Meraki

GIdenJoe · ‎Aug 23 2023

Those are two radically different platforms. You may not even support the same features as you are using now in your new design. In this case I think you should just list all the configurations that are relevant in your new design and are supported on the MS425 and just do the config. I assume that won't be that much of a work.

GIdenJoe · ‎Aug 22 2023

Make sure each Meraki site makes a non-Meraki tunnel towards the non Meraki network. As alemabrahao already mentioned, you cannot include SD-WAN remote subnets in a non-Meraki VPN. It can only route client VPN, local subnets and static route subnets.

GIdenJoe · ‎Aug 21 2023

I have used Cisco Mobility Express in the past for forwarding multiple VLAN's since Meraki did not support it back then. I have also done this with a Cisco C9800 controller but not yet on an Embedded Wireless Controller setup. I haven't needed to create one via Meraki yet but there are a few caveats if the rest of your network would also be Meraki.

GIdenJoe · ‎Aug 21 2023

Yep, you'll need to do some scripting and loop over all your switch devices.

GIdenJoe · ‎Aug 20 2023

Yes that is what wanted to bring across. So still to this day the MX appliances do not support STP and will just transparently forward BPDU's coming from your left switch over to your right switch. So in case you have a higher speed between your switches than up to the MX you will have an STP block on the right switch going to the MX but a root port forwarding to the left switch. If you have identical speeds between your switches and to your MX (like you are using a single link of 1 Gbps between your switches and 1 Gbps upstream to each MX) then you will have to make sure the lower port number goes between your switches and the higher port number to the MX. In this case for example if you are using 48 port switches you could have 47 and 48 of both switches going upstream to the MX and have 46 between the switches.

GIdenJoe · ‎Aug 19 2023

So if you don't really have a tiered topology. So the two switches you mentioned are in fact the only switches in the network or are serving as distribution switches for the rest of the network with firewalls directly attached then you should have a link between them and make sure that link is not blocked by spanning tree. That means the left switch is then your root bridge and the other switch is a normal bridge and traffic from the other switch flows to the first switch before going to the firewall. The reason for this is if you have traffic flowing from hosts on the left switch to the other switch that traffic won't pass through the switch internal on the firewall and you can still have your regular design where each firewall has two downlinks one for each switch.

GIdenJoe · ‎Aug 19 2023

Good luck with that one. Do mind that now each individual switch needs dual uplinks to the distribution switches to maintain a redundant design.

GIdenJoe · ‎Aug 18 2023

I just want to chime in on the fact you said they are stacked using 10 Gbps. MS225's do physical stacking and those cables are 40 Gbps each, not 10 Gbps. But to help you with your post: If you don't use port-channels on your ESXi hosts and just divide your VM's manually over your VMNIC's you would be better off using separate access switches to those hosts. You could do the separate network like Philip suggests or if you want to keep it in the same network you could do staged upgrade. If you do port channels and want separate switch upgrades then you would not be helped with Meraki switches but you would have needed vPC's on Nexus switches if you like to keep it in classical layer 2 networking.

GIdenJoe · ‎Aug 18 2023

I'm flabbergasted the MA-MOD does not support over 10 km. If I look on the official Cisco SFP compatibility matrix you can indeed see the difference between the MA-MOD-2x40G and the C9300-NM-2Q. I mean... WHYYY? Aren't those modules identical, why wouldn't they support the SFP's?

GIdenJoe · ‎Aug 16 2023

I'll definitely try that mode if I get such an AP in Catalyst mode. Most of our customers are Meraki though so it won't be easy to get one. I don't want to flip between DNA en Meraki mode after ordering it.

GIdenJoe · ‎Aug 14 2023

If that Cisco switch is downstream of your Meraki MX you can just configure port forwarding on your MX regardless of the switch the device is on. The two technologies have nothing to do with each other and will work perfectly together given your LAN is correctly uplinked to the MX.

GIdenJoe · ‎Aug 12 2023

I hope you were capturing on the destination port then 😉 If you click the green link (DSCP to CoS mapping) you have control over what DSCP value goes into which queue.

GIdenJoe · ‎Aug 11 2023

I know, and I added that other antenna vendors also list those if you want to reference those antennas with the AP's. I'm not trying to detract from your response. I'm sorry if you would feel that way.

