About KarstenI

KarstenI

@Bruce We use TPG in Australia. If I remember right they bought the "low-cost" AAPT business and provide a /29 for a more or less reasonable price.

KarstenI

Is there anything visible when you hoover the mouse over that element?

KarstenI

But be aware that the proposed solution is only for the AutoVPN, not for internet-traffic. Our RingCentral customers are accessing the service directly on the internet and there is no way to control it based on the performance metrics.

KarstenI

What problems are you running into? I am using it on MS120, here in the office I have the MS120-8FP. and 802.1X works as expected.

KarstenI

Can you explain in a little more detail what the problem is?

KarstenI

It seems to be time to upgrade my home-office to MX75! 🙂

KarstenI

Hmm ... In contrast to @Bruce I interpreted the original post in a way that all sites have already MX devices with internet and the L2 connection is an additional way to connect the sites. That perhaps needs some clarification.

KarstenI

First question is if you want to have all traffic encrypted that is passing over this connection. Then you likely can use the documentation for the MPLS-AutoVPN. If traffic over this connection can be sent in clear, without encryption, then you can configure an additional MX LAN-interface on each MX, all in the same IP subnet and configure static routes with route-tracking pointing to the other sides MXes. You do not say how many sites you have, if there are a couple of hundreds, the second option will certainly not scale.

KarstenI

And thanks for making me aware of this quiz-maker website. I think I will use that to provide some quizzes for my students in training-classes.

KarstenI

got five points, I am to slow in reading the questions ...

KarstenI

2012 ... You are aware which year we are heaving now? 😉 Back to topic, Have you done a capture of your RADIUS-communication to see if there is any hint? At lest you will see if the NPS sends back an answer like an Access-Reject. And you see if you are matching on any attributes that are not in the request.

KarstenI

I imagined I would fail before I entered my name. Half the time was already gone ... 😉

KarstenI

It does not give automatically "better" coverage, but "other" coverage. By the choice of the correct antenna, you can "direct the signal" to where you want to have it. A well sought of WLAN-requirement and solid WLAN design will tell you if you need them or if you can go with the less expensive models with internal antennas. If it is intended for an office environment, you will likely be fine with the internal antenna-devices.

KarstenI

It seems you have one of the most beautiful doorstops you could ever get.

KarstenI

With only a /30, you can not directly connect both MXes to that ISP. I would try hard to replace the /30 with a /29. There are other solutions for this scenario but all make the setup more complex and again you need additional equipment: You could replace one of the switches with an extra router and terminate the ISP on that link. Between the MX and the Router you have a private transfer-network that gives you enough IPs for both firewalls. In this case the router does the NAT and has a static route to your internal network while the MX is configured to not do any NAT. Another solution is to connect the ISP1 (with the /30) only to your primary MX and ISP2 to both MXes. Here you only have full redundancy and both ISPs available on MX1, but that should not be a major problem.

KarstenI

Yes, but using a MS225 IMO is a waste of precious resources and with only one of them you still have a single point of failure. When using a Meraki-switch, just make sure that this external switch is in a different dashboard-network as the MXes.

KarstenI

You should have two external switches for full redundancy. Here is a picture of my default-setup: The external switches are typically Cisco Cat1000-10. Both MXes are connected to both external switches and the ISP-routers also go to both switches. The connection LAN3 on the MX to Gig9 on the switch is for the management of the external switches. This is a dedicated DMZ on the MX. On the switches, Gig1-4 are VLAN A (ISP1) and Gig5-8 are VLAN B (ISP2). Gig9 is the management VLAN and Gig10 is a trunk.

KarstenI

I have a couple of VPNs running between MX and Cisco ASA. Works like a charm.

KarstenI

This is my typical setup. Most important is to have at least a /29 from both ISP so that both MXes can have an own IP on both ISPs subnets. Ideally you have also one spare IP as the virtual IP. The rest is pretty much straight forward.

KarstenI

Seems he bough a lot of devices without checking if these fulfilled his needs ... Can you elaborate on your plan with disabling DHCP? I don't get yet how this should achieve anything.

KarstenI

If VLAN 3 is configured on the Link to the MX and is also the VLAN configured on Port 5, you can transparently communicate from the Port5-systems to the MX. You could assign your IPs statically, but you could also use the DHCP on the MX. If you want to configure your Lab-devices statically, then configure a range of reserved addresses on the MX DHCP-server to avoid any conflicts.

KarstenI

Ok, if all devices behind port5 should be in VLAN3, then configure the port as Access with VLAN 3.

KarstenI

With this problem, you likely need an AP with granular access-control between different users. The Meraki MR access-points are capable of this, but the MX can not solve this problem.

KarstenI

Is it your PC on port 5? Then it should be Access in your User-VLAN (probably 3). The Link between MX and SG is trunk on both sides with the same native VLAN and the same allows VLANs. And if you enable the DHCP-server on the MX, your client should get a DHCP-address from the MX.

KarstenI

A couple of things to question here: Why do you put an IP on the Switch-VLANs? It should be either on the MX *or* on the Switch. You only have IPs on both for the transfer-VLAN between them. You show that you have configured Port 5 as Access, but not for which VLAN. You say you get an APIPA-address but can ping the MX-IP. Probably something happened in between these two events as that can not happen.

KarstenI

Community Record

Badges