Meraki

KarstenI · ‎Jan 8 2021

Thanks @PhilipDAth for this input. I never thought about this consequence of using the VIPs.

CarolineS · ‎Jan 8 2021

@DarrenOC wrote: Can we please feed this back @MeredithW , @CarolineS Thanks for the heads up, @DarrenOC! I've passed this on to the right people. Cheers!

KarstenI · ‎Jan 8 2021

Oh, yes, it's the mail-server that needs to send mails. I was under the impression that you want to only allow access *to* the Mail server. Of course Bruce is right here.

BrandonS · ‎Jan 7 2021

Maybe a bit of a stretch and a chore, but I understand Meraki has AnyConnect client VPN under beta. You could ask support about enabling it and see if it works from that location. I have no idea if it uses different ports and protocols, but it may.

GIdenJoe · ‎Jan 5 2021

If you only need wireless behind one internet connection it's usually better to use an MX appliance (which can do PPPoE) that has wireless on board MX67W.

ganeshjadhav · ‎Jan 5 2021

Thanks

KarstenI · ‎Jan 5 2021

You have to: Create a new Group-Policy Deny all traffic to the list of unwanted servers Allow the rest Apply this Group-Policy to the Mail-server

ricvil · ‎Jan 1 2021

Understood. Thanks for the insight.

KarstenI · ‎Dec 31 2020

There is no native integration with any MFA providers. You can use any system that uses *one* login through RADIUS and divides this login to authenticate both factors. I use duo.com for this: User enters his AD-credentials MX sends the login to the Duo authentication-proxy (an app running on Windows or Linux) The Auth-Proxy uses this login to authenticate the User to Active Directory (or through ISE) When the Authentication is successful, the Auth-Proxy queries the Cloud to send a request to the smartphone The user accepts the login on his smart-phone The user is granted access

rocktreesign · ‎Dec 30 2020

Hi, I am trying to setup the scenario where I am tracking an IP in the MPLS network for a specific route reachable via that MPLS network. That way I can be quite granular in what routes go via the MPLS network and which would failover to an IPSEC tunnel to the DC. I'm doing this on the Meraki Live demo site with an MX100. When I add the static route entry with 'while host responds to ping' for an IP in the MPLS network i get the error message... "There were errors in saving this configuration: Host IP must be inside the static route's subnet." It seems I can only use an IP in the attached subnet for the next hop? That doesn't seem to be of much use. The LAN interface of the MPLS router will be up and responding to pings even when its WAN interfaces are down or blackholing traffic so my static route would never be removed from the routing table and the MX100 would never use the IPSEC path to the DC. The only scenario that would failover is if the MPLS router fails completly. Its much more likely for the circuit to fail so I need to cover that eventuality somehow. Any ideas or thoughts? Thanks RTS UPDATE - 5 mins after posting - I was misunderstanding the error message. the host IP to ping must be in the destination subnet, not next hop subnet so it seems ok. I'm guessing the logic is that if this IP in the destination subnet is not reachable via this next hop then don't use this static route which makes sense. I wanted to use a transit subnet near to the destination but this works in any case. Thanks if you read this far as I'm working through my design!

ww · ‎Dec 29 2020

Make a packet capture on port 23 and see if the switch send a dhcp discover and gets a offer back on vlan 100. Or try set a static ip or vlan 100

oldroo · ‎Dec 24 2020

i spoke to Meraki about this and their multigig capability and wifi accomodated standard as i have to do a 5yr lifecycle for site deployments for up and coming projects. Currently multigig capability (theoretical is just under 5 gig even though multi gig 10 is out there). So where am i going ? there are always technologies in the pipeline. Multigig throughput and anything beyond wifi 6 there are no current products planning to be released in the near future.

KarstenI · ‎Dec 23 2020

Amber means no cloud connectivity. What is the status in the dashboard?