GIdenJoe · ‎Aug 11 2023

It is in fact RP-TNC. You can check this for example with external vendors like Acceltex where they have a nice way of listing compatible AP's with their antennas 😉

GIdenJoe · ‎Aug 10 2023

First thing I did 😉

GIdenJoe · ‎Aug 7 2023

I stand corrected!

GIdenJoe · ‎Aug 7 2023

That's not just MR but everywhere. Since if you use transition mode that would mean you also support WPA2 association but that is not allowed in 6 GHz. So yes you have to have a seperate SSID if you want to support anything below WPA3 and enable 6 GHz on it.

GIdenJoe · ‎Aug 4 2023

So if you configured flows or firewall as a tag in the syslog server configuration on Network wide -> general then you can indeed tick boxes on your L3/4 rules and when they get hit they will log to the syslog in 3 lines. A flow start log will be made which shows the normal and translated IP addresses (can't be filtered) A flow or firewall log that actually shows a logic match at the end so you'll have to think what ports and protocols you are matching in that rule to recognize the matched rule. examples: protocol=tcp sport=43958 dport=443 pattern: allow all protocol=udp sport=54366 dport=53 pattern: Group Policy Allow I don't have access to our logging server to show better examples right now. A flow end log after the connection is terminated with also the NAT information like the flow start. We log several firewalls like this and haven't had any issues with that.

GIdenJoe · ‎Aug 4 2023

I also noticed no support for port-security in the port-profiles setting.

GIdenJoe · ‎Aug 4 2023

For mass editing in a single network I heavily use tags and then go about selecting the tag's and editing their configuration in one go. Usually when you connect a new switch to a network the first thing you do is the following. Go to switch -> switchports and then apply following filter. switch:nameofnewswitch port:1-48 and then give them all the tag ACCESS and a second tag depicting the VLAN they are supposed to be in. Next time you need to edit all those ports you just go tag:nameoftag and then you bulk edit them. There is also a port-profile early access feature but it is missing some key configurations IMHO. If you're heavily into API's and you automate new switches into a network it might be a good idea to automatically add tags to new ports.

GIdenJoe · ‎Aug 4 2023

If it is pure EAP-TLS you should indeed not see a tunel form. But in case if your client would send a legacy-NAK and goes for EAP-PEAP then you have a different session type and then you do have to troubleshoot if they fail to negotiate a tunnel (TLS version, cipher suite etc..) However if it is just an exchange of certificates then you could run into the MTU issue pjc is mentioning below or that the client is not trusting the server cert.

GIdenJoe · ‎Aug 3 2023

If you have long aisles make sure you have single AP's that cover almost the entire aisle with an external antenna. But then also have AP's at the intersections so your device can leave the aisle while under the cover of a local AP. And if you have control over it set the roaming aggressiveness on the scanners high. To avoid the AP's in the intersections to have too far coverage and interfering each other you could use narrow beam antennas pointing straight down so your device is also enticed to roam faster to the neighboring AP.

GIdenJoe · ‎Aug 3 2023

Can you see in pcaps towards your clients that the TLS session is fully formed? Is it an EAP-TLS or an EAP-PEAP with certificate inside? In case of the latter is your TLS being built or are they hanging a bit?

GIdenJoe · ‎Aug 2 2023

You're not kidding about those addresses jeez. Those IPv6 ranges look much better aggregated. You have a direct link to the API documentation on the dashboard! I just looked at action batch supported resources and alas the policy object resource is not part of action batches and you have to create each policy object on it's own which means inside your loop you will need to create a pause and a retry mechanism so you don't run into the rate limit for doing API calls. So basically you could write a script that takes a list inside a text file with the IP addresses and add each of those as a policy object with a nice structural naming scheme (example: NET_PUB_ZOOM-1) and once all of those have been added you can add them to a group object that then will be used inside the firewall rule.

GIdenJoe · ‎Aug 2 2023

300 IP addresses for 1 service? That's a bad service. I guess you should create policy objects for all those IP addresses and add them to a group. You can do this faster by using API calls and just copy pasting IP addresses in your JSON body.

About GIdenJoe

GIdenJoe

Joey Debra

Community Record

Badges