Meraki

KarstenI · ‎Oct 8 2020

@CptnCrnch I already wanted to ask if you are the one. Those were also fun times.

KarstenI · ‎Oct 8 2020

I assume it could be based on the enabled load balancing. While you connect to then primary uplink, your client traffic will leave the MX load-balanced on either WAN1 or WAN2 based on the configured WAN-speeds.

KarstenI · ‎Oct 8 2020

Client VPN only uses the primary Uplink and falls over to the secondary if the primary does not work. Using the provided hostname instead of the static IP ensures that the client-VPN will still work when the primary link fails.

KarstenI · ‎Oct 8 2020

Yes, I just passed the exam 10 Minutes ago. I'll write some lines about that (of course without any rule-breaking) when I recover from my mental disorder caused by the exam.

KarstenI · ‎Oct 7 2020

@Twitch wrote: I am an old school command line guy, and sometimes things don't "click" in my brain with the GUI interface. So am I ... Yes, adapting the Meraki "thinking" is sometimes difficult. I also have problems from time to time. 🙂

KarstenI · ‎Oct 7 2020

Look for „Per-AP Availability“, there you can define on which APs, based on Tags, the SSID is broadcasted.

KarstenI · ‎Oct 7 2020

Actually I don't know but I would expect anything from sweaty feet to apocalypse. With unique client identifier there is a correlation done between seen IP- and MAC-addresses. I expect for this to work all switches have to be on the LAN side where the Meraki switches can see both of these. On the WAN side the switch sees the WAN-MAC addresses and public IPs and probably does not know how to correlate them. And personally, I would not waste a shiny Meraki-switch for that. Nowadays I typically use Catalyst 1000 switches on the WAN side.

KarstenI · ‎Oct 6 2020

No one can deny you to study together, The 90 minutes on exam day of course have to be done on your own.

KarstenI · ‎Oct 6 2020

On Wireless -> SSID Availability you can control which APs broadcast which SSIDs. Just configure this AP not to broadcast your SSIDs and no user/device can connect.

KarstenI · ‎Oct 6 2020

@cmr wrote: There are plenty of other areas where I would prefer the developers focused, hardware wise more than 2WANs would be my No.1 for MXs and an MS350-8P would be great for switches. Oh, I join you in dreaming ... 🙂

KarstenI · ‎Oct 6 2020

There are tons of documentation on https://documentation.meraki.com ... But all depends on how your network is build. I would expect that the routing core is the MS425. With that the MX is completely out of the equation. If the Hyper-V is also attached to the Core, then the Access-switches are not relevant here. All you need to look at, are the two ports connecting to the VM-Host. Now I would think that a 10Gig-Port is a waste of ressources only for Hyper-V-Management. I would put both NICs to trunk and make sure that the VMs can use either ports which also gives you some redundancy. If your setup is differnet, you should provide some more information here.

KarstenI · ‎Oct 6 2020

Practically there is only "Trunk" available for this use-case. And if you do not need any native VLAN, I would leave native VLAN on the port blank and configure the HyperV to tag all the data-vlans.

KarstenI · ‎Oct 6 2020

I think that it's not possible at the moment. But I would expect that Meraki will implement it in the future. With "Smart Application Based Local Internet Breakout" the foundation is available in the MX. I could imagine that it will be expanded to internet-traffic also. But I would not wait for it. If you really need it: Place a proxy server in a DMZ, configure it with two IPs and tell the proxy to use IP-A for general traffic and IP-B for social media. Then the Flow preferences of the MX can handle the rest.

KarstenI · ‎Oct 6 2020

@Pipeline wrote: Is there a way to fully disable the FW? You could replace the device with a cross-over cable. Full gigabit speed and no firewall applied. 😉

KarstenI · ‎Oct 5 2020

@SBITSolutions wrote: I just finished the ECMS1 but can't find the ECMS2. Any links? https://community.meraki.com/t5/ECMS2/ct-p/ecms2

KarstenI · ‎Oct 5 2020

At least I don't know of any vulnerability at the moment. That does not mean that it will never have one. Having a service running for others is always a risk. For me, I accept this risk most of the time. But if you want you can disable/configure the local status page in the "network-wide" configuration. If you leave it enabled, make sure that you have at least set your own password.

KarstenI · ‎Oct 5 2020

No, although you'll remove the actual one physically when you want to exchange the device, I am talking about removing the MX from the dashboard network and assigning the new one.

KarstenI · ‎Oct 5 2020

@BlakeRichardson wrote: @SBITSolutions Welcome. Meraki ECMS1 and ECMS2 courses are both free. https://community.meraki.com/t5/ECMS1/ct-p/ecms1 Well, only if you are entitled ...

KarstenI · ‎Oct 5 2020

Thanks for this designation and also for the congrats. Now I have to decide what to do with all the trophy money .. 🙂

KarstenI · ‎Oct 5 2020

You don't need to restore anything here. The config is applied to the Dashboard-network. When you remove the MX from the dashboard and add the new MX, it will fetch the config from the cloud and you are ok. You only have to make sure the WAN IP (or IPs if you also use WAN2) is set so that the MX can connect to the cloud.

KarstenI · ‎Oct 2 2020

I would say that the MX100 is pretty fine for the next upgrade(s). We have an MX84 on a 1Gig connection. Obvious we can not use the whole 1Gig, but up to around 500 MBit all is running smooth. (The Upgrade from the previous 200MBit to 1Gig was nearly the same price as the Upgrade to 500MBit and a new firewall was not in the budget yet.)

KarstenI · ‎Oct 1 2020

Yes, had this and similar problems a couple of times. Nearly all were resolved by updating the ASA to a more recent or at least suggested release.

KarstenI · ‎Oct 1 2020

@NolanHerring wrote: Thanks for sharing. Might be a good idea to add to the document, how to tell when a device is using a randomized MAC address. "If a MAC address second character is a 2, 6, A, or E, then it is a randomized address." x2-xx-xx-xx-xx-xx x6-xx-xx-xx-xx-xx xA-xx-xx-xx-xx-xx xE-xx-xx-xx-xx-xx And if anyone just thinks "why are these the randomized addresses?" They are exactly the addresses that are defined in IEEE Ethernet as "Locally Administered Addresses" which have set the second least significant bit of the first octett (the U/L bit): https://en.wikipedia.org/wiki/MAC_address#Universal_vs._local

KarstenI · ‎Oct 1 2020

Thanks for the kind words 🙂 I'll do my very best ... 😉

KarstenI · ‎Sep 30 2020

Sadly, this is a known bug. From the release-notes: MX250 and MX450 appliances will not apply the configured VLAN ID to traffic transmitted on their WAN interfaces if VLANs are also enabled on the LAN for other downstream clients and traffic. You probably have a DSL-Modem in front of the MX. Disable VLAN-tagging on the MX and let the DSL-Modem do the job. I personally prefer the Draytek Vigor for this.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges