Meraki

BrechtSchamp · ‎Nov 18 2019

Yes, plenty of people have their MX behind another device. As long as the device behaves as Meraki puts it "NAT-friendly" you will be fine. If it behaves NAT-unfriendly, the dashboard will let you know. Solutions for that issue are described here: https://documentation.meraki.com/MX/Site-to-site_VPN/Troubleshooting_VPN_Registration_for_Meraki_Auto_VPN#NAT_Type:_Unfriendly

BrechtSchamp · ‎Nov 17 2019

That's a standard setup for AutoVPN, so it should work yes.

BrechtSchamp · ‎Nov 17 2019

What makes you think it wouldn't work? Seems like a standard setup for AutoVPN?

BrechtSchamp · ‎Nov 17 2019

Well that call is showing clients that have used the network in the specified time interval. But if you don't specify a timespan yourself it defaults to 1 day, so it's showing you the users that have used the network in the last day. Try specifying a timespan that suits you. It's a value in seconds. In each of the results there's also a field called "status" that'll show "online" or "offline". So you could also use a large interval but filter out all the results that state "offline". E.g.

BrechtSchamp · ‎Nov 17 2019

I simply refuse to throw away things if I can fix them. I'm not always succesfull but very often I am. I love tinkering with electronics. A couple of examples: My surround audio receiver is a broken one that I bought and fixed. I had to replace 2 capacitors. Such an easy repair and very satisfying. The volume control on my desktop speakers is very prone to failure, had to repair it multiple times. Honestly, that volume know is bad design. But they've been lasting for much longer than they're meant to. Our handheld vacuum is also a broken one that I fixed. It was a simple mechanical fault with the on-off switch. Again, so simple and very satisfying. I recently bought two broken Nintendo GBA SP's. One had a broken charge port, the other had a faulty screen. I combined the two and have now a perfect retro-gaming machine. Back when I still lived at home I fixed my parents' electronics many times. Had to replace multiple screens on their smartphones. Replaced the motherboard in their TV. Fixed the hometrainer. It often takes very little effort to fix something. Give it a try! If you fail you've likely learned something new, and at least you tried. If you're not too sure, try to find a repair café near you and have someone help you. Also, if you really don't want to spend time on it, but you think something can be fixed, put it up for free on a craigslist or facebook marketplace for someone that likes repairing things. Once you throw it away it very likely won't be salvaged.

BrechtSchamp · ‎Nov 17 2019

As a presales guy, I'm less involved in day to day management of networks. For me the focus will therefore be to investigate the new technologies. Looking forward to exploring the new MS390's capabilities and the new object-based firewall feature that is coming soon. I've been meaning to look into Cisco's defense orchestrator too. Does anyone know the SKU for some extra time in a day?

BrechtSchamp · ‎Nov 17 2019

Hi Mike, The MX does not support Etherchannel. Nor does it do RSTP. That topology works because the switches support RSTP and will eliminate any loops. On the LAN-side no VIPs are used. Both need a physical IP address. One Virtual MAC address is used by both MX's though. That's described here: https://documentation.meraki.com/MX/Networks_and_Routing/NAT_HA_Failover_Behavior "In addition, the VRRP MAC address is shared by both MXs for LAN communication. Clients on the LAN will associate this shared MAC address with the MX's LAN IPs. As such, in the event of failover, LAN clients won't need to update their ARP table with a new MAC address." You can also find more info about that here: https://tools.ietf.org/html/rfc3768#section-7.3 . Take a look at section 7.3 and 8.2. OSPF support in MX is limited to exporting the AutoVPN routes towards the core router via OSPF. It will not learn routes from OSPF. For that you need to look into the MS line that has more OSPF support. Sources: https://documentation.meraki.com/MX/Site-to-site_VPN/Using_OSPF_to_Advertise_Remote_VPN_Subnets https://documentation.meraki.com/MS/Layer_3_Switching/MS_Layer_3_Switching_and_Routing https://documentation.meraki.com/MS/Layer_3_Switching/MS_OSPF_Overview

BrechtSchamp · ‎Nov 15 2019

Nice! Thanks for reporting back. Glad we could make it a pleasant experience!

BrechtSchamp · ‎Nov 14 2019

I think you can probably sleep on two ears with it blocked. But you could try nmap to see if that gives you more info.

BrechtSchamp · ‎Nov 14 2019

Mac addresses can be spoofed. Maybe that's what is going on?

BrechtSchamp · ‎Nov 14 2019

@Miyo360 wrote: Re your other comment about using L3 firewall, yes, I could use that but it affects the entire VPN subnet. Using that method it is not possible to filter by user/group. Indeed, that is a limitation of doing it that way. However I'm afraid your idea may not work either. See this note: Note: At this time, the MX does not support mapping group policies via Active Directory for users connecting through the Client VPN.

BrechtSchamp · ‎Nov 14 2019

Can't you use L3 firewall rules as described here: https://documentation.meraki.com/MX/Client_VPN/Restricting_Client_VPN_access_using_Layer_3_firewall_rules

BrechtSchamp · ‎Nov 12 2019

Hmm, that's a bummer. I don't expect any problems though when it comes to MS's, afaik there are no region-based limitations. For MR's the story would be different as the regulatory domain determines what channels can and can't be used. But for those there's also a procedure to change it. More info about that here: https://documentation.meraki.com/MR/Radio_Settings/MR_Wireless_Regulatory_Domains

BrechtSchamp · ‎Nov 12 2019

I see. The switch I brought from the US shows as BE in my inventory. I wonder if it will change when you add the switch to a network tied to another region. It may also be set when you add it to a network for the first time.

BrechtSchamp · ‎Nov 12 2019

No clue either. I tried getting access to the beta, but failed. I know @jdsilva has tried it out, maybe he knows more.

BrechtSchamp · ‎Nov 12 2019

Sorry, I don't speak Japanese but I'll respond in English. IPv6 support on MX is very limited at the moment: "Cisco Meraki security appliances can pass IPv6 traffic in pass-through mode, but no traffic analysis or manipulation is possible when using IPv6. At this time, IPv6 traffic cannot be routed or passed along a VPN tunnel." Source: https://documentation.meraki.com/zGeneral_Administration/Other_Topics/IPv6_Device_Compatibility To keep up-to-date about IPv6 support, subscribe to this topic: https://community.meraki.com/t5/Full-Stack-Network-Wide/IPv6-Meraki/m-p/53677

BrechtSchamp · ‎Nov 12 2019

I don't think so. I have brought back a Meraki MS from the US and I've used it in EU without issues. Where do you see that Country/Region?

BrechtSchamp · ‎Nov 1 2019

Oh and thanks to @MeredithW of course!

BrechtSchamp · ‎Nov 1 2019

Wow congrats all! I love how close all of our scores are! Well, except for @PhilipDAth of course who's always showing us the way. I'm with @jdsilva being surprised that this is your first motm @Nash . Great job @nealgs and @dsekely_brs . Well deserved!

BrechtSchamp · ‎Nov 1 2019

It falls back to DHCP when it can't reach its gateway. But I suppose that can't be the reason here?

BrechtSchamp · ‎Nov 1 2019

I believe the cause of the problem is your header "application.json". Try changing it to "application/json". Fyi, these are the headers I use: headers = { 'Accept': "*/*", 'Content-Type': "application/json", 'cache-control': "no-cache", 'X-Cisco-Meraki-API-Key': api_key }

BrechtSchamp · ‎Nov 1 2019

Hmm strange. It works fine for me. Can you share your full code? I'll try to debug it again.

BrechtSchamp · ‎Oct 31 2019

@Asavoy wrote: @BrechtSchamp - A Catalyst 9200L is way more switch than needed for an offline scenario, not to mention cost prohibitive and 24port is the smallest (I believe). @Tomek I would recommend a SG300-10MP or SG350-10MP switch if you need a managed swtich with some POE ports. Newer and much better than a 2960! Good point, I had disregarded the 8-port part. I was thinking of the regular 2960X.

BrechtSchamp · ‎Oct 31 2019

Yes. Well, in a way. In the headers there will be a link field, as shown below: In this example the "first" link brings you back to the beginning with startingAfter=a000000. The "next" link brings you to the next set of - in this case 3 - results with startingAfter=k70307.

BrechtSchamp · ‎Oct 31 2019

See also this excellent post by @CBurkhead explaining more in detail. https://community.meraki.com/t5/Developers-APIs/Retrieving-more-than-2-pages-of-1000-clients-from-GET-networks/m-p/61501/highlight/true#M1919

About BrechtSchamp

BrechtSchamp

Community Record

Badges