About KarstenI

KarstenI

I am using them on multiple organisations. With a complex firewall rule set, I would not want to work without it any more. Main "problem" is that I have very often display problems in the browser where columns are not filled or the the rules do not show up at all. But after a browser refresh all is ok.

KarstenI

Yes, really a good one, but after thinking about it all but one answer can be eliminated: a) It has to be something with MX 3 that communicates to the internet, not MX1 b) Destination ports are never rewritten (at least not for internet-bound communication) c) It is traffic that is originated by the MX, the NAT config is not relevant here d) The hole-punching needs the source-port to stay the same, so this is the correct answer

KarstenI

How did you configure the Supplicant through the GPO? It should be mode "Computer Authentication" to only authenticate the machine and not the user.

KarstenI

Where do you see that it is traffic to the dashboard? In general, what you show looks typical to APs with SSIDs configured with Meraki DHCP where all the client traffic leaves with the AP-IP.

KarstenI

No, that's not what I tried to say ... 😉 I was talking about how to authenticate your endpoints when entering the network. Your BYOD devices typically get a certificate enrolled and use the Meraki authentication (That is IMO one of the best features of SM). But the domain-PCs do not have a certificate from the Meraki Dashboard like the BYOD devices and have to be authenticated in a different way, for example through your Microsoft NPS. The ISE could authenticate both your BYOD- and domain systems.

KarstenI

It all depends. Do you *send* the traffic to the different destinations directly? Then it will be load balanced (well, if that feature is enabled on the MX). But if you send the stream to a distribution system (like youtube or a website where the stream can be consumed) then again, there will be no load balancing.

KarstenI

If it is one flow or even one IP-address-pair in the communication, it will go over only one ISP. There will be no load balancing.

KarstenI

What about one SSID with VLAN A for the parents and another SSID with VLAN B for the kid. On the MX you can assign different Group-policies to both VLANs.

KarstenI

My two highlights of the year (well, some time ago) are the CiscoLive and the WirelessLAN Professionals Conference. Not only for the sessions as these are later available online, but meeting likeminded people, having some drinks or meals together can never be replaced by any online event. I am desperately missing it! (There is a third thing I miss in a same way, my spring-cycling vacation on Majorca, but for all three, I hope for 2022!)

KarstenI

The MX typically does not play any significant role in the BYOD solution. The onboarding runs through manual enrolment or through the MR access-points and provisions the client into the SM Mobile Device Management. Best to build a test-system for all your intended devices as there are some gotchas that make it less usable compared to an ISE. For example, the BYOD users can automatically get a certificate for WLAN access. But this is not an intended use case for your domain-users which need a different authentication. And these certificates can not be used on all switch ports. If you have an all-wireless, all BYOD environment, then it will be great. But if there are a significant amount of legacy devices you need "something else" for these. And the ISE could give you all at the same time.

KarstenI

I am using Graylog and not Syslog-NG, but there I have to use an input of "plain UDP" instead of "syslog UDP" to get my messages into the system.

KarstenI

@wfoteping2101 wrote: most likely answer here is A would be nice, but ... No!

KarstenI

@ww wrote: You can use the API to get info. I directly looked if @PhilipDAth already has a script for this ... 🙂

KarstenI

Again one that you just have to know, also for real implementations: 🐝

KarstenI

Or an IP-address-report for the whole organisation? +1 from me!

KarstenI

I am not aware of any way to achieve this from the dashboard. But you can export all flows with Netflow and analyse the clients traffic on the Netflow collector.

KarstenI

@RichardChen1 wrote: Since the concentrator has a lan ip address. What kind of port forwarding required for client vpn to work? Just udp500/4500 to lan ip? Yes, UDP/500 and UDP/4500 is enough as with NAT-T, after the initial exchanges on UDP/500 all is encapsulated in UDP/4500.

KarstenI

Has there been a Meraki-switch in this network before? The dashboard remembers this and also tracks the desired firmware version in case you again add a switch at a later time.

KarstenI

@GIdenJoe wrote: I know a Cisco ASA does not support multiple TS with IKEv2. There has to be a different reason if that didn't work somewhere. The ASA supports this and I use it with lots of customers.

KarstenI

Ok, that's strange. After double-checking the switch-priorities I would open a support-case and let them investigate.

KarstenI

1) The Guards can have a benefit when implemented wisely. But on the infrastructure you should only set it when you know how your infrastructure behaves. On User-facing ports, using root- or BPDU-guard is probably a good idea. 2) It's ok that way. The preferred root has the best priority, your next preferred device if the first one fails gets the second best priority. All other switches can typically stay at the default or any value that is larger than the first two. 3) It already should be if there is no other STP-device in your network. The switches will tell you which one is the root. How did you test it that you say the core is not the root?

KarstenI

What @UCcert mentioned is the way to go. But be aware that it is not route-filtering as you was asking for. The Branches still know the other subnets but the filtering prohibits them from communicating with each other.

KarstenI

Just in case someone missed it. I think that this guide and the referenced document in the second paragraph are some really good introductions to some concepts of Wireless LANs: https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Wi-Fi_6_(802.11ax)_Technical_Guide

KarstenI

This is what I wrote when the Beta was released. Still valid for 16.6: https://cyber-fi.net/index.php/2021/03/13/anyconnect-vpn-on-meraki-mx-a-first-impression/

KarstenI

You are probably talking about the local status page. Access to it can be controlled from the dashboard: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#Configuring_the_Local_Status_Page Be aware that this status page is only for initial setup for the cloud connectivity and not to configure the whole device. That is only done on the dashboard.

KarstenI

Community Record

Badges