Meraki

KarstenI · ‎Dec 8 2021

KarstenI · ‎Dec 8 2021

Ja, der Partner Locator ist worüber man geht: Locate a partner Und da sehe ich Partner für die Schweiz und Meraki ...

KarstenI · ‎Dec 8 2021

Moin in die Schweiz, ja, diese Teams gibt es. Aber der Weg wäre über einen Cisco Partner zu gehen, und der kann dann recht einfach einen Cisco Meraki SE dazu holen, zumindest wenn es eine größere Geschichte ist.

KarstenI · ‎Dec 7 2021

There is no exact range, also not for the MR-range. It all depends on your environment. But at least when I was using the internal wireless of the MX64W, it was not that good as I was hoping. This, together with the fact that the MX/Z-wireless is quite limited and does not integrate with MR, I always plan for MXes without integrated wireless and add a small MR access point like the MR36 to the network.

KarstenI · ‎Dec 7 2021

Typically yes, but with successfully association at the cell edge, the multi-packet EAP-exchange with larger payload has a quite high likelihood to also fail.

KarstenI · ‎Dec 6 2021

Either fitting foam glue, or (if it has to be reversible): https://www.padjack.com I have some from delock, but they are similar.

KarstenI · ‎Dec 6 2021

I would say this is expected behaviour for the MS390. The list of bugs is larger than the list of features. Most admins working with Meraki would suggest not to buy 390s, but instead one of the other devices like MS250s or MS35x. But now that you already have these deices, I would open a case every time you are facing a problem. And look at the release-notes (you find them in the firmware-upgrade page of the dashboard) to see if the behaviour is already mentioned there.

KarstenI · ‎Dec 5 2021

There were a couple of Release/model combinations where the Management-port didn't work for the local status page. Have you also tried a LAN-port for this?

KarstenI · ‎Dec 3 2021

I don't think that this information is anywhere available. And if it was, it wouldn't be an indicator of a good training as the one that would go three days through braindumps would have the best pass rate.

KarstenI · ‎Dec 3 2021

This alert is based on a snort IPS rule that matches a vulnerability in a browser engine that is used in multiple products. Could be a false positive, but probably better to let it enabled if no user complains.

KarstenI · ‎Dec 2 2021

Ups, second time MotM … I have no idea what went wrong that this happened … 😀 And congratulations to all others!

KarstenI · ‎Dec 2 2021

At least I am not aware of a way to do that. I filed a "wish" for this inconsistent behaviour to stop some time ago.

KarstenI · ‎Dec 2 2021

Would still go for "Identity PSK without RADIUS".

KarstenI · ‎Dec 2 2021

As mentioned, RADIUS is needed for that. But as MAC-filtering will not add any security benefit, I would go for "Identity PSK without RADIUS" to give different groups of IoT devices different PSKs and group-policies.

KarstenI · ‎Dec 1 2021

The authentication issues should have a quite small number but are not typically 0%. The authentication exchange could fail because of roaming away, packet loss, or other problems while authenticating.

KarstenI · ‎Nov 29 2021

When comparing prices, remember that with HA you only need one license with Meraki MX. And the license is most often the most expensive part.

KarstenI · ‎Nov 23 2021

Other than setting the public IP to give the MX a way to reach the Dashboard, there is no offline config. The config "lives" in the cloud and gets pushed to the device.

KarstenI · ‎Nov 14 2021

"no native support" only means that there is nothing directly integrated. But you are free to integrate an external solution. So now go to the link @ww provided and then use Duo, or alternatively directly go to use Duo ... 😉

KarstenI · ‎Nov 9 2021

Meraki Support can enable a beta feature named "custom layer 3 inbound firewall rules" where you have more flexibility in controlling the inbound way similar to what is available now for outbound rules. Perhaps this feature is of benefit for you.

KarstenI · ‎Nov 9 2021

The firewall rules are not for inbound traffic. They only control traffic from VLANs to the internet and between VLANs. That is the reason your tests did not block RDP. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings

KarstenI · ‎Nov 9 2021

Your unbind, upgrade, bind approach will not work. The target-firmware is bound to the network/template and not to the device. The moment you bind the network back to the template it will revert back to the firmware version configured for the template. The only solution I see is splitting your setup into multiple templates or accept that the upgrade will be done for all networks at the same time (well, same time local to the network).

KarstenI · ‎Nov 8 2021

You can change the default rule to "deny any any" and apply a group-policy to the client with access where the network rules are overridden. For SD-WAN, you can specify which networks are part of the AutoVPN. What do you want to achieve exactly?

KarstenI · ‎Nov 4 2021

I assume @cmr gets a five figure salary per month from Meraki to keep us updated as soon as possible ... 😉

KarstenI · ‎Nov 2 2021

Meraki first goal is simplicity. It doesn't always work as expected but if you use the system as intended you get an easily manageable network that really saves you time compared to the traditional Cisco gear..

KarstenI · ‎Nov 2 2021

Authelia looks very promising. Need to test that when I have some spare time!

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges