Meraki

BrechtSchamp · ‎Jan 28 2019

Yes, but in some cases (FDDI, OM1, OM2 cabling) you need a mode-conditioning patch cord. If your fiber is multimode and you don't already have that single mode transceiver it would be better to just use a multimode SFP. GLC-SX-MMD= https://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/product_bulletin_c25-530836.html

BrechtSchamp · ‎Jan 28 2019

No, VTP is not supported on Meraki switches. Check these links for detailed info on interoperability: https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Integrating_the_MS_Access_Switch_into_a_Cisco_VTP_domain https://documentation.meraki.com/MS/Deployment_Guides/Advanced_MS_Setup_Guide "Meraki switches do not support VTP but will forward VTP updates, which means they operate in VTP transparent mode."

BrechtSchamp · ‎Jan 28 2019

SX is multimode, LH is single mode, so no this is not recommended. What distance do you need to cross and what type of fiber do you have?

BrechtSchamp · ‎Jan 28 2019

Officially: For the Meraki side use Meraki SFPs: https://meraki.cisco.com/lib/pdf/meraki_datasheet_sfp.pdf For the Catalyst side, use the Cisco Transceiver Compatibility Matrix: https://tmgmatrix.cisco.com/home Non-officially, Meraki isn't too strict about the SFPs used in them. Your mileage may vary but most Cisco SFPs will work in it too. In any case, make sure wavelengths and links speeds on both ends are the same of course.

BrechtSchamp · ‎Jan 27 2019

Good to hear!

BrechtSchamp · ‎Jan 27 2019

Could you elaborate on what you mean with "NATing" appears to be an issue. Are we talking about outgoing NAT or incoming NAT (port forwarding/1-to-1 NAT)? Can you give a couple of examples of applications experiencing issues?

BrechtSchamp · ‎Jan 27 2019

I'm missing the default route pointing to 192.168.1.2. Could it be the screenshot incomplete?

BrechtSchamp · ‎Jan 27 2019

Can you post a screenshot of Switch > Configure > Layer 3 routing

BrechtSchamp · ‎Jan 27 2019

What does your topology look like? Client - Switch - MX - Wan-router? Is the switch in L3 mode?

BrechtSchamp · ‎Jan 27 2019

I'd start with the path clients take towards the internet. Use ping and tracert to see where they get blocked.

BrechtSchamp · ‎Jan 27 2019

The auto VPN only works between MX and Z series. You can build site to site ipsec tunnels to other devices like asa and Fortinet: https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_between_MX_Appliances_in_Different_Organizations#Third-party_VPN_Configuration You can configure basic settings like static ip, gateway, dns, proxy via the local status page : https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

BrechtSchamp · ‎Jan 26 2019

There is a client alerting feature, but it's not specific to wireless clients. It's in the Network-wide/Alerts menu. Would that help?

BrechtSchamp · ‎Jan 26 2019

Seems like the snippet installation guide is not available yet on their link: https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/wifi4eu

BrechtSchamp · ‎Jan 25 2019

That's hard to believe :). The MR (access points) only has one license tier. I'm assuming you mean you bought 7 x LIC-ENT-3Y. It's the MX (firewall/router) that has the two licenses. Lets say for example you bought an MX100. You would then either buy LIC-MX100-ENT-3Y (enterprise) or LIC-MX100-SEC-3Y (advanced security).

BrechtSchamp · ‎Jan 25 2019

In most cases the IP is just used for management purposes. Can't you use a temporary address, take out the old switch and change the IP after that? That change should be bumpless. Or do you have routes pointing to its IP address?

BrechtSchamp · ‎Jan 25 2019

@NolanHerring wrote: 5 minutes seems an awful long time for fail-over, so I would question that. Best thing to do is test it, but anytime I've disconnected WAN 1, WAN 2 almost instantly kicks in, and usually do not see a ping drop. Keep in mind that active flows will need to re-establish though. Not sure if things change for LTE but I would imagine maybe like 5 to 10 seconds. The 300 seconds is worst case and also only applies on a soft-fail. So when the MX doesn't detect a link down!

BrechtSchamp · ‎Jan 25 2019

Not sure, the 300 you read is the failover time between wired WAN connections, you read it here: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover or here: https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_SD-WAN

BrechtSchamp · ‎Jan 25 2019

I'm with Nolan. And Teleworker Z1 and Z3's also do L3.

BrechtSchamp · ‎Jan 25 2019

Any chance the syslog server puts it in there like that because it detects the source is it's own default gateway?

BrechtSchamp · ‎Jan 25 2019

The first one. The order number.

BrechtSchamp · ‎Jan 25 2019

The way I see it, every time a new TCP connection is established to a certain socket it's a new flow. In your example connection towards TCP 443 on a facebook server it will be counted as a flow. So per client using facebook the number of flows will definitely go up, but one client might also have multiple flows if they make multiple connections to facebook (multiple browser tabs for example). Whether the connections remain open or are closed each time depends on the application and type of flow. Google for example has a desktop app that keep certain flows open for the sync with Google Drive.

BrechtSchamp · ‎Jan 25 2019

I can't handle the awkwardness...

BrechtSchamp · ‎Jan 25 2019

What is a flow? A flow is defined by the firewall as one connection socket. Each port used in communication with each source-destination pair is one socket. For example, 10.1.1.1 on port 234 communicating with 10.2.2.2 on port 432 is one socket. Source: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Traffic_Analytics_and_the_Layer_7_Firewall

BrechtSchamp · ‎Jan 25 2019

From this reddit post I read mDNS is the culprit keeping it from working across subnets: https://www.reddit.com/r/Chromecast/comments/454fsi/chromecast_across_subnetsvlans_pfsense/ I have no Chromecast myself so I can't test it but you might be able to leverage the Bonjour Forwarding feature in the MX to make it work: https://documentation.meraki.com/MX/Other_Topics/Configuring_Bonjour_forwarding_for_the_MX_Security_Appliance Don't forget to also open up TCP 5556 and TCP 5558 from your Chromecast segment to your source device segment as mentioned in the Reddit. Hope that helps.

BrechtSchamp · ‎Jan 25 2019

As far as I know Site-to-site VPN tunnels on MX are always L3 tunneling. All branches will have their own subnet (and if they don't you'll need to contact Meraki support to have them enable VPN subnet translation. So you don't have to worry about broadcast traffic from one branch reaching all other branches. Do you need L3 multicast? Make sure you use either MX250's or MX450's (two or more for redundancy) as Concentrator/Hub to support those 1000 tunnels. And use Spoke mode on the Z's as Mesh mode would require too many tunnels.

About BrechtSchamp

BrechtSchamp

Community Record

Badges