Meraki

KarstenI · ‎Feb 14 2023

You wouldn't need the firewall rules for DHCP as that is exempted from the "Deny Local LAN" processing: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

KarstenI · ‎Feb 14 2023

No conflict as your individual rules are always placed above the "Deny Local LAN".

KarstenI · ‎Feb 14 2023

It works aas intended. And now I again ignore it as I nearly never use the hamburger menu ... 😉

KarstenI · ‎Feb 13 2023

Certainly not always best. But works for me very well most of the times.

KarstenI · ‎Feb 10 2023

I don't think there is a hard Best Practice, It has to match your needs. I am a friend of DHCP with reservations for my devices. This speeds up the onboarding if they are moved to different locations. But on some situations I set them statically. For example if I need to send traffic from the device to a RADIUS server for 802.1X.

KarstenI · ‎Feb 10 2023

With this little traffic it is quite certain that having "only" 10G is not the problem. Moving to 20G with a LAG will improve reliability but will not solve the problem. Now you have to look for other differences between these two places. For example AP config/models/problems/channels etc.

KarstenI · ‎Feb 10 2023

You need to look at the individual ports that connect your switches: If you see a traffic rate that approaches the line rate it's time to add some links to the LAG or move to a faster interface. The pure amount of traffic is not really relevant as it doesn't tell if it is bursty.

KarstenI · ‎Feb 9 2023

Look at the dashboard if these 10G links are already saturated. If yes, not only the speed-tests are affected, also the user-experience should be limited.

KarstenI · ‎Feb 9 2023

What software do you use here to get the data? I am pretty sure the client software messes something up here. How does it look in Postman or called by the python-SDK?

KarstenI · ‎Feb 3 2023

No, the AP and the Sentry client need to be in the same org. With that it would work for the clients still on the legacy SM but not for new new "regular" clients.

KarstenI · ‎Feb 2 2023

Both the ASA and FTD is available in the cloud but sadly, no full featured MX.

KarstenI · ‎Feb 2 2023

No, the main purpose is to act as a VPN-concentrator and not as a "real" firewall.

KarstenI · ‎Feb 1 2023

Oh, back in the fantastic four group …. Congratulation to all who have their names listed here! 😀

KarstenI · ‎Feb 1 2023

Sometimes you want that also the branch offices send the internet traffic first to the Hub and from there into the internet. One reason could be that your MXes only have the Enterprise license without any NGFW security. But on the headquarter you have an additional NGFW to protect the traffic. Here it could be useful to use the headquarter as the central internet break out.

KarstenI · ‎Jan 31 2023

If you want to connect remote users, AnyConnect is the way to go. After establishing a connection to your VPN-gateway (whichever this is) the users can use the AutoVPN connection on the gateway to connect to other sites if your access-control and routing allows this.

KarstenI · ‎Jan 31 2023

If both are in the same dashboard organisation, you can use AutoVPN to connect them.

KarstenI · ‎Jan 30 2023

You say the SSID is broadcasted but you also say you get no signal. But that is contradictory. Have you checked with a WLAN scanner? And in the dashboard, what does the individual AP list?

KarstenI · ‎Jan 30 2023

There is soooo much that needs to be considered here that you really should look for a Cisco partner to support you. But in general: The MX is typically "only" the firewall and doesn't care if the network has APs from vendor A or vendor B. With Meraki APs, the MX can take the role that is known as an anchor controller in the traditional Cisco wireless world. It is not possible to mix traditional Cisco and Meraki for this function. If you buy Catalyst 9100 APs, you need a compatible controller which could be any of the c9800-series. Your older Aironet 1832 can still run on this controller.

KarstenI · ‎Jan 30 2023

The VMX is a license-only "device". Of course there has to be a cloud instance to run the VMX on that will have an additional cost, but in regards of the dashboard licenses, only the VMX license of the appropriate size is needed.

KarstenI · ‎Jan 30 2023

But keep in mind that you shouldn't be in an area where "Winter" is available unless you have a temperature controlled enclosure: Operating temperature: 32 °F to 104 °F (0 °C to 40 °C)

KarstenI · ‎Jan 30 2023

This is more an MX topic and not Wireless LAN ... It can be done with Flow preferences on the MX: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences#Flow_Preferences But FW2 needs to be the active unit to make it work.

KarstenI · ‎Jan 27 2023

"Earned by 13" so far ... Probably more to come. Now we only need a way to see who earned a specific badge. 🙂

KarstenI · ‎Jan 27 2023

This is what I want to do. Really no API for this? That would be quite disappointing.

KarstenI · ‎Jan 27 2023

Hi, I don't find the endpoint to query if Umbrella is enabled on the MX and if yes with which settings. Any hints for me? Have a great weekend, Karsten

KarstenI · ‎Jan 26 2023

done! 🙂

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges