About KarstenI

KarstenI

Look at the following script if it can help you with the migration: https://github.com/wifiguru10/Meraki_MX_Converter But be aware that for every migration the rule “garbage in, garbage out” also applies here. Clean up the old config before the migration.

KarstenI

Can't wait to board the plane tomorrow! (I try to express my excitement in my Avatar)

KarstenI

And make sure to order the right MX Product Edition for your Org. You will find this info in your Dashboard under Organisation -> License Info

KarstenI

Very good point. On my previous answer I didn't think about that in this scenario only the FT sequence is relevant where indeed only one PMKID is allowed. Important here is that in IEEE wording "shall" is equivalent to an RFC "must" and not to an RFC "should".

KarstenI

Quite strange to have this behavior as multiple PMKIDs are allowed since “forever” … Hopefully it gets solved soon.

KarstenI

If the access-control to the Meraki devices is your main concern, you could do iPSK with RADIUS. Each user only has access to the file containing the floors default PSK on the RADIUS server and can change it without ever touching the Meraki Dashboard.

KarstenI

Yes and no. There is visibility but likely not in an extend as you want it. But I would assume if you send your events to an external server (Syslog and Netflow) you would get what you are looking for.

KarstenI

Then it is likely something in the Switch-config that it doesn't answer the SSH request from outside. Best to replace the switch with a Meraki switch. Then you are still in the right community ... 🙂 As a switch problem, the Cisco Community is likely the right place to ask. But likely no one will be upset if you show your CBS config for troubleshooting wile your Meraki Switch is not delivered. 🙂

KarstenI

A VPN is not required, but will make it more secure. Here it looks like no answer is coming back from the switch. Can you ping the switch from the MX and does the Switch have a default-gateway pointing to the MX?

KarstenI

First, do a packet capture on the WAN to see if the session reaches the MX. Second, think about using a VPN for this task.

KarstenI

The only way I see is to use different logins for each set of customers. Add a new login for all North orgs and a different login to all south customers. It's an extra burden for switching between orgs, but at least it will work.

KarstenI

I was not aware that there is a copper SFP+ available from Meraki ... At least I used a compatible one from fs.com and it worked as expected. But you likely are out of luck with support if it doesn't work.

KarstenI

I assume that you have a little misunderstanding how VLANs work in the Meraki world. It would be good if you show a diagram of your topology. First you need to distinguish between the ports and switches that connect a device that is member of a specific VLAN and the device that routes the van subnet to other subnets. Th later is what is shown on "Routing & DHCP". This routing can be done on a cap le L3 switch or on the Meraki MX. If you don't have the "Security & SD-WAN" element, you likely don't have an MX in your setup. The routing needs to be done exactly on one device in your network This needs to be configured. But then you can use the VLANs on the Port-Settings wherever you need and the VLAN is trunked to. Well, with a diagram it would be easier to give some better advice.

KarstenI

My solution would be to add an additional Firepower Device to the setup.

KarstenI

What is the Gateway you want to connect to? The MX? Then it won’t work. If any other Wireguard server? Then you should ask the operator of that device.

KarstenI

I would not assume this as the question was for "Wireguard with Meraki VPN". I think he wants to use Wireguard *on* the MX. @tallariel Can you clarify this?

KarstenI

Just to make sure you don't get this wrong. You can set up a Wireguard server in your network and do a port-forward on the MX to that server. But the MX itself will not run a Wireguard server. There we only have the legacy L2TP/IPsec and the support for AnyConnect (now Cisco Secure Client).

KarstenI

At least no animals that try to kill you as they have in Australia ...

KarstenI

I am counting the days until being again live at CiscoLive!

KarstenI

Even if it is not the wanted answer, it really is the only answer!

KarstenI

And if the answer of @PhilipDAth was too technical, the easy answer is "No, nothing has changed. Still nothing that compares to VTIs on a Cisco router".

KarstenI

What happens when you click “Open browser ..”? And are your firewall rules for this SSID blocking something?

KarstenI

Did you also try to skip the root certificate? And can you also post the “wrong” root-cert?

KarstenI

You need to build a new organisation, and add a new network in the new org. Then the devices and the licenses have to be moved to the new org/network: https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Moving_Devices_between_Organizations https://documentation.meraki.com/General_Administration/Licensing/How_to_Request_a_License_Transfer

KarstenI

In the tech game, we bring the heat, Meraki Fullstack, can't be beat. Smooth as silk, no need to fret, Networks locked down, no room for threat. Meraki got your back, from street to suite. (If I win, please draw another time. I already have this nice little speaker.)

KarstenI

Karsten Iwen

Community Record

Badges

Re: Access Point Traffic Encryption