Meraki

Adam · ‎Sep 24 2018

With any wireless solution, there are momentary drops when you roam and move from one AP to another. Has the application been able to roam between other types of APs without problems? Does a temporary loss in connectivity cause the application to crash rather than waiting to re-establish connection?

Adam · ‎Sep 21 2018

Was the new account he created a generic email address (gmail, yahoo etc) or one in your environment/domain?

Adam · ‎Sep 21 2018

If you use the postman application you can test your API calls and it also allows you to generate HTTP or PHP code to use on a website. Just keep in mind, there is typically some dependency requirements for those.

Adam · ‎Sep 21 2018

Thanks for the update. I'm glad to hear you are making some progress. The 'top sites' with categories will probably resolve the issue. I'm willing to bet that was the cause. We experienced the same thing. Very intermittent page load times with full list since it had to do the site lookups every time (you'd think it'd cache the sites visited). But keep in mind, you'll have much less protection with 'top sites' vs 'full list'.

Adam · ‎Sep 20 2018

One other thing worth checking is your content filter settings. See if it is set to 'Top Sites' or 'Full'. If 'Full' just try 'Top Sites' to see if it makes a difference. That resolved it for us once. The only other time we had an issue like that was when we had an undersized device for the site. Note: This assumes the DNS and uplink stuff has all been tested/verified as other members have pointed out above.

Adam · ‎Sep 20 2018

The IP information on the switch is really only used to so the device can talk to the cloud. Just curious what your motivation is in having the switch IP isolated?

Adam · ‎Sep 20 2018

I also dealt with this once. Two pieces of advice worth checking: 1. Double check you didn't mix up the gateway and subnet mask in the wrong boxes. I've done it. 2. Sometimes it takes a bit for the static IP to stick. Especially if the devices has been rebooted a lot. I had one that didn't take it until overnight. Lastly as said by some of the other guys here. Double check the port has the right vlan and the upstream configuration is the same.

Adam · ‎Sep 17 2018

Agreed some additional details would be useful. What scenario are you wanting to protect against?

Adam · ‎Sep 17 2018

Based on the density potentially needed and this sizing article I'd go with 18-20 (MR52 or MR53 APs), Auto RF, and Auto Power Reduction. Depending on the amount of bandwidth needed they may want to set per client bandwidth restrictions as well with bursting. If needed, add a Meraki Gnome to the environment to minimize any wireless signal bouncing. To address the performance of business-critical applications I'd enable Traffic Shaping prioritization. Security Appliance>Traffic Shaping. In the definition section select things like VPN, Email, and Productivity and set them to High priority. To prevent vendors and attendees from setting up their own hotspots that may interfere with the venue’s networks I'd enable Air Marshal. Wireless>Air Marshal and select 'Block clients from connecting to rogue SSIDs by default' Access to the wireless metrics can be provided through the Wireless Health console.

Adam · ‎Sep 14 2018

I'm not an expert on how SMB works but many multicast style devices will only search the subnet they are in based on their subnet mask and gateway. Can you make it scan to a statically defined share instead of SMB?

Adam · ‎Sep 14 2018

Postman just uses the API so possibly a difference in the code/calls you are using? You can generate code from Postman to compare and verify.

Adam · ‎Sep 14 2018

In our experience with PTZ, they are inevitably looking in the wrong direction or are left in the wrong direction of where they should be recording. Directional cameras have been far more reliable for us in catching incidents in critical areas. And you are correct, Meraki doesn't have a PTZ offering yet.

Adam · ‎Sep 14 2018

In the alerts that @BrandonS mentioned you can also set an email address that is your phone's text address. Most cell carriers have this. example 5551234567@txt.att.net. I do this for a few critical devices in my network.

Adam · ‎Sep 13 2018

Nice we can use this feature in a few spots for sure.

Adam · ‎Sep 12 2018

You guys have given me some potential ideas. In the meantime, I instituted some traffic shaping to minimize the amount of bandwidth the updates can consume. But the whole thing got me thinking about the difficulty of this type of scenario.

Adam · ‎Sep 12 2018

Good to hear it is working again. Must have been a serverside issue.

Adam · ‎Sep 12 2018

Wouldn't really help. Our WAN connection is private MPLS so the WSUS would still have to live at our colocation center. In this case, I'm wanting to send the windows update traffic over the slow DSL connection at the site.

Adam · ‎Sep 12 2018

I can't seem to find a way to route Windows Update traffic download.windowsupdate.com to a specific WAN interface. It looks like internet flow preferences require typing in the IP or subnet as a destination. Any other ideas options?

Adam · ‎Sep 12 2018

+1 for what @PhilipDAth said. RADIUS would be your easiest route. You can add NPS to a windows server and configure 802.1x to send authorized devices to a trusted VLAN and non authorized devices to a guest VLAN on the Meraki side.

Adam · ‎Sep 12 2018

Which one is the MX in the diagram? Anyways I'd recommend starting a ping to 74.95.183.209 from the outside. Then you'll need to run some captures. First on the outside and inside interface of your Firewall to make sure the pings are getting there and through. Then on the outside (internet) interface of your MX. My guess is that the traffic isn't making isn't routing properly on that 1921 as expected.

Adam · ‎Sep 11 2018

I'm not familiar with Forescout so maybe others can chime in on that. But with a standard 802.1x Windows NPS Meraki deployment it can be configured to drop the computer into a guest VLAN if it fails 802.1x so it is isolated.

Adam · ‎Sep 11 2018

It can come up but be unreliable if things like the Phase 1, Phase 2 lifetimes don't match etc. Have you checked all of those things to verify they match on both sides?

Adam · ‎Sep 11 2018

Have you looked through Network Wide>Event Log and change it to the security appliance and then filtered for the VPN related event types to see if there are any clues in there?

Adam · ‎Sep 11 2018

Nice feature, seems like it is still being tweaked. https://community.meraki.com/t5/Switching/Native-VLAN-Mismatch/m-p/27650/highlight/true#M2278

Adam · ‎Sep 11 2018

So you have an MX firewall/router but no Meraki switches? What kind of switches do you have or are the clients only connected directly to the MX? Explain a little about your topology and I can advise.

About Adam

Adam

Community Record

Badges