Meraki

BrechtSchamp · ‎Apr 2 2019

Oh yeah! #swagtastic

BrechtSchamp · ‎Apr 2 2019

@AxelB wrote: Do you have access to the "add client" button on the "clients" page of the dashboard ? I do yes. What do you have in that network (MX, MR, MS?). I believe the functionality is only available when you have at least an MX or an MR or both in the network. I noticed that the button isn't there in a switch-only network. That's probably because the functionality was actually meant for the management of Group Policies. Which is only available in networks with and MX and/or an MR as well.

BrechtSchamp · ‎Apr 2 2019

It's normal. All my DHCP leases appear like that in the event log too. It just tells you that the MX has handed out IP address x to client y.

BrechtSchamp · ‎Apr 1 2019

I like that idea @PhilipDAth ! I want to nominate @MerakiDave , @Nick and @ww . Gratz again all!

BrechtSchamp · ‎Apr 1 2019

Okay, so it's a log line for a dhcp offer on vlan 4. That MAC address, do you recognize it? How is that device connected?

BrechtSchamp · ‎Apr 1 2019

I just tested it with Postman and it works. I have an environment setup where baseUrl and networkId are already setup (Info here: https://create.meraki.io/build/meraki-postman-collection-getting-started/). So the only thing I needed to do was double click the call in the collection so a new tab opens in postman for that call. Then below go to the "body" section and fill in the needed data ( "mac", "name", "devicePolicy"). In this case because I only wanted to change the name I set devicePolicy to "normal". This is what that looks like:

BrechtSchamp · ‎Apr 1 2019

Is there anything else on that log entry? Seems incomplete...

BrechtSchamp · ‎Apr 1 2019

The MX100 has a dedicated management interface to access the local web page, but I think you can also access the local webpage when you have L3 access to the LAN IP of the MX. For that you'll have to set " Remote device status pages" to "Enabled" in Network-Wide > General. The docs specify the following: You can toggle the LAN2 port between LAN and Internet, through Uplink configuration under the Local status tab. Source: https://documentation.meraki.com/MX/Installation_Guides/MX100_Installation_Guide So only LAN Port 2.

BrechtSchamp · ‎Mar 29 2019

Ooohhh I love this... Monty Python will be hard to beat. But it's short so maybe a playlist is needed. Maybe some of these: The Beatles - Help Eric Prydz - Call on me David Bowie - Space Oddity Adele - Hello Pink Floyd - Is there anybody out there Tenacious D - Best song in the world

BrechtSchamp · ‎Mar 26 2019

I have the same. I have an event for one of my wired clients in security center. But if I go to the normal event log in Network-wide > Event-log can't find that event either. Whatever I select as source in the drop-down (for switches or for security appliances). It's probably a bug as I would expect them to appear in the normal log as well... seeing as there are filter categories for them (e.g. "security blocked file" would be the relevant one for my event). I'd open a support ticket.

BrechtSchamp · ‎Mar 26 2019

@PhilipDAth You're thinking of the MR42 and above. Its datasheet mentions the reduced functionality. The MR33 only uses max 11W so 802.3af is sufficient.

BrechtSchamp · ‎Mar 26 2019

@Richard_W wrote: Any diff between MS210 and MS220? If the question was really that... the MS220 (non-compact) is EOL and didn't support stacking. MS210 is a current model and supports stacking. MS220 has the compact model mentioned in this topic, the MS210 doesn't, see below. Datasheets here: https://meraki.cisco.com/lib/pdf/meraki_datasheet_ms210.pdf https://meraki.cisco.com/lib/pdf/meraki_datasheet_ms_220_320_only.pdf However I assume your question was really whether there is a difference between MS120-8FP and MS220-8P. Then the answer is that the MS120-8FP is much more compact and that there's a lower PoE budget version of it called MS120-8LP. The MS220-8P is EOL. Datasheets: https://meraki.cisco.com/lib/pdf/meraki_datasheet_ms120_compact.pdf https://meraki.cisco.com/lib/pdf/meraki_datasheet_ms220_compact.pdf

BrechtSchamp · ‎Mar 26 2019

I think you're talking about the "Clear passcode" MDM command found under the device details of a device. Go to Systems Manager > Devices and click on the device of which you want to reset the password. Then scroll down to MDM commands and click the Clear passcode button.

BrechtSchamp · ‎Mar 26 2019

You need a standard PoE (802.3af) or better (so 802.3at works too) injector or switch. That TP-link would work.

BrechtSchamp · ‎Mar 25 2019

Gratz to the winners!

BrechtSchamp · ‎Mar 25 2019

Yes. Let's say in one of the sites you have a static route pointing to 172.18.0.0/24 with the gateway set to 10.8.44.25. In that list I showed you there should then be a 172.18.0.0/24 entry for that specific site. If the dropdown is set to yes, then all your sites should be able to use that route. If they have their own direct route over the local hardware it will be preferred due to the route preferences in the MX, refer to the link @ww shared.

BrechtSchamp · ‎Mar 25 2019

The first requirement is to have Meraki AutoVPN enabled in all your sites. Then in Security & SD-WAN > Site-to-site VPN of the network where you have setup the static route, you will see that destination subnet listed in the Local Networks. When you change the dropdown from "no" to "yes" for that entry, it will be announced inside the AutoVPN network. Now your other sites will be able to use the static route going through Meraki AutoVPN.

BrechtSchamp · ‎Mar 25 2019

That should work. Multimode uses 850nm light normally. Best to check with your ISP what wavelength they're using and make sure that it is indeed multimode. If the link is long they would normally go for single mode rather than multimode. The basic rule of thumb is multimode within buildings and single mode in between buildings.

BrechtSchamp · ‎Mar 25 2019

Someone here is using the MX itself as medium converter, but the setup is a little dirty. It's basically that what @PhilipDAth describes in the topic I mentioned above: https://github.com/swiatecki/Networking/blob/master/MX84Fiber/MX84FiberUplink.md Simplest would be a medium converter.

BrechtSchamp · ‎Mar 25 2019

See this topic. https://community.meraki.com/t5/Security-SD-WAN/MX84-Internet-ports-GbE-SFP-option/td-p/5499

BrechtSchamp · ‎Mar 24 2019

Could also be a mismatch somewhere. Make sure that all equipment on that path is spec'd identically. I.e. if you're using multimode OM4, make sure the SFPs are multimode on both ends and make sure that the patch cable is multimode (ideally OM4) too. Similarly if you're using single mode, everything should be single mode. In your case it's the latter so everything should be single mode. Lastly, it could also be that you're near or over the max distance for that cable/speed. Take a look at the distances mentioned here: https://meraki.cisco.com/lib/pdf/meraki_datasheet_sfp.pdf

BrechtSchamp · ‎Mar 24 2019

As @NolanHerring said. Likely a bad or dirty SFP, bad or dirty fiber or an overly bent fiber patch cable (they have a maximum bend radius).

BrechtSchamp · ‎Mar 24 2019

Have you tried doing it from the view all networks page with the pencil icon next to the name in the list?

BrechtSchamp · ‎Mar 23 2019

All right, I think I figured it out. The remaining issue was the depth of the JSON conversion. Here's the working code: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $api_key = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX' $header = @{ "X-Cisco-Meraki-API-Key" = $api_key "Content-Type" = 'application/json' } $orgID = 'XXXXXXXXXXXXXXXXXXXXXXXXX' $api = @{ "endpoint" = 'https://nXXX.meraki.com/api/v0' } $api.url = '/organizations/' + $orgID + '/thirdPartyVPNPeers' $uri = $api.endpoint + $api.url $parms =@( [ordered]@{ name = "My peer 2" publicIp = "123.123.123.1" privateSubnets = @( "192.168.13.0/24" ) secret = "asdf1234" ipsecPolicies = [ordered]@{ ikeCipherAlgo = @( "tripledes" ) ikeAuthAlgo = @( "sha1" ) ikeDiffieHellmanGroup = @( "group2" ) ikeLifetime = "28800" childCipherAlgo = @( "aes128" ) childAuthAlgo = @( "sha1" ) childPfsGroup = @( "disabled" ) childLifetime = "28800" } } ) $json = ConvertTo-Json -Depth 5 -InputObject $parms $change = Invoke-RestMethod -Method Put -Uri $uri -Body $json -Headers $header -Verbose $change Hope that helps.

BrechtSchamp · ‎Mar 23 2019

I've been analyzing it a bit and I think apart from what @CN mentioned about the child ciphers I think you also need an array at the outermost level: @( [ordered]@{ name = "... } ) I also noticed that for me postman puts not only the child ipsecPolicies in brackets but all of them except the 2 lifetime ones. I also noticed that there's a difference in behavior between: $json = $parms | ConvertTo-Json $json = ConvertTo-Json -InputObject $parms I couldn't get it to work with powershell myself either, I'm still experimenting...

About BrechtSchamp

BrechtSchamp

Community Record

Badges