Meraki

KarstenI · ‎Dec 30 2020

That means you want to connect the AP directly to the ISP without a Firewall/router doing the PPPoE? This is not a supported use-case. You can (which has to be enabled by support and I never tried it) do a client-side-PPPoE-connection, but I don't think that this is what you want: https://documentation.meraki.com/General_Administration/Other_Topics/Support_for_PPPoE_on_Cisco_Meraki_Devices#Client-side_PPPoE_on_MR I think you have to place a dedicated device in front of the AP to build the PPPoE connection.

KarstenI · ‎Dec 30 2020

PPPoE is not typically used on an access-point. And obviously, you already have connected them "the normal" way to your network. What do you want to achieve with PPPoE?

KarstenI · ‎Dec 21 2020

I think I did that already some time ago, but I wished for that now again.

KarstenI · ‎Dec 21 2020

@GreenMan wrote: Using Network Objects may help you: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Network_Objects_Configuration_Guide On the SSID-Firewall? Does the Support have to enable that?

KarstenI · ‎Dec 21 2020

The design that you are showing is at least very uncommon ... The first question for an advice is: What is your design-goal and why do you think that you can not use a "normal" setup whre both MXes are connected to the ISPs?

KarstenI · ‎Dec 21 2020

Sadly, this is not possible. Yes, having kind of "Config-Objects" that can be applied to different networks would boost productivity with Meraki. But no, that is not possible. Workaround: Configure your rules as a JSON object on your PC and use the API to push it to all networks that need the same config.

KarstenI · ‎Dec 18 2020

The Firepower 1010 only has two PoE-Ports. So all APs are connected to a switch. The VLANs for the Wireless users are configured on the Firepower for everything that is Guest and IoT as I want a strict access-control and the internal Users VLAN is configured on the switch. The connection between switch and Firewall is a Trunk in this case. DHCP is always running on the device that holds the VLAN, but it could also be done on the internal DHCP-server. Configuring the FTD will be a little bit more challenging, that device is not as easy to configure as the Meraki MX.

KarstenI · ‎Dec 18 2020

The APs are completely independent of your firewall as long as they can reach the Meraki cloud. And the FTD 1010 for sure works with these APs. In my office I also have a 1010 combined with my Meraki AP. One drawback is that you will not have the complete visibility from client to internet as you can have it with the Meraki FullStack.

KarstenI · ‎Dec 13 2020

From my experience this is "normal" behaviour. This is another reason I often run an ASA in parallel to the MX for AnyConnect Client VPN. There you can assign the IPs by DHCP and the VPN-hostname gets automatically registered in DNS. But I think there is no way in the MX to achieve this.

KarstenI · ‎Dec 2 2020

Double-check that you have the correct serial-number (the one with the dashes in the blocks of characters). Or just reset the device and try again to access the local status page. There you correct the IP-info and the rest of the config gets automatically fetched from the dashboard.

KarstenI · ‎Dec 2 2020

Do you have a LAN~address configured on the MX? You can access this address in a browser. more info on the local status page: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

KarstenI · ‎Dec 2 2020

The system will be resettled to default. But you can correct the settings through the local status page.

KarstenI · ‎Dec 2 2020

The answer is a) And if you ask yourself why, I would read the Meraki documentation and also the Snort documentation.

KarstenI · ‎Dec 2 2020

You should rethink of and reevaluate your complete network and your security-strategy. If no one is aware of this device, it was probably never updated and could also be a thread to the network. And if there is a device no one is aware of, it is not your network any more ...

KarstenI · ‎Dec 1 2020

Bypassing the firewall is nearly always a bad idea, also while troubleshooting. I would start with Captures (Wireshark/tcpdump) of the web-sessions. One capture for a working attempt and one capture with a failed attempt. Then compare these two captures if you spot something different. Another troubleshooting: Have you tried lowering the MTU/MSS and try if the websites work with that modification? If it works, the PMTU discaovery could be broken in your environment..

KarstenI · ‎Nov 27 2020

But be aware that this feature will not provide the functionality you were asking for. It's only for Auto-VPN and will translate a whole local subnet. Well, the last point could perhaps be solved with a static host-route on the MX.

KarstenI · ‎Nov 26 2020

@CptnCrnch wrote: Repeat after me: MX is not ASA / Firepower. MX is not ASA / Firepower. MX is not ASA / Firepower 🙂 Amen! 😉

KarstenI · ‎Nov 26 2020

Why not share a link with your own "teaser". That way you will reference always the most recent version.

KarstenI · ‎Nov 25 2020

There are a couple of switches with MGIG interfaces available like the MS350 and above. These are good candidates for 10G server connections.

KarstenI · ‎Nov 19 2020

There seem to be some super-folders among us. 💪👍 And @JanVincent, I think you have to fold a little harder for the bag ... 😉 (I would be perfectly happy with a pair of socks).

KarstenI · ‎Nov 19 2020

Brightcloud is quite fast in adding new URLs when they are suggested in their system. In the past, I typically got answers after three to six hours. If you want to block newly seen Domains, integration with Cisco Umbrella could be the solution.

KarstenI · ‎Nov 16 2020

KarstenI

KarstenI · ‎Nov 9 2020

And if anyone is preparing for the CMSS and is not aware of the answer, this is the document to read: https://documentation.meraki.com/MS/Other_Topics/MS_Switch_Quality_of_Service_Defined

KarstenI · ‎Nov 4 2020

Yes, an additional IP is needed. But only one regardless of using HA or not. But I always try to have IPs on both ASAs. If you do not have spare IPs, I would reach out to the ISP to get some more. If that is not possible you can put the outside interface of the ASA into a MX DMZ and forward UDP/443,500,4500 and TCP/443 to the ASA.

KarstenI · ‎Nov 4 2020

I typically put them in parallel or put the inside interface of the ASA in an MX DMZ, based on the filtering needs. Both solutions work good. In general I would not place them inline as there is most of the time no real benefit of that. Well, I have one network where the ASA (actually it is a Firepower 1010) is inline with the MX, my office network.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges