to a fast roaming enabled Wi-Fi network. We currently don't have any issues with roaming but I was wondering how can we leverage 802.11r ? EDIT: We have MR33 , MR36 running 28.6.1 🙂 Thanks ,

RaphaelL · ‎Jul 25 2022

Hi , I just ran that endpoint on my personnal network which contains 1 device. Here are the results : {"counts":{"total":1,"withHeavyUsage":0},"usages":{"average":2180905,"withHeavyUsageAverage":0}} I belive the total":1 is the number of clients in that network and the usages are simply the network usage :

RaphaelL · ‎Jul 25 2022

Yes that would be the way to do it ! Somehow I missed the part about the Group Policy in your post.

RaphaelL · ‎Jul 25 2022

Hi , Simply do : Deny 192.168.1.0/24 RFC1918 ( 10.0.0.0/8 , 192.168.0.0/16 , 172.16.0.0/12 ) Any Permit 192.168.1.0/24 Any Any This will block anything from 192.168.1.0/24 towards rfc1918 , except it's own vlan and will allow the flows towards the internet.

RaphaelL · ‎Jul 22 2022

Woot Woot ! Thanks a lot guys ! 😀

RaphaelL · ‎Jul 21 2022

Sounds like a dashboard UI bug. Maybe try opening a case on that one. Out of curiosity , why are you disabling RSTP on those interfaces ?

RaphaelL · ‎Jul 21 2022

Happens to the best of us ! Glad you were able to find a solution !

RaphaelL · ‎Jul 21 2022

Just tried the endpoint on my Org and networks and it is working. Is there any MX on that network ? if not it should return a 404 and not a 401 , but it might be bugged.

RaphaelL · ‎Jul 20 2022

I really feel like I'm hitting No DHCP response error is seen after a client performs a successful L3 roam (Wi-Fi 5 Wave 2 MRs/Wi-Fi 6 MRs) on MR 28.6 But my SSID is in bridge mode. When clients are roaming , there is really often a no DHCP response error , but I don't see any DHCP trafic . Investigating...

RaphaelL · ‎Jul 20 2022

Ahhh I feel dumb. I didn't find that piece of documentation ! SSID is in bridge mode. Clients are receiving the DHCP leases , but it seems that the DHCP renews are failing. I will have to troubleshoot a bit more

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges