Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About JohnT
JohnT
Getting noticed
Member since May 13, 2019
Monday
Community Record
56
Posts
38
Kudos
1
Solution
Badges
Jul 25 2021
8:25 PM
1 Kudo
16.10 lists this as a known issue. Due to a regression, MX appliances are not able to properly utilize dashboard auto-enrolled certificates for AnyConnect VPN connections. MX appliances will default to using a self-signed certificate, which will provide users connecting to the AnyConnect VPN service with a warning message about connecting to an untrusted server.
... View more
Jul 14 2021
9:22 AM
1 Kudo
I upgraded from 16.4 to 16.9 and now I'm getting an "Untrusted Server Blocked" error message when I try to connect with AnyConnect. The dynamic DNS name appears to be the same so I'm not sure what would cause that. Maybe something went sideways with the certificate during the upgrade. I'll probably open a support ticket.
... View more
Jun 4 2021
11:15 AM
This could be done with the Cisco ASA and AnyConnect, but I don't believe this feature exists on the Meraki implementation. I would also be curious if someone has found a workaround for this. It looks like certificate authentication may be the solution for this.
... View more
May 12 2021
11:57 AM
2 Kudos
You can go to https://haveibeenpwned.com/ to see if your account has been compromised somewhere.
... View more
Feb 15 2021
3:31 PM
Also keep in mind that failover WAN links create additional VPN tunnels, so a dual WAN link firewall may create up to 4 VPN tunnels per device when connecting to another dual WAN link MX. If you mesh with additional firewalls with dual WAN links the tunnels grow exponentially and it can quickly get out of control. I didn't consider this initially when I did my planning.
... View more
Feb 15 2021
8:57 AM
1 Kudo
Meraki provides the site to site VPN connection for my DR site so unfortunately it's my only option. However, I was able to solve the problem by changing the replication to transfer over port 443 instead of 80 to avoid packet inspection. I just thought it was such a strange and interesting problem and maybe someone could benefit from this post.
... View more
Feb 12 2021
3:15 PM
Hi Everyone, I'm wondering if anyone else has run across this problem before. I have been noticing that my Hyper-V servers have been triggering the Meraki IDS system periodically when they replicate over the WAN. When I inspected the packets that triggered the IDS it was full of what appeared to be some sort of malware. I was initially very nervous, but it just didn't seem to add up and probably wasn't what it appeared to be. After further investigation I discovered that the IDS alerts would trigger just a few minutes after a Windows Defender update on one of my virtual machines. The Windows Defender definition updates on a virtual machine would trigger replication, and then the Meraki IDS would intercept the replication packets over port 80 and block it. I decided to configure replication to happen over 443 instead of 80 and now the IDS alerts have stopped. Has anyone else seen this happen before? Meraki support says that they have never heard of this happening. I can't think I'm the only one.
... View more
Oct 28 2020
1:43 PM
3 Kudos
If you deploy the client with PowerShell you can use the -IdleDisconnectSeconds parameter to set the idle timeout in the client connection settings. You can also set this in the VPN network adapter settings on the Options tab. Just set the timeout where it says "Idle time before hanging up.". This only works on a PC.
... View more
Ahh, I think I missed the part where you can add multiple VLAN's with tags to an SSID. That might do the trick. I'll be onsite next week to test.
... View more
Jun 19 2020
10:47 AM
1 Kudo
Hi everyone, I'm trying to figure out the best way (if possible) to have a single SSID and multiple VLAN's for our point of sale systems. We already have 3 other SSID's so I'm trying to keep the SSID count low. We have two iPad based point of sale systems, one for Retail and one for our Restaurant. I tried setting up a group policy that would assign a VLAN to a device with bridge mode, but it doesn't seem to be working as expected. I'm either doing something that isn't possible, or I am misunderstanding how this should actually work. Does anyone have any experience getting something like this to work? Thanks all.
... View more
May 25 2020
1:53 PM
I always create a "Deny All" rule for my entire local subnet. This blocks all inter-vlan traffic. All inter-vlan traffic that I want to permit I put above that line, and everything else goes below it. In your case, you would put the ICMP rule above the Deny All rule. Here is an example:
... View more
Apr 9 2020
8:23 PM
4 Kudos
I found this video on YouTube that shows how the firewall objects will work. https://youtu.be/C3UKEjIJZzU Just give this to me now please. This feature will be life changing. I'm so tired of copying and pasting my rules into notepad.
... View more
Yes, purchasing certs would work, or you can add the Certificate Authority certificate to the trusted root certificate store in both domains by deploying them with group policy. Then the certificates would be trusted by all computers in both domains.
... View more
Mar 2 2020
10:00 AM
1 Kudo
I'm not sure this is possible. I solved this by authenticating the "user" AND the "mac address" of the device in radius. You may want to take a look at this thread: https://community.meraki.com/t5/Wireless-LAN/iOS-and-WPA2-with-Radius-Authentication/m-p/58804#M8834 -John
... View more
Dec 14 2019
5:26 PM
1 Kudo
It should never have been released to stable. It was terrible for me and I had all kinds of connectivity problems. SSID's disappearing and random disconnects.
... View more
Dec 10 2019
9:33 AM
I considered the MR55, but it's significantly more expensive than the MR45. The MR45 seemed to be on par spec wise (4x4) and price wise with the MR52, so that was my thought process. We don't push large amounts of data, but we do have a high amount of devices on our network so I'm more interested in the eventual density benefits of Wifi 6. My biggest concern is the production readiness of the MR45 and the last thing I want to do is introduce problems with our wifi. Has anyone deployed these and had no issues?
... View more
Dec 9 2019
3:26 PM
Hi Everyone, I'm looking to purchase some new access points for one of our locations and I can't decide between the MR45 and the MR52. Our location has a mixed environment of corporate, retail and restaurant. I've had great luck with the MR52, but the MR45's seem like a better long term investment with Wi-Fi 6 compatibility and new technology. However, I have read some forum posts about issues with HP laptops and I don't want to create any headaches for myself. Does anyone have any feedback they can offer on the MR45's?
... View more
Oct 15 2019
7:29 AM
1 Kudo
I opened a ticket with support and they said that I needed to reach out to my Meraki representative instead. I reached out to her and she said that she doesn't have this kind of access and will need to ask around. It sounds like they are not quite sure how to turn it on yet. I'm pretty excited for this feature. I watched the Q&A section and they said that the feature is in the dashboard and that there isn't a firmware requirement on the MX.
... View more
Sep 30 2019
1:35 PM
2 Kudos
@PhilipDAth All good points you make there. I think the next step is to head down to the remote location and just start unplugging and testing how this fail-over actually works. It sounds like ideally I would let the MX handle fail-over, but I'm unclear if that is an option. As soon as I do some testing I'll report back to the forum with my findings.
... View more
Sep 30 2019
11:55 AM
I'm in a different state, and I may be able to get down there towards the end of October to fully test how this all works. I was hoping to be prepared to test some scenarios when I get down there. 1. Yes, I believe this is how it is supposed to function. If the cable network goes down, the cellular takes over automatically. 2. Yes, if I connect the Cradlepoint directly to the MX it will effectively dismantle the Comcast setup. However, I don't know if they have anything upstream that would prevent this from working. 3. This was my thought as well, but I didn't know if there was some added benefit to doing this. 4. True. Although maybe someone has had a bad experience with the Comcast fail-over and would recommend against using it.
... View more
Sep 30 2019
11:39 AM
I just realized this got posted in the wrong forum. Can we get this moved. Thanks!
... View more
Sep 30 2019
11:36 AM
Hi Everyone We are opening a retail/restaurant space in Portland and I'm curious about everyone's thoughts on how to setup an MX67 with Comcast's Business cellular fail-over (Connection Pro) Essentially, they have a Cradlepoint added to the mix that provides the cellular fail-over. In our other locations we have done this with dual wired ISP's and this is the first one that we will be using cellular for backup. I could leave it "as is" and let Comcast handle the fail-over as designed. Although it makes me wonder if there is a better way to set this up. As I see it, here are my options. Please chime in if you have an opinion Don't mess with it, just plug in the Comcast WAN link to your MX67 and let them handle the fail-over as designed. Plug the CradlePoint into the 2nd WAN link and let the MX handle the failover Purchase a MX67C and remove the sim card from the CradlePoint and insert it into the MX67C Get rid of the Comcast cellular and purchase it from another provider, then set it up like #2 or #3 Thanks everyone! -John
... View more
- « Previous
-
- 1
- 2
- Next »
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 14577 | Aug 15 2019 9:55 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 5092 | |
| 4 | 5193 | |
| 4 | 13146 | |
| 3 | 9229 | |
| 3 | 14577 |
© 2024 Cisco Systems, Inc.
