Meraki

MDHackett · ‎Jun 11 2021

@Bruce We're working to resolve this through attaching WAN1 from all the remote sites (big and small) to the L2 fiber connection and bringing those into the Data Center LAN port in it's own subnet, drawing an internet connection through WAN1 on the Data Center, allowing them to enable an AutoVPN connection to one another to allow them to control their own routing. I've connected WAN2 at the remote sites to a cable modem as fail-over for the AutoVPN and management if it should otherwise lose connection to the L2 fiber. We're in the midst of rolling this into place at all our locations for testing before we cut over on a weekend to live, but so far it looks very promising.

DarrenOC · ‎Jun 11 2021

hahahahaha - not just me then and I produced the questions @SandroZ

Inderdeep · ‎Jun 11 2021

@SandroZ : we know your tricks and we got the right answers 😀 Thanks for these initiatives !

suneq · ‎Jun 11 2021

Thanks all for your great help. It's nice to hear feedback from the field.

MerakiMed · ‎Jun 10 2021

Thank you Karstenl for that clarification. The feature is will still be useful for other apps like VDI over VPN. But too bad we can't use it for VOIP too. Fortunately we don't get too many RC problem calls.

KarstenI · ‎Jun 10 2021

What problems are you running into? I am using it on MS120, here in the office I have the MS120-8FP. and 802.1X works as expected.

Bruce · ‎Jun 8 2021

Hey @BlakeRichardson, I remember setting up NPS once on a Windows Server (could well have been 2012 box) and there was a service that needed starting to get it to respond to 802.1x requests. I can't remember which one exactly it was, but it only seemed partially relevant, may have been something like an 802.1x client service or something.

PhilipDAth · ‎Jun 7 2021

Cisco ISR1111-8P Strongswan on Ubuntu,

cmr · ‎Jun 6 2021

@Inderdeep I've edited my comment to make it clearer, thanks for pointing out the error!

cmr · ‎Jun 6 2021

@Aslam if they can share the invoice with Meraki then you might be in luck. If it's the same company then surely the new management can access the accounts?

Inderdeep · ‎Jun 5 2021

@leadtheway : yes you can still do that redundancy. Let suppose x amount of traffic is passing through wan1 and y amount of traffic via wan 2, if wan 1 link down, the x amount of traffic failover to wan2 with y amount of traffic, similar vice versa.

KarstenI · ‎Jun 5 2021

Seems he bough a lot of devices without checking if these fulfilled his needs ... Can you elaborate on your plan with disabling DHCP? I don't get yet how this should achieve anything.

CBCAV · ‎Jun 5 2021

Gotcha! I just configured everything via VPN will be in the office later today to test it out. Thanks for your help!

Inderdeep · ‎Jun 4 2021

@SandroZ : Thanks a lot !

nikmagashi · ‎Jun 4 2021

Hi PhilipDAth, I do have my own suspicions also, but we will check and see what is going on there. Anyway thank you all for giving me different views on this case. I really appreciate this.

KarstenI · ‎Jun 3 2021

No, that's not what I tried to say ... 😉 I was talking about how to authenticate your endpoints when entering the network. Your BYOD devices typically get a certificate enrolled and use the Meraki authentication (That is IMO one of the best features of SM). But the domain-PCs do not have a certificate from the Meraki Dashboard like the BYOD devices and have to be authenticated in a different way, for example through your Microsoft NPS. The ISE could authenticate both your BYOD- and domain systems.

KarstenI · ‎Jun 3 2021

It all depends. Do you *send* the traffic to the different destinations directly? Then it will be load balanced (well, if that feature is enabled on the MX). But if you send the stream to a distribution system (like youtube or a website where the stream can be consumed) then again, there will be no load balancing.

GIdenJoe · ‎May 31 2021

Hey @PhilipDAth that was what I was referring to. If you have multiple VLAN's per template network the carving of subnets will be random. For example if you have 10.0.0.0/8 as an IP block to carve from and you want /24's for each VLAN on a template network one branch could get 10.5.15.0/24 and 10.66.22.0/24 with the Meraki implementation. That's just horrible IMHO. I'd rather have that one branch would get 10.5.15.0/24 for VLAN x and 10.5.16.0/24 for VLAN y. It would have been better that you could choose: 1) your ip block to carve from 2) an ip block per site 3) an offset for each VLAN that applies to all template branches. I guess one could script that 🙂

PhilipDAth · ‎May 30 2021

Click "Show details" on the right-hand side when looking at the client. It brings up traffic analytics for just that one client.

Inderdeep · ‎May 28 2021

@SandroZ : Thanks !

rhbirkelund · ‎May 28 2021

@mmistretta wrote: [...] it wasn't until after configuring the local and remote IDs, the tunnel came up. Which is also a change in behaviour for MX15.42.1 firmware. From release notes;

KarstenI · ‎May 28 2021

@RichardChen1 wrote: Since the concentrator has a lan ip address. What kind of port forwarding required for client vpn to work? Just udp500/4500 to lan ip? Yes, UDP/500 and UDP/4500 is enough as with NAT-T, after the initial exchanges on UDP/500 all is encapsulated in UDP/4500.

PhilipDAth · ‎May 27 2021

You can not perform route filtering of AutoVPN routes.

PhilipDAth · ‎May 27 2021

The priority applies to the entire switch stack, not individual members of the stack. Assuming this is a hardware stack.

KarstenI · ‎May 26 2021

You are probably talking about the local status page. Access to it can be controlled from the dashboard: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#Configuring_the_Local_Status_Page Be aware that this status page is only for initial setup for the cloud connectivity and not to configure the whole device. That is only done on the dashboard.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges