Meraki

KarstenI · ‎Dec 31 2022

I also opened a Case for this and at least the Supporter didn't directly say that it is not supported. Let's see what comes out of this.

KarstenI · ‎Dec 31 2022

I just tested it, and you are right that it doesn't work. But that is not because of CoA. It just seems that the MX is ignoring the RADIUS attribute for the VLAN. I am not 100% sure, but I think I have done this previously (on older MX versions) and it worked. Best to open a support case.

KarstenI · ‎Dec 31 2022

The MX doesn't do CoA. But you can still do Authentication and Authorization without. https://documentation.meraki.com/MX/Access_Control_and_Splash_Page/MX_Access_Policies_(802.1X)

KarstenI · ‎Dec 24 2022

You are right about the grace period, you have 30 days left. For the license ... no, it is not valid for a vMX because it is for the ... MX100. That leads to the question why you ordered it if you don't have one? By mistake? If the licenses is new, you can let it refund. About applying the licenses ... I wonder why you got three licenses. To extend the license duration of the organisation, you need to apply one license with all what is needed in one license. But if you have your dashboard license expired anyhow, you could add the first license with "Renew my Dashboard license" which resets the inventory devices to the device of the first license. After that you add the other licenses with "License more devices" and you are all good. And for you next renewal interval, come back and ask how to handle all of this before ordering the licenses. Happy Holidays!

KarstenI · ‎Dec 19 2022

Nothing that is included in the Meraki solution. And in my opinion, if you need something like this, the best option is to choose an ISP that offers this as a service.

KarstenI · ‎Dec 12 2022

To add on what is already said: If PPPoE is used on the WAN, the MTU is automatically adjusted for the overhead If you need a different WAN MTU, Support can set this for you. But this reduced MTU is not accounted for when using non-Meraki IPsec VPNs and you will certainly run into problems.

KarstenI · ‎Dec 2 2022

Well done everyone!

KarstenI · ‎Dec 2 2022

Yes, this will work. I also typically update the hubs last and my spokes were running v17 while one or more hubs were still on v16.

KarstenI · ‎Dec 1 2022

Oh yes! That is a big improvement.

KarstenI · ‎Dec 1 2022

Whatever the idea was, I support it! 😀

KarstenI · ‎Dec 1 2022

The most important question is where this ACL is applied. Keep in mind that in the Meraki world, you don't apply an ACL to a switch. You apply the ACL to the switches in the network. And this line permit 172.x.x.x 0.0.0.31 could be wrong (at least if you want to act on the RFC1918 range) and perhaps should be permit 172.x.x.x 0.0.0.15

KarstenI · ‎Nov 30 2022

It shows if this rule acts on IPv4, IPv6 or on both DualStack.

KarstenI · ‎Nov 28 2022

With two gateways, I assume that you also have two dashboard networks. In this case the APs in the different networks will not mesh. The clients in the “middle” will have a bad time as they could change from one network to the other and each time they receive a new DHCP config and sessions will break.

KarstenI · ‎Nov 27 2022

Oh, never heard of this. Next time I’ll look if I have an offline device. But I am pretty sure that for me, it was something else most of the cases. When I take devices offline I typically move them to a “spare” network.

KarstenI · ‎Nov 26 2022

Ok, that makes sense. Is it documented somewhere?

KarstenI · ‎Nov 26 2022

My first idea was that it could somehow relate to the port mapping that is also used in templates: https://documentation.meraki.com/MX/Other_Topics/MX_Cold_Swap_Replacing_an_Existing_MX_with_a_Different_MX#Port_Mapping_for_different_MX_models But no, does not align here at all ...

KarstenI · ‎Nov 25 2022

Updates are always done on a network and not on the individual APs. So there is no way to update the single device. You can install the ne APs anytime you want. As long as they are supported by the running firmware for the network, they should install that version and directly work.

KarstenI · ‎Nov 25 2022

This happens also to me from time to time. Some times I just have to wait a little bit, but sometimes I needed to upgrade to a different version and from there to the intended version. I have no idea what is really causing this.

KarstenI · ‎Nov 24 2022

This is not a valid test as you are only blocking the echo-replies when initiated from the peer side. I would consider this firewalling working if I can block an SQL-Slammer (which was only one UDP packet without any return packet) from my Non-Meraki-peer.

KarstenI · ‎Nov 23 2022

Perhaps we should all add a wish that FT should be implemented together with CoA.

KarstenI · ‎Nov 21 2022

Well, someone has ordered these licenses. That is probably the person to approach. At least I don't know a different way.

KarstenI · ‎Nov 20 2022

You will receive a “Your Meraki order has shipped” e-mail which includes devices and licenses in this order.

KarstenI · ‎Nov 17 2022

You will not lose the config of the existing switch. But adding a member to a stack (or especially building a stack) is better done with the switches being switched off and not doing it online.

KarstenI · ‎Nov 17 2022

I think you are basically on the right track: Configure multiple VLANs on the MX, at least one for the legacy 192 network, one for the new 172 network. Or directly implement multiple different new VLANs for Servers, Users, Printers, IoT, Voice, and so on. Either assign the VLANs to two of the ports where you use your old and your new infrastructure, or use a Trunk for the connection to the switch and implement VLANs on the switch. If you are quite new to networking, I would hire a consultant to design you a new secure environment based on your needs.

KarstenI · ‎Nov 16 2022

Nowadays it is quite unlikely that you'll find a relevant client that doesn't support these channels. But if you need to have legacy clients. it definitely could be. The first Apple Retina iPad2 is one of the devices that I remember not to have UNII-3 support.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges