Meraki

JeroenVercoulen

aaa new-model aaa group server tacacs+ GROUP_TAC server name TAC-AUTH1 server name TAC-AUTH2 aaa authentication login default local group GROUP_TAC aaa authentication login MERAKI local aaa authentication enable default enable group GROUP_TAC aaa authorization config-commands aaa authorization exec default local group GROUP_TAC if-authenticated aaa authorization exec MERAKI local aaa authorization commands 15 default group GROUP_TAC if-authenticated aaa authorization commands 15 MERAKI local aaa accounting update periodic 3 aaa accounting commands 15 default start-stop group tacacs+ aaa session-id common

Stuart4

mDNS introduces several security risks so my Cyber Security Team won't allow it.

DMD

Has anyone experienced Active Directory DNS entries not updating after upgrading to this version? The time stamps on our DNS were being scavenged after 14 days of inactivity. This was the only thing that changed. We downgraded to the stable release of 19.1.10 and fixed the issue and DHCP entries began to populate correctly. I believe 19.2.2 has a hidden bug or its the way they changed the DNS stuff.

jd-1607

Yeh you're right, might need to pursue a client agent to pass the user context through to the firewall instead

GIdenJoe

Still testing? what's happening with this version?

Asly

In this Article from Ekahau ( i guess you might have looked at this) Ekahau Zero-Touch Meraki Dashboard Provisioning How-To Guide – Ekahau Customer Support there is more and quite good info about how to.. and what you need to do it.. As @ammahend says above.. Then in AI pro project. just go to Action and paste API Key.. choose Correct Region, Customer and site.. And you are good to go 🙂 a tip is to make shure the floorplan name is the same and that the building also has the same names.

KarstenI

There really should be a documentation of all these "can be enabled by support" gems. Knowing of this option enables some new opportunities for me.

NonDescriptEng

Update from Fortinet re this integration Cisco 9300 managed by Meraki Cloud displa... - Fortinet Community This article describes the behavior where a Cisco C9300 switch displays as a '?' in Inventory when managed by the Meraki Cloud, as well as how to resolve this discrepancy.

GIdenJoe

On regular MS switches all the possible VLAN numbers are created automatically (1 - 1001, 1006-4094). So you can just use the VLANs on your ports. This however can be seen as a waste of TCAM space. On a Catalyst switch the TCAM allowed for VLAN definitions is smaller on C9300 and C9200 switches. This is why by default the Catalyst switches create vlans 1-1000 (and now 1-995). If you run IOS-XE native you can actually see the VLANs that are created by using the Cloud CLI. However if you want to use VLAN's above the 1000 number you should use the VLAN database feature @Slayton already explained. In fact if you can always use the VLAN database and only create the VLANs you actually need. Then you are sure to not run out of space if you like to put your management SVI in VLAN 2002 like I do 😉

BaskaranGanesan

@n01048 -0. Good to hear from you. I tried this option five months ago, but it didn't work out for me. Issue with both MAC and Windows laptops. We are receiving strong interference from a neighbor on the 5 GHz band. Playing with Low Power on the 5 GHz to see the RF interference. So far, I can see a 10% improvement. However, I am still having an issue with the client bouncing between the APs. The problem is that the client is accepting the weak signal and bouncing back to a strong signal.

GIdenJoe

If you mean the CDP/LLDP from connected devices then I can confirm there are no issues on native IOS-XE version on C9300-M switches. If you mean that you can't see any hostnames of clients that are connected to a C9300-M switchport then yes that appears to be an issue. I can see the mac address and the IP. But the typical hostnames like you can see on native meraki switches is not shown. So I believe you are referring to missing info on the clients themselves. I am currently running 17.15.3.1. I do see in the 17.15.4 release notes that there are two related fixes where one is closest to the issue you are describing: Resolved an issue that prevented some clients from being correctly displayed on the Network-wide > Clients and Switching > Switch Summary pages Maybe check this version out. Do mind that if you are running CS software the change to native ios-xe is impactful and needs plenty of downtime.

GIdenJoe

This is normal behavior. Usually the tunnel will re-establish sooner than the seconds expiry. I believe there also is a data limit but the MX will rekey sooner than the configured and this should be relative to the amount of seconds configured. So your logs will show initial IKE_SA where the CHILD_SA is instantiated in the same message which means you will probably get a log for the initial CHILD_SA. And then after a while you will get the established for the new CHILD_SA and a closing of the old CHILD_SA. You will also see the sequence numbering <remote-peer|90177> count up in the newer SA. The log does show separate entries for inbound and outbound CHILD_SA.

MRCUR

👋

GIdenJoe

You sure? I haven't caught anything about that. I know about the org-wide GPO since Cisco Live EUR 2024 already. They could just fix the GPO's to apply it statefully on the MX.

RobAce

The documentation now lists MS 18 as the minimum required firmware. Has anyone installed this Beta version and tested yet?

NetworkCcie

ooops double post

NetworkCcie

Possible solution Meraki access manager + cloud pki Check out this solution Meraki access manager + cloud pki https://www.hypershift.com/blog/meraki-intune-cloud-pki

NetworkCcie

Take a look at this solution. Meraki access manager + cloud pki https://www.hypershift.com/blog/meraki-intune-cloud-pki

NetworkCcie

Take a look at this option Meraki access manager + cloud pki https://www.hypershift.com/blog/meraki-intune-cloud-pki

TimothyM

I have moved on beyond access manager, after hours and hours of trying to get the certificate based authentication to work...it failed. my support tickets have gone silent and I dont mind testing this new feature but it is broken. I appreciate everyone from this thread on attempting to help but its not functional. Its a pipe dream to get 802.1x deployed and although Jaideep Kukunuru gave a great presentation back at cisco live... but its not real. Its a fake demo without any proof of working properly. I have exhausted all my resources on tireless testing and completely discouraged with this experience. Meraki support offered no solution nor would they escalate my issue.

Mloraditch

I have been by Cisco folks that this is exactly what happened.

ESMichal

MS 18.1.1 Beta firmware release notes indicate a fix for this issue. I haven't tested it yet though.

sys-admin

Has anyone attempted to use this for multiple SSID's? There doesn't seem to be a way to scope users/groups to different SSID's with this method.

Mloraditch

These were completely non cisco, but I meant speed wise as that was the reference I made. These were 10gb sfps in 1gb slots

Bobcheese2

Ok adding to this, seems like when someone is connected to the AnyConnect the customer loses connection to the far end of the S2S VPN locally. AnyConnect user doesn't seem to lose connectivity to the S2S VPN at all just local LAN (Wi-Fi) users. Can see lots of logs of DNS failure on the Wi-Fi during that time, DNS server is at the far end of the S2S VPN. Anyone seen anything like this before?

About GIdenJoe

GIdenJoe

Joey Debra

Community Record

Badges