KarstenI · ‎Dec 22 2020

The first important thing is that there will be no fast roaming between Meraki and the other Cisco gear. For the concentrator implementation: The concentrator is typically placed in the DMZ. For each SSID you can choose to break out the traffic locally or to tunnel the traffic to one of your concentrators. This tunnelling is basically what you are doing with local mode and the local break out would be comparable to FlexConnect. An important point to consider is what you say about the different organisations: There are also organisations as a Meraki term where all devices and licenses of a company are combined. SSID tunnelling is only possible between devices in one organisation. If each of your organisations want to buy their own concentrators, then there is no tunnelling from your AP to their the other organisations concentrator.

VinhLV · ‎Dec 21 2020

Yes, it was working, and i would insert public IP to setup with topology Meraki Recommend full stack. Thanks you !

kawata2 · ‎Dec 21 2020

Thank you for your reply. I'm waiting for network objects (official). I'll try it when I get a chance to verify. Regards,

BlakeRichardson · ‎Dec 21 2020

Well done everyone!

Basil · ‎Dec 20 2020

So I'm back again. After playing around with this for about 4 days now, finally got it fixed. So i had to make 2 changes. 1st on my DNS server and 2nd on my win 10 client vpn adapter. i went to my DNS server, and in my forward lookup zone, and my domain, i went to the properties and changed dynamic updates to allow both secure and nonsecured setting. Then went to the Cisco Client vpn adapter on the win 10 client, properties and choose IP4 , and then under advanced, needed to check mark both the DNS options Register this connections addresses in DNS & Use this connections DNS suffix in DNS registration. Since my win 10 machine was already a domain connected device, i left the DNS suffix as blank. If your computer is non domain joined, then please add the dns suffix field. With both of these check marked, I had to disconnect the VPN connection, and then reconnect again. Once this was done, my VPN clients started registering properly in my DNS server. So my initial issue is fixed and my RMM solution is able to recognize the VPN client . This is going to make my life so much easier providing remote support to users working from home. So i'm just putting it across if its useful to anyone. Now what i wanted help is if i can add the above 2 DNS options to automatically be check marked when i create future VPN connections for my users using my powershell script. As of now. the script does everything. But now i need to add the above 2 dns options to be checkmarked too. Any idea on how i can make that possible.

Bossnine · ‎Dec 18 2020

Having them hug the wall, even if the math works out, seems like it would introduce problems with far end clients potentially reaching for an AP not in their physical room. (which has happened to me in my environment). That being the case, I try to center the AP in each classroom as I come across them.

cmr · ‎Dec 16 2020

If it's the destination that has the latency then you should be able to create a rule to send traffic to that destination

PhilipDAth · ‎Dec 11 2020

I've had this issue intermittently and a device reboot seems to fix it. I think the issue is in particular firmware versions. I haven't run into the issue for a while.

RafaelM · ‎Dec 10 2020

Aaaaaaaaand... corect answer is: a. More references can be found on: https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection Thank you for your participation on this one again!

BlakeRichardson · ‎Dec 9 2020

@Noah_Salzman Yes I was around for the PPC to Intel transition as well as the MacOS classic to Mac OS X transition. The issue with ARM is the lack of bootcamp and Virtualisation at this stage a bit of an issue as well.

Bruce · ‎Dec 9 2020

You shouldn’t lose your connectivity just by switching from Single LAN to VLANs. The IP configuration of the MX as Single LAN gets copied across to VLAN 1. The only issue could be if the MX ports are not configured as Access Ports on VLAN 1 - this could be the case if there was a previous configuration on the MX. Make sure the ports are configured as Access, VLAN 1 and enabled, and you shouldn’t lose any connectivity. Once you’re at that starting point you can then move to creating the DMZ. If all your ports are configured correctly and you’re still losing connectivity then I’d contact Support as it’s unlikely that you’ll get the assistance here that you need to troubleshoot this one.

ghud312 · ‎Dec 7 2020

@KarstenI Ok, Thanks. Will give it a try.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges