About KarstenI

KarstenI · ‎11-02-2021

I used Splunk some time ago (and just now I am wearing a Splunk T-Shirt 😀 ). I really liked it but the free version didn't have any Access-Control. Is that still the case now? Probably not really important as either are typically operated behind a reverse-proxy. I normally use NGINX on the same VM for this.

KarstenI · ‎11-02-2021

Unless you are facing a really nasty bug, these are actions that don't cause any disruption.

KarstenI · ‎11-02-2021

As @UCcert said, that's what it is. And with x*10GBit between Access and Core I actually don't care any more ... 😉 There is also one exception to this, the MS390 uses MST, only single instance but MST ... 😉

KarstenI · ‎11-02-2021

@AutomationDude wrote: Sadly they seem to be acting at the network level so you probably wouldn't be able to stage exact devices but you might be able to stage the different networks and types of devices. This is the same as it is done in the dashboard.

KarstenI · ‎11-02-2021

Yes, you just have to compare the cost of the license with the effort you have to make in building and operating your own CA. If the CA is only for WLAN, I assume that Meraki SM could be less pricy. If you are a friend of RedHat/CentOS/Fedora-Linux, then dogtag-CA could be a solution. For Windows Server there is a build in CA.

KarstenI · ‎11-02-2021

Yes, it's a paid license. But IMO worth it at least for company owned mobile devices.

KarstenI · ‎11-02-2021

No, EAP-TLS uses certificates. MAC based authentication should not be used for corporate access as MAC addresses can easily be spoofed. Also think about using Sentry with the Meraki MDM. By enrolling the device in MDM it can automatically get a certificate to connect to a secure SSID.

KarstenI · ‎11-02-2021

@UCcert wrote: In your Dashboard does the Network > Monitor > Client view not show you the information you need? Has this been reliable for you? I don't trust this output. For example my AppleTV is shown on port 8 of the MS120 instead of directly connected to the MX. And even worse, Port 8 is the Uplink to the MX ...

KarstenI · ‎11-02-2021

Sadly, that doesn't work that way. But it would be really nice. I would wish for a "no automatic scheduling of updates in Q4 of every year".

KarstenI · ‎11-02-2021

Also with non-domain-members like phones you can authenticate against AD. But for phones EAP-TLS is the better solution. Just imagine you change your password on your PC and the phone (with the saved old password) tries to reconnect several times.

KarstenI · ‎11-01-2021

I like GrayLog. There is a free Small-Business edition for up to 5GB/day.

KarstenI · ‎11-01-2021

You can mount it on the ceiling and the wall, but the radiation pattern will change. If you look at the datasheet you see that the radiation is slightly different in all directions. You have to take this into account when planning your WLAN.

KarstenI · ‎10-29-2021

Another way of doing it, without migrating your networks to a template is the API: https://developer.cisco.com/meraki/api-v1/#!update-network-wireless-ssid

KarstenI · ‎10-29-2021

Imagine an internal L3-switch which has a static route towards the MX, but a default-route to a different firewall. The traffic to the remote site would never reach the MX and there would be a static route needed to the MX.

KarstenI · ‎10-29-2021

Yes, that is all you need. For the MX, you should use a LAN-Port with your Link-Subnet and not one of the WAN-Ports for this. Also make sure that all internal systems route the traffic to these firewalls if not handled automatically with a default-route.

KarstenI · ‎10-28-2021

Did you manipulate the Auth-type settings in your Freeradius-config? I general you shouldn't as the default matches nearly everything. The MX uses the plaintext-authentication-method PAP_ASCII, if you want or need to configure your Freeradius for that, make sure that this method is enabled.

KarstenI · ‎10-28-2021

Didn't knew about this. They say that the API-Key is not stored. I would check if the Backup runs in your browser (which would be ok) or if it runs on their servers. With the last implementation I would never use it from a more or less anonymous system. Also look at the script that @PhilipDAth provides: https://www.ifm.net.nz/cookbooks/meraki-backup.html

KarstenI · ‎10-28-2021

I also have to agree here, this is not implemented "the Meraki way" ...

KarstenI · ‎10-28-2021

I typically would use an omni-AP (also because of the price) and mount it with a kit like the following: https://www.acceltex.com/shop/universal-ap-l-bracket-wall-mount/ Never used it with the Meraki APs, but as being a "universal" mount, it should also fit.

KarstenI · ‎10-28-2021

For me the "inline documentation" of the VLANs are only the secondary but definitely a welcomed benefit. The main benefit is that (well, at least I expect that this feature will work that way similar to Catalyst switches) I can send the VLAN name from the RADIUS server and the "right" VLAN gets applied regardless of the VLAN ID. Yes, having consistent VLAN-IDs would be better, but is not always possible.

KarstenI · ‎10-27-2021

Yes, no problem for me, I don't use firmware version < x.5 or so ... 😉 And I assume that one will get fixed quite soon.

KarstenI · ‎10-27-2021

@cmr wrote: Branch additions Named VLAN support for MS120/125/210/225/250/350/355/390 series switches This will ease a lot of installations! Great addition.

KarstenI · ‎10-27-2021

Having two links from each MX is the "official" way to do it: https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Recommended_Topologies But as @cmr mentioned, take care of spanning tree. You have to make sure that BPDUs that are sent from a switch to the MX are sent back over the second link. You are not allowed to drop untagged frames. If you use VLAN 1 untagged in your environment you are fine.

KarstenI · ‎10-25-2021

You VLAN-Settings are preserved, but not the interface assignments. And you need to configure your uplink by hand, without that the device can not get the config from the dashboard.

KarstenI · ‎10-25-2021

Why do you want to reset the camera? Are there any problems with it? If yes, one troubleshooting step could be do move the camera to a new network and later move it back. Sometimes problems disappear this way.

KarstenI

Karsten Iwen

Community Record

Badges