Meraki

KarstenI · ‎Sep 8 2024

We have to wait until it either works again or there is an official statement of the end of the Meraki Insiders program. I assume it will be the first option.

KarstenI · ‎Sep 7 2024

Works as expected: But I also always have a 5 GHz SSID. IMO, it's too early to rely on PSCs only. All Security types work as expected: And I am on v30.7

KarstenI · ‎Sep 5 2024

No, the SSID has to be configured either for MAB or for 802.1X. What you want is only possible on wired ports.

KarstenI · ‎Sep 5 2024

Different models from the Catalyst 9300-M line are the replacements.

KarstenI · ‎Aug 30 2024

You are right. 1: All your VLANs that you want to route internally. 2: typically a default route is fine here. 3: Routes to all VLANs that you configured in Step 1. But also all VLANs that you need to segment for security. For example your DMZs. Depending on the environment, I have all my VLANs here and not on the L3-switch.

KarstenI · ‎Aug 29 2024

Who is 10.45.0.2? Have you tried a packet capture to see what is happening? My typical occurences of this error is when I have some suboptimal routing where traffic from the firewall is sent to the switch and directly back to the firewall.

KarstenI · ‎Aug 29 2024

Switch-QoS is independent of any load. It should re-mark the traffic if configured correctly. Can you show a screenshot? And where did you capture? It has to be on the outgoing port of the first switch or more upstream.

KarstenI · ‎Aug 29 2024

The 350/355 were my default Core-Switches in the Small business area. If I ignore the SVI-bugs that some customers some unplanned downtimes, I was quite happy with them.

KarstenI · ‎Aug 29 2024

It's expensive, but some equivalent devices are even cheaper. All in all, my (very short) calculation is that switching will get more expensive in the future. IMO, it's still the right way.

KarstenI · ‎Aug 29 2024

You always have a kind of Subscription for AnyConnect. There are three models: Subscription per Person that uses the Cisco Secure Client. Every User needs a license. The term is typically three or five years (which have the best price/value ratio) and after the term it has to be renewed. Same as 1) but you "buy" the license (it is perpetual). But for Updates of the client you need a service contract. Licensed per device, but this is only useful if you have many users but only a small amount of them connect at the same time. Again, you need a service contract. In 99% (just a guess) option 1 is the way to go. https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/secure-client-og.html

KarstenI · ‎Aug 26 2024

This is quite limited. You need to make sure that the rest of the network routes traffic to the best exit point in your network. Without an IGP on the MX, it is likely some IP SLA on the L3-switches in front of the MX to determine if the primary connection is alive. If not, the internal routing gets manipulated to route the traffic to the other buildings infrastructure.

KarstenI · ‎Aug 25 2024

Look at this blog post: https://goodwi.fi/posts/2024/04/meraki-ipsk-freeradius/

KarstenI · ‎Aug 25 2024

Well, if you choose "no encryption", you get no encryption ... You need either "Enterprise with my RADIUS Server" or "iPSK with RADIUS" as the Security option depending on your needs.

KarstenI · ‎Aug 23 2024

FreeRADIUS can definitely be used as a RADIUS server. But without any information, it is impossible to help. Is your SSID already configured for Enterprise Authentication? Do the clients already see the SSID? Are users asked for a username/password? What Log do you see in the dashboard, and on the RADIUS-Server?

KarstenI · ‎Aug 23 2024

Yes, this should work. But there are also SSID dependent settings like firewall rules that can restrict the communication. And do devices receive IPs in the same subnet after connecting to these two SSIDs?

KarstenI · ‎Aug 21 2024

The Link you posted and here with some more details: https://documentation.meraki.com/MX/Site-to-site_VPN/IKEv1_and_IKEv2_for_non-Meraki_VPN_Peers_Compared The IKEv2 implementation of the MX is different to approx. 90% of commercial firewalls out there. It's a shame that the MX team doesn't care. Or they care in a way that they hope customers move the peer to AutoVPN. Sadly, for me, some customers moved entirely away from the Meraki Fullstack because of MX limitations.

KarstenI · ‎Aug 21 2024

Without knowing your setup, it is only a guess. But it is likely that you don't use the FQDN that is shown in the AnyConnect config page but your own FQDN. Use the Meraki FQDN and you are fine.

KarstenI · ‎Aug 21 2024

As @RaphaelL says. The typical use-case for the RADIUS-Proxy is if you have branches that don't have IP connectivity to a central RADIUS server.

KarstenI · ‎Aug 19 2024

Am I right that you only have the Advanced Licenses for the switches in your "Philip-Home" network? That would mean it should also be possible with Co-Term to buy the ENT for most networks and ADV for the one network where Adaptive Policy should run.

KarstenI · ‎Aug 19 2024

I still need to find a statement for this in the documentation so that the customer is confident in this solution.

KarstenI · ‎Aug 18 2024

Ok, so for Co-Term we can name this the "Big Al" Licensing ... But for Subscription Licensing it is possible to have different feature tiers per subscription, right? I could have a subscriptions with MS Essentials for network one and a subscription with MS Advantage for network two, right?

KarstenI · ‎Aug 18 2024

Does this also mean that the customer has to buy the ADV licenses for the "normal" 130 if they plan to use Adaptive Policy later on the C9300 somewhere in the same organisation?

KarstenI · ‎Aug 16 2024

But this is about the regular 130 (non-X, and what I forgot to mention initially, also non-R). And I really don't want to believe that Meraki takes double the money for nothing ...

KarstenI · ‎Aug 16 2024

Enterprise and Advance for the classical licensing Essentials and Advantage for the new Subscription Licensing

KarstenI · ‎Aug 16 2024

no, really the legacy differentiation ENT vs. ADV:

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges