Meraki

KarstenI · ‎Apr 6 2022

This will work. The Z3 has 802.3af power and that is enough for the MR36. If it is only for internet-access, even the access-control is easily done.

KarstenI · ‎Apr 6 2022

That is all really strange. I know of an Org (with per-device licensing) that was many months over the expiration date and nothing happened. Personally, I'll work hard to never run into this situation.

KarstenI · ‎Apr 6 2022

@MarcP Nevertheless you get my Kudo for this suggestion ... 😉

KarstenI · ‎Apr 5 2022

still three days to go (8th of April), hurry up!

KarstenI · ‎Apr 5 2022

We just ordered a bunch of MR57 with a lead time of 38 days. All other models (typically we had taken the MR44/46) had much longer lead times. Now I am waiting for them to arrive.

KarstenI · ‎Apr 4 2022

@MarcP https://www.youtube.com/watch?v=hFDcoX7s6rE

KarstenI · ‎Apr 4 2022

@AutomationDude about three degrees Celsius. But at least no snow. That was freaking cold on my way to work this morning! So yes, a wooden winter cap would also do the job.

KarstenI · ‎Apr 4 2022

@AutomationDude I'll take a second pair of socks instead of the cap ... 🙂

KarstenI · ‎Mar 31 2022

You still have to convert it, you are not allowed to send the single network ID as a string.

KarstenI · ‎Mar 31 2022

This is how I do it with the API: uplinks = dashboard.appliance.getOrganizationApplianceUplinkStatuses( org_id, networkIds = net_id.split(), total_pages="all") net_id is a single network which I first convert to the list that is sent to the API.

KarstenI · ‎Mar 31 2022

networkIds is an array, do you send the data appropriate?

KarstenI · ‎Mar 31 2022

This call needs the serial-number of the device. You have to get all the serials of all intended networks and iterate over this list.

KarstenI · ‎Mar 31 2022

On a MX67/68 and for internet-traffic? Security enabled?

KarstenI · ‎Mar 31 2022

Correct! Just the "normal" traceroute on linux should show the correct result as it is based on UDP and only optionally on ICMP.

KarstenI · ‎Mar 31 2022

I would not say that it's a bug, just that it is an unexpected "feature" of the Meraki implementation. At least it is a documented feature. And MTR is again the wrong test as it also uses ICMP and the MX will ignore the flow preference for it. I think that all these tools that show the public IP are the right thing to test it. Or to do a packet-capture on the secondary WAN and see if the UDP/TCP traffic leaves this interface.

KarstenI · ‎Mar 30 2022

For HA you ned two public IPs as the secondary device also needs internet-connectivity. And yes, if the ISP device only has one port, you need a switch between these devices.

KarstenI · ‎Mar 30 2022

Are you using Windows? Tracert is based on ICMP on that platform and ICMP is nor handled by the flow preferences. Can you try it from a linux box ans see if the route changes?

KarstenI · ‎Mar 28 2022

And now AnyConnect shows up here on my MX64 network! 🙂

KarstenI · ‎Mar 28 2022

As mentioned, when the capture was done while testing the connection, it has to be the port-forwarding on the DB.

KarstenI · ‎Mar 27 2022

Could it be that you confuse that with a PPTP setup? There is no GRE in L2TP/IPsec forwarding.

KarstenI · ‎Mar 27 2022

A couple of things: You don't need to forward AH and ESP, that is wrong on the mentioned video. IPSec needs to be disabled on the box if you only have one IP address. It can only be processed on the box *or* forwarded to the next device. This is the documentation to the packet capture: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overview#MX_Appliances_and_Teleworker_Gateways Capture on the internet port of the MX and use the filter "port 500" to filter out everything that is not needed as a first step. You could also try to forward TCP/443 on the box and use AnyConnect on the MX. It's anyway the better VPN-implementation.

KarstenI · ‎Mar 26 2022

I would assume the original question is to have the flexibility like on an FTD to deny and allow certain traffic based on the App and not only deny as in the actual implementation. Yes, that would be nice.

KarstenI · ‎Mar 25 2022

Most importantly, exchanging an AP doesn't need a new config. The config is in the dashboard network and gets pushed to all APs in the network by default. If you want to have a backup as a disaster recovery mechanism, best is to pull all config by API. Or directly configure the network with the API so you can just apply all API calls to a different network.

KarstenI · ‎Mar 23 2022

Yes, they have to be bought, but luckily the PLUS license is quite cheap.

KarstenI · ‎Mar 22 2022

thanks for the info, I am waiting for over six years, one week doesn't bother me ... 😉

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges