Meraki

KarstenI · ‎Aug 4 2022

Still waiting for approval for our first CW9164 order ... But I would expect to see the same features.

KarstenI · ‎Aug 4 2022

Yes, these subnets need to be included into the VPN traffic.

KarstenI · ‎Aug 4 2022

Are the external subnets part of your Split-Tunneling definition?

KarstenI · ‎Aug 4 2022

As far as I understand it, we lose everything that is not "normally" available on the Dashboard.

KarstenI · ‎Aug 2 2022

With AnyConnect, the easiest way is to let the RADIUS server return a filter-id that matches a dashboard group-policy.

KarstenI · ‎Aug 1 2022

The first question that comes to mind here is "Why are you hiding your SSID"? 99% of the given reasons (like more security) doesn't work that way.

KarstenI · ‎Jul 27 2022

Damn, wrong link ... Yes, luckily at least one other paid attention ... 🙂

KarstenI · ‎Jul 27 2022

The main "problem" is that the MX is like a Hub in this situation and all BPDUs are flooded throughout the network. If possible in your IP design, I would configure different IP networks (VLANs) on the MX for every switch and limit the connecting ports to these VLANs.

KarstenI · ‎Jul 27 2022

I've done it as a PoC. You have to tell Support to enable SAML for AnyConnect and then just follow the guide: https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_SSO_with_Azure_AD We didn't implement it later because with RADIUS the ISE was able to easily return Group-Policies for differentiated user-access.

KarstenI · ‎Jul 22 2022

Can you post your Split-Tunneling list? Perhaps there is a mistake in the syntax (like wrong mask for the network) that could show this error.

KarstenI · ‎Jul 22 2022

Well deserved Raphael! Welcome to the most elitist and prestigious club in the world of IT communities! 😀

KarstenI · ‎Jul 21 2022

You are talking about the ACLs that you can configure on the Switches? Then you are IMO out of luck. With an ACL deny tcp deny udp allow IP ICMP should work, but also all other IP protocols that you likely don't want. This is a job for a firewall.

KarstenI · ‎Jul 20 2022

Welcome to this very nice community. You'll surely have done the right decision and will have much fun! 🙂

KarstenI · ‎Jul 20 2022

Yes, that is the way to go: 1) Allow IP1 -> Server:25/465 2) Deny any -> any:25/465

KarstenI · ‎Jul 20 2022

Damn, why didn't I find that post ...

KarstenI · ‎Jul 20 2022

Hi all, is anyone aware if there is a way to disable the 2.4GHz band on the Z3? Have a great day, Karsten

KarstenI · ‎Jul 20 2022

For the configuration, the AP needs to be connected to the dashboard and also has a license. I think the perfect device for this setup would be a Z3C. It will provide WLAN to the user, connects to the internet with LTE and can directly connect to the HQ via AutoVPN (if there is an MX at the HQ).

KarstenI · ‎Jul 18 2022

The ISE will help that each user/device will get the right classification for the segmentation. The needed Device depends on the Security you want to have: For Basic L3 control, a L3 switch could do the job. For Advanced L3/L4 control I would go for a Firewall like the ASA running on a Firepower platform. For L7 control we need a NGFW/IPS. For some implementations I place the routing on the MX with Adv. Security License, but only when most of the traffic is going to the cloud anyway. If there is a very high amount of local User/Server-Traffic I typically use FTD on a Firepower platform as the throughput per $ is better compared to the Meraki MX (even with HA). And there are better ways to integrate it.

KarstenI · ‎Jul 18 2022

1) You'll find this under "Security & SD-WAN" -> Appliance Status -> Uplink There you can change the IP from DHCP to Static. NAT will be automatically done for all outgoing traffic. 2) This is done under "Security & SD-WAN" -> Addressing & VLANs There you can decide if you want to have multiple VLANs, configure your internal IPs and also set static routes if you have VLANs on the internal switch.

KarstenI · ‎Jul 13 2022

Without a license, you are also not allowed to use AnyConnect on any other platform ...

KarstenI · ‎Jul 1 2022

A couple of my customers do it also this way. But if I am in charge I typically follow the approach to keep my stacks small (two to four switches). I am a little coward and each stack is it's own failure domain. The likelihood of a stack-failure might not be large, but I had large stacks that completely failed. With smaller stacks the impact is reduced and with virtual stacking I do not see any drawback in the maintenance. The only drawback is that now we need more SFP+ ports in the core because we have more stacks. And there the MS425 is again my choice.

KarstenI · ‎Jul 1 2022

As @DarrenOC says, it all depends. And if you only have 4 Access-Stacks, I would also think about a 355s core/server-switch. But the moment I plan for more than four access-stacks, I would also directly go for a MS425 as the core/aggregation.

KarstenI · ‎Jun 3 2022

With that requirement the MR36 is probably enough. 155 Days lead time ... All Meraki APs are PoE capable. But the requirements are different. The MR36 is fine with 802.3af, the larger models need 802.3at power.

KarstenI · ‎Jun 3 2022

You don't specify what your AP needs to be capable off. So the general advice would be "any of the actual APs" Meaning Wifi6 or better. My device of choice was the MR44 for a quite long time. This changed for some customers to the MR57. Just because an highly expensive AP that you get delivered is better than a less expensive AP that you get delivered in 300 days.

KarstenI · ‎Jun 1 2022

Have you ask yourself if you really need a faster MX? I have a couple of customers with 1Gig internet and even running a MX84. For sure they can't reach Gigabit-speed, but also when they had the slower Internet before, they never got to the max. And being "restricted" to 600 M will be sufficient for nearly everyone with a network that is small enough for an MX68.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges