Meraki

KarstenI · ‎Apr 16 2023

Yes, they are really good!

KarstenI · ‎Apr 16 2023

They are also available directly from the vendor: https://www.rackmount.it/products/regulars/cisrack/rm-ci-t14.html But through Amazon might be more comfortable.

KarstenI · ‎Apr 15 2023

The Meraki Authentication uses EAP-TLS which is considered one of the most secure methods available. One drawback is that it’s only supported on wireless and not for 802.1X on the switch ports. If you want to extend the authentication to the switches you need a RADIUS server.

KarstenI · ‎Apr 13 2023

This is the biggest restriction of the MX. If there are specific VPN needs I always place an ASA/FTD side by side to the MX. Another option is to have all peers on AutoVPN with an MX. There you can use the outbound firewall.

KarstenI · ‎Apr 11 2023

Here is number 2: https://community.meraki.com/t5/Smart-Cameras/Cloud-Archive-Bandwidth/m-p/40295#M816

KarstenI · ‎Apr 10 2023

Just got the answer from certification support (where I opened the initial case) that they are still in progress, but it will be extended before expiration. And as I did the exam shortly after it went live, I assume that will be solved for all CMSS. A big thank to the Meraki and Certification Support teams for working on this. Now I have the problem that I have no idea which exam to write at CiscoLive …

KarstenI · ‎Apr 7 2023

This is really good news that it was possible to sort this out. Every CMSS wins by this. Well, not @PhilipDAth who already recertified this time by exam … But probably next time.

KarstenI · ‎Apr 5 2023

Well done @Esh and congrats to the rest! 🙂

KarstenI · ‎Apr 4 2023

@Rainverm The newer models have PoE on the WAN ports.

KarstenI · ‎Apr 4 2023

with Cisco it is often referred Policy-NAT.

KarstenI · ‎Apr 4 2023

There is something else that could influence your decision. With 40 users, the internal wireless of the MX (any model) will likely not be powerful enough for you. I would buy a model without internal WLAN and just add two MR access-points to the network. Mixing internal WLAN and additional APs doesn't work that great.

KarstenI · ‎Apr 3 2023

If the ASA 5505 did the job, I would replace it with a Firepower 1010 (running either FTD or ASA image) for this use case. The MX is quite limited when it comes to extranet VPNs.

KarstenI · ‎Apr 2 2023

I can't change the ip plan on both. For sure you can. It is just that someone is thinking that the PITA of having duplicate networks is less pain than renumbering. IMO every other way to solve this problem is better that having this double NAT.

KarstenI · ‎Apr 2 2023

The first question is all your choice. Personally I like the primary/backup approach as long as the primary link is not saturated. Having no load-sharing makes troubleshooting much easier. But if you go to the max of ISP1 *and* both uplinks are equally fast, I would use load-sharing.

KarstenI · ‎Mar 31 2023

But just a warning, for non AutoVPN IPsec tunnels, it is a whole mess as the automatic MSS adjustments for lower MTUs is *not* done for these tunnels.

KarstenI · ‎Mar 30 2023

This is all about honouring you @PhilipDAth 🙂 And you deserve it! (And I also got eight new badges 🙂 )

KarstenI · ‎Mar 30 2023

Need? No! Still good and future-proof choice? Yes! But the MX67 is likely the financially better choice.

KarstenI · ‎Mar 30 2023

On the screenshot it seems that it is a documented feature of your ISP connection.

KarstenI · ‎Mar 30 2023

As @Brash mentioned, your setup is perfectly fine. Replacing the actual firewall with an MX will easy your management and monitoring as all will be done from a single dashboard. Other than Brash suggests, I would go with the MX75 if the budget allows it. This device is the newest one in the line and is likely supported longer than the MX67. If you are on budget, the MX67 will be perfectly fine, I operate plenty of them even with more users. But I would not buy the MX64 any longer as this device is already quite old.

KarstenI · ‎Mar 30 2023

This is already answered, it can be done.

KarstenI · ‎Mar 30 2023

As @ww said, this can be done and will typically work. I always go one step further and tell my customers to get a fixed public IP if they want to provide public services where Remote Access VPN is one of them. It will just avoid any future problems.

KarstenI · ‎Mar 29 2023

Well, before deciding for a design, you should make sure that it matches your need. With your central design the spoke traffic to the internet will run through your internet pipe twice.

KarstenI · ‎Mar 29 2023

That is exactly what is possible.

KarstenI · ‎Mar 29 2023

It all depends on how you define "specific". Whatever it is, it will not be controlled on the MX. If it is pure IP-basd, a device in Front of the MX could handle this with ACLs, for everything else you likely need an integration with your radius server.

KarstenI · ‎Mar 29 2023

I am not 100% sure that I understand you correctly. But you can do the following which will work: The Fortigate is your main firewall that connects to the internet The HQ MX is placed in Concentrator mode in a FG DMZ The HQ MX is used as a Default route for your branches The Traffic from the branches will be tunnel to the MX, leave the same MX interface and is routed back to the FG interface. If it is internal traffic, FG will route it internal, if it is Internet traffic, the FG will send it to the internet.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges