Meraki

BrandonS · ‎Dec 7 2018

Is it claimed and added to a network?

BrandonS · ‎Dec 6 2018

@PhilipDAth wrote: That is how I would do it. Thanks for the endorsement. I am not sure why I felt there might be some better way.. I guess a media converter and a cheap copper switch might be another option, but I wouldn't propose it for this particular client.

BrandonS · ‎Dec 6 2018

I have a client with full stack Meraki that has a requirement to share their SM fiber internet handoff with another business unit that wishes to use their own separate firewall with a direct, public IP. My first thought is the only way to do this is with a "breakout switch" in between the fiber handoff the rest of the gear or do it using available ports on their switch stack in a common VLAN. So, I might get 2 new SMF SFP modules and put them in SFP on a switch and create a common VLAN with those two ports and a third copper port (for the other business handoff). Then I can patch the internet handoff fiber to one of those ports and the other fiber port back to the WAN port of the MX. I would keep the IP I have for the MX and let the other folks use an available one from the block and patch into the copper port on that common VLAN. Is there another or better way to do this I am not thinking of? Thanks

BrandonS · ‎Dec 5 2018

SD-WAN is simply a term to describe dynamic and configurable network access via multiple WAN (internet) links. A common example would be to have two different internet service providers connected to a Meraki MX appliance and configure the MX to send voice traffic on the link with the lowest latency, jitter and packet loss. You will be able to monitor the links in the dashboard and see when the MX has made decisions dynamically to route voice traffic over either link. The links may also be site-to-site VPN links to other branches or locations. Many organizations are choosing to move away from expensive dedicated WAN links to SD-WAN since the performance can be similar and the price less. Here is simple diagram depicting two MX appliances each with two internet connections and site to site VPN:

BrandonS · ‎Nov 22 2018

Yes and did you see this? https://meraki.cisco.com/blog/2018/11/prepare-for-ax-wireless-with-meraki-switches/

BrandonS · ‎Nov 16 2018

Tell them if they are caught using hangouts they will be written up and can lose their job 😉 Seriously though, blocking applications like that can be very difficult because they use so many different domains and IP blocks to operate. And whatever they use now could change without notice. If you really want to try to do this at the Meraki level your best bet is probably to run packet captures while using Hangouts and see what common URL's and IP addresses you may be able to restrict without breaking other services. Good luck.

BrandonS · ‎Nov 14 2018

Interesting idea, but I feel like it would not work. How would you connect the antennas? One side of MR has 2x 5Ghz connectors and the other has 2x 2.4Ghz. Would you cross them so each antenna connects to both? I guess you could try, but I would not expect it to work..

BrandonS · ‎Nov 7 2018

Actually, based on "Also if Z1 is literally just powered on, no LAN or internet cables attached it will reboot bang on 16 mins 45 seconds. I think maybe 2 or 3 times it's rebooted around 14 to 15 mins. " I think you have an easy case to get a replacement shipped out from Meraki.

BrandonS · ‎Nov 7 2018

I suggest asking your IT support nicely to escalate this to Cisco Meraki support. If Meraki support does not have any good ideas they will normally send out a replacement without much hassle. I manage plenty of Meraki gear and have never heard of anything like the particular issue you describe. I would guess it is either the Z1 is bad or there is some rare compatibility issue with your ISP gear. Replacing the Z1 should help determine where to look next if it does not solve the issue.

BrandonS · ‎Nov 7 2018

@ph0t0g wrote: Oh, OK. So it's just E.T. phoning home. Thx Haha. Does anyone here remember ROLM? I used to have a bumper sticker back in the 80's that said, "E.T. phone ROLM"

BrandonS · ‎Nov 7 2018

Why is the title of your post, "Client VPN split tunneling?" I have split combined networks and combined them again and not seen any service interruption or other trouble. I did this most recently to get rid of an old demo MC network I had in one of my combined networks. If anything, you *might* lose historical data like client usage. If that is important, I would call support or research more to find out.

BrandonS · ‎Nov 7 2018

I am pretty sure that is just part of the normal connectivity testing al Meraki products do. This is for MX, but probably similar for MS, etc. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover

BrandonS · ‎Nov 6 2018

Thanks for the great replies! I think the last thing I am wondering is if I need to consider anything for my single switch. I can just plug LAN 1 on each MX into my single switch instead of the two like diagramed here? Or do I want a VLAN for the connectivity between MX also? That seems the same as a direct cable though.. And maybe I want an MS120-8 on the WAN side with two VLANs (one for each ISP between their handoff and the MX's). It looks like a need a total of 3 IP addresses from each ISP, right? Going with number 1-4 on the diagram Comcast: 1: 1.1.1.1, 3: 1.1.1.2 at&t: 2: 2.2.2.1 4: 2.2.2.2 Then also two VIPs like 1.1.1.3 and 2.2.2.3? Thanks again.

BrandonS · ‎Nov 6 2018

Can someone help me clear up some doubts about how to configure this? I have read https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair and also https://www.willette.works/mx-warm-spare/ 1. Is it not good to connect the MX's directly to each other anymore? Do I need to care why? 2. Do I need 2 switches also? I prefer to have one switch only and only have HA for if one internet goes down or one MX fails. For this instance I am not concerned about 'core' switch failure. 3. How do I handle client VPN if one internet fails? Users need to know two different IP's to connect to potentially? 4. This customer uses public IP whitelisting to access some cloud services. I am not clear on the VIP configuration. I will have one VIP from each ISP that would need to be whitelisted by the service providers I guess? Thanks for any help. I have been working with Meraki for some time, but not yet configured HA.

BrandonS · ‎Nov 2 2018

Yeah. Since I posted this I have become less and less concerned :). I just wanted to get all switch port configuration and tags, names, etc. done in advance and I feel I still can. I will just save the step of creating the stack in the dashboard for after the gear is physically installed. I think I am assuming correctly that none of the configuration I do in advance on the switches will change when I put them in a stack.

BrandonS · ‎Nov 2 2018

Previously I have always followed the stacking guide and plugged in each switch individually to connect to the dashboard first and then power them down, connect cables, restart with a single uplink and configure it, but I have a project that needs to move fast and was thinking to try configuring it all before the gear arrives on site. It seems possible, but I am not sure if I should bother trying or not. Has anyone here tried this or have any thoughts? Thanks.

BrandonS · ‎Oct 30 2018

And note that Threat Grid is not a Meraki product. You need to purchase it as a traditional Cisco item and then there is an integration with Meraki. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Grid_Integration

BrandonS · ‎Oct 22 2018

I would try a new SSID with default settings for testing. Then change one thing at a time to see if it breaks again. Did you enable 802.11r or change the RF profile at all?

BrandonS · ‎Oct 21 2018

What settings do you have on the Meraki side? It sounds like you chose something Apple doesn't like.

BrandonS · ‎Oct 16 2018

Here is some info about the enhanced service levels. I am a reseller and have never sold these yet, but I can see how some customers may want them: https://meraki.cisco.com/lib/pdf/meraki_now_solution_guide.pdf

BrandonS · ‎Oct 16 2018

MR Enterprise license is required to operate the MR and includes 24/7 phone support and NBD hardware replacement. You don't need additional services, but they are available if you want better response time and hardware turnaround.

BrandonS · ‎Oct 15 2018

a) LIC-MS425-32-10YR b) LIC-MS350-24P-10YR c) LIC-MS350-48FP-10YR Let me know if you want a price too 🙂

BrandonS · ‎Oct 12 2018

I decided to try it out and got it working. Where are you having trouble? My biggest issue was messing with Windows firewall to allow connection to the installed collector.

BrandonS · ‎Oct 10 2018

That's true about limited alerts. Assuming you have the license and IPS/IDS and AMP enabled you can send security events to your own syslog server or a cloud one like papertrailapp.com. That is what I do- From there you can trigger email, SMS alerts or hook into Slack, Glip, etc.

BrandonS · ‎Oct 10 2018

You probably don't have the security license or if you do, didn't enable it. Try that and check again.

About BrandonS

BrandonS

Brandon Svec

Community Record

Badges