Meraki

KarstenI · ‎Dec 8 2022

Have fun and stay healthy!

KarstenI · ‎Dec 8 2022

Yes, these local functions will still work without dashboard-connectivity.

KarstenI · ‎Dec 7 2022

you could look into the MX75 which can go up to a Gig. But it's much more expensive than the MX64.

KarstenI · ‎Dec 2 2022

Well done everyone!

KarstenI · ‎Dec 2 2022

Yes, this will work. I also typically update the hubs last and my spokes were running v17 while one or more hubs were still on v16.

KarstenI · ‎Dec 1 2022

The typical way is to read the actual config from the network, adjust the settings and write the new config back.

KarstenI · ‎Dec 1 2022

Oh yes! That is a big improvement.

KarstenI · ‎Dec 1 2022

Whatever the idea was, I support it! 😀

KarstenI · ‎Dec 1 2022

The most important question is where this ACL is applied. Keep in mind that in the Meraki world, you don't apply an ACL to a switch. You apply the ACL to the switches in the network. And this line permit 172.x.x.x 0.0.0.31 could be wrong (at least if you want to act on the RFC1918 range) and perhaps should be permit 172.x.x.x 0.0.0.15

KarstenI · ‎Nov 30 2022

It shows if this rule acts on IPv4, IPv6 or on both DualStack.

KarstenI · ‎Nov 28 2022

With two gateways, I assume that you also have two dashboard networks. In this case the APs in the different networks will not mesh. The clients in the “middle” will have a bad time as they could change from one network to the other and each time they receive a new DHCP config and sessions will break.

KarstenI · ‎Nov 27 2022

Oh, never heard of this. Next time I’ll look if I have an offline device. But I am pretty sure that for me, it was something else most of the cases. When I take devices offline I typically move them to a “spare” network.

KarstenI · ‎Nov 26 2022

Ok, that makes sense. Is it documented somewhere?

KarstenI · ‎Nov 26 2022

My first idea was that it could somehow relate to the port mapping that is also used in templates: https://documentation.meraki.com/MX/Other_Topics/MX_Cold_Swap_Replacing_an_Existing_MX_with_a_Different_MX#Port_Mapping_for_different_MX_models But no, does not align here at all ...

KarstenI · ‎Nov 25 2022

Updates are always done on a network and not on the individual APs. So there is no way to update the single device. You can install the ne APs anytime you want. As long as they are supported by the running firmware for the network, they should install that version and directly work.

KarstenI · ‎Nov 25 2022

This happens also to me from time to time. Some times I just have to wait a little bit, but sometimes I needed to upgrade to a different version and from there to the intended version. I have no idea what is really causing this.

KarstenI · ‎Nov 25 2022

It is not a trick, it just won't do what you were asking for as the PC could still join the SSID. If the workflow is ok for you it can be implemented this way: Default policy is to block everything (or perhaps allow DHCP) the client connects to the SSID the client gets whitelisted on the dashboard by applying the right policy

KarstenI · ‎Nov 25 2022

The best way is to do it with a radius-server. There you can define which MAC-addresses are allowed and also pass the correct passphrase for encryption to the AP. This is done with "iPSK with RADIUS".

KarstenI · ‎Nov 24 2022

This is not a valid test as you are only blocking the echo-replies when initiated from the peer side. I would consider this firewalling working if I can block an SQL-Slammer (which was only one UDP packet without any return packet) from my Non-Meraki-peer.

KarstenI · ‎Nov 24 2022

Just installing the Beta 15 is not enough. This feature is still in closed beta. I also wanted to try it and sadly it's not yet publicly available.

KarstenI · ‎Nov 23 2022

I always prefer to connect a stack of two switches to the MX (or redundant MXes). And this stack connects all the other switches.

KarstenI · ‎Nov 23 2022

Perhaps we should all add a wish that FT should be implemented together with CoA.

KarstenI · ‎Nov 22 2022

In addition to the upgrade suggested by @ww I would also do a hardware-reset: https://documentation.meraki.com/General_Administration/Support/Resetting_Cisco_Meraki_Devices_to_Factory_Defaults#Rack-Mounted_Security_Appliance

KarstenI · ‎Nov 22 2022

How much separation do you need? And is it really only outbound traffic or also inbound? If it is only outbound, do you really need the old firewall or can you just configure a VLAN with the subnet of the old firewall and replace the old device? For Internet-access, PAT is done automatically when you send traffic to the MX on a LAN interface.

KarstenI · ‎Nov 21 2022

When the MX runs in VPN-Concentrator-mode you can activate BGP to participate in dynamic routing. I am not really sure if this will integrate with external VPN-peers (don't think so), but if you place a vMX into Azure you should be able to do all your routing dynamically.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges