Meraki

KarstenI · ‎Aug 16 2024

Hi all, What is the benefit of the Advanced License compared to the Enterprise License for the MS130 (non-X models)? Obviously, it's not Adaptive Policy or more OSPF routes like on the high-end models. Any idea or reference? Have a great weekend, Karsten

KarstenI · ‎Aug 14 2024

Sadly, your options are either IKEv1 or consolidating your IP networks into one supernet. It's a shame that these two Cisco solutions can only communicate with the help of deprecated technology. At least in regard of extranet VPN functionality, the MX would be the kid that gets regularly scrapped on the schoolyard ...

KarstenI · ‎Aug 14 2024

Which version and which platform?

KarstenI · ‎Aug 12 2024

This is a not that uncommon approach in this situation. Sadly, this is not easily simulated because of the different walls types of historic buildings (and you never know what is really inside the wall). IMO, testing and measuring it is the only way to go here.

KarstenI · ‎Aug 11 2024

Not really a problem for the Meraki Community. But what I see most often as a problem is a messed up NAT config on the FTD.

KarstenI · ‎Aug 11 2024

What is now configured on your VLAN1 subinterface needs to be moved to the physical interface. It is still a routed interface and not a switch port/VLAN interface as on the 1010. But this is the way you make the traffic untagged.

KarstenI · ‎Aug 10 2024

If you configure VLAN 1 as a subinterface on FTD, you don't have a native VLAN. You need to confgure your VLAN1 settings on the main interface. But to be sure better post screenshots of your settings.

KarstenI · ‎Aug 9 2024

This is a specific limitation of the Full Tunnel setup. But this is only one possible way to operate the device (although a common one). If not using Full Tunnel, you can get the firewall speed.

KarstenI · ‎Aug 8 2024

You can use any port you want, also the SFP ports.

KarstenI · ‎Aug 7 2024

I would start with CMNA. If you work for a partner, go through all the Meraki Blackbelt trainings. This is all free. The ECMS (without 1 or 2) is paid, but the "official" way to the exam. IMO, the ECMS training is not enough to pass the exam. The Meraki documentation is the most relevant source.

KarstenI · ‎Aug 7 2024

Do you mean the CMNA? This is a good start, but ECMS2 has a deeper technical content.

KarstenI · ‎Aug 7 2024

IPS is done on the MX where the traffic enters the AutoVPN system; not on the Hub if you have Spoke -> Hub -> Spoke traffic. But if I remember right, IDS would still be done on the Hub.

KarstenI · ‎Aug 7 2024

Which Cisco Learning are you talking about? Cisco has numerous learning offerings that make it hard get get what you are talking about. But perhaps it is due to the fact that Cisco merged both trainings ECMS1 and ECMS2 into one combined training.

KarstenI · ‎Aug 7 2024

This is a good idea! 👍

KarstenI · ‎Aug 7 2024

Adding to what was already said, the CW9166D1 solves some of the problems when it normally requires external antennas.

KarstenI · ‎Aug 7 2024

This is one of the use cases for MACsec. Sadly, it is not supported in the Meraki world. If you decide to use two Meraki monitored C9200CX, MACsec should be a way to go.

KarstenI · ‎Aug 7 2024

And make sure you have enough days of vacation left to go through all of them ... 😉

KarstenI · ‎Aug 4 2024

What kind of problems did you face?

KarstenI · ‎Aug 4 2024

Mine were only for pure end devices that consume services but don't provide services. Yes, a video server needs other settings.

KarstenI · ‎Aug 3 2024

For all user-ports, I typically use 1%. Everything above that (or even with 1%) is a clear failure condition as that should not happen normally.

KarstenI · ‎Aug 3 2024

As a Cisco Partner, you have access to the BlackBelt Trainings on Salesconnect: https://salesconnect.cisco.com You are likely to benefit from the Presales Training. It has three stages, which must be completed in the right order (Stage 1 -> Stage 2 -> Stage 3).

KarstenI · ‎Aug 3 2024

Yes, this is exactly what you need to do: The Edge router is configured with PPTP on the WAN side and with an IP from the /28 on the LAN side. All your MX and other routers get an IP from the /28 block and use the Edge-Router LAN IP as the default gateway. The EdgeRouter should not do any NAT, just routing.

KarstenI · ‎Aug 2 2024

All VPNs are always terminated on the IP that the MX holds. You can put other services (NAT) on the additional IPs.

KarstenI · ‎Aug 1 2024

Every wireless client that connects with a non-Meraki infrastructure shows up as a client connected to the switch where the traffic enters the Meraki network. Works as designed. I would assume this will change when you add your 9800 in monitor mode to the Meraki Dashboard: https://documentation.meraki.com/Cloud_Monitoring_for_Catalyst

KarstenI · ‎Jul 30 2024

5.1.4.74, it‘s the same for all platforms.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges