Meraki

BrandonS · ‎Apr 28 2021

Interesting. I would not expect an NMAP scan to cause a printer to print anything, but I suppose it is possible. Do you have any port forwarding on your firewall to the printer or anywhere else that could even allow outside access into your network? If not, I suppose it is possible someone inside the network was playing around and caused this unintentionally (or intentionally). Also- this is not really the right forum for Meraki Go. This is "regular" Meraki here. Meraki Go has it's own community: https://community.meraki.com/t5/Meraki-Go-Community/ct-p/go Best

BrandonS · ‎Apr 28 2021

I'd give that a very low, almost zero probability of any kind of attack. I would dig into the printer settings and web GUI to see what you can find about that print job and look through logs, etc. How certain are you that it isn't just a corrupt print job from one of your users?

BrandonS · ‎Apr 27 2021

@SNSGS I don't think I can estimate and I suppose it will depend on each environment and which messages you choose to send, but I do have dozens of devices sending what seems to be a lot of messages for only $10/mo. You can also filter out messages on the receiving end that will not count toward your quota. Best.

BrandonS · ‎Apr 21 2021

I appreciate the updates. This sounds like a painful troubleshooting gauntlet, but your methodology seems sound and you are breaking the problem down into pieces so should at least end up with a general idea where the trouble was/is.

BrandonS · ‎Apr 20 2021

Your description makes me think of a duplex mismatch. It could explain the 100mbps limit. If you can't control that on the ISP side maybe try a dumb gig switch as a test between your WAN port and the ISP handoff. If you can control it or have someone at the ISP check on their side you may be able to verify that port's negotiated status too.

BrandonS · ‎Apr 15 2021

I don't think there is any detailed documentation about it. It may be considered proprietary/secret to some degree. I have noticed odd descriptions there too, but one explanation can be things like VMWare or a Mac user running Parallels or VMWare Fusion so the same machine can actually connect to the network as two different hosts either at different times or even at the same time. There is little flag you can use to submit suggested corrections next to the names.

BrandonS · ‎Apr 14 2021

Depending on how urgent it is and if you are able to reboot clients and/or your MX I would suggest just making the DHCP lease time shorter like 1 hour. If you have significantly more clients that need to connect, you can also do as it suggests and open up your subnet to /23 or /22 to allow more clients on that subnet. Consider what other implication of allowing more clients are too though. Maybe you don't want 1000 guest clients on your network at once, for example.

BrandonS · ‎Apr 12 2021

I see. I think you can just ignore the port numbers and try adding those domains to your whitelist, but unless you already had them explicitly denied I am not sure that is going to solve it. You might also try whitelisting a couple of clients completely to test. If whitelisting the client fixes the issue you know you can somehow adjust content filters and firewall rules appropriately. If whitelisted clients still have the trouble then there must be another reason. I have a hunch this could be related to a session timeout and you can't modify those on Meraki. Maybe support can for you though.

BrandonS · ‎Apr 12 2021

You should typically not need to create any rules or do anything for RingCentral to work behind your MX84. What problem are you trying to solve? I think those notes are just to ensure your content filter is not blocking needed RingCentral domains and may not translate exactly to what you can configure on your MX.

BrandonS · ‎Apr 12 2021

There are some free and low cost options here: https://www.opendns.com/home-internet-security/ You enroll for free or paid and then tell it your public IP or IP block to filter against. To ensure users can’t bypass this DNS that you would serve via DHCP presumably, you could create firewall rules denying all DNS port 53/UDP except OpenDNS/Umbrella and that should do a good job complying with blocking adult content for a library. My generally understanding for the laws around this in the US is that you make a reasonable attempt such as this and are not liable for reporting or instances where people find a way around it.

BrandonS · ‎Apr 9 2021

If I understand correctly I have just done this exact thing for a customer on a small campus with fiber connecting two buildings and full stack Meraki. Building A had been primary and building B was just switches and wireless sharing building A internet via the fiber link. Then they added dedicated internet for building B so I added a MX and put that new internet in WAN 1. Then I created a dry VLAN on the switch and connected WAN 2 of building B MX into an access port with that VLAN (say VLAN 999). I made sure VLAN 999 was tagged and trunked back to building A. Back at building A an access port with VLAN 999 was plugged into another "regular" switch port that would provide DHCP and internet access). They did not care to do the opposite for building A to ever fail to building B, but I see no reason I could not have done that too. Does that track with what you are trying to do and make sense?

BrandonS · ‎Apr 8 2021

I see. Do you get some kind of bounce message via email or how do you know it is blocked? So your email server is local in your office/data center/shop? Maybe your public IP is on block lists or you DMARC and SPF is not setup correctly? You mentioned blocking the world due to attacks. What are you actually referring to there? Did you enable geographical IP blocking firewall rules and that causes the issue you are having?

BrandonS · ‎Apr 8 2021

That’s what I thought you said. That is not how email works though.. First, no one uses port 25 plaintext SMTP for email anymore and many ISP’s block it. Do you really need to connect to other mail servers around the world in plaintext port 25? I would never do that for any reason. Do you or someone on your team run your own local mail server? Are you having a particular issue sending email?

BrandonS · ‎Apr 8 2021

Just have a rule allowing port 25 above any rules denying it. But- I think you need to explain more what you are trying to accomplish because you shouldn’t need to do that.

BrandonS · ‎Apr 8 2021

>It should be using port 500. 514 I think. or it can be changed in Meraki side to match 15146

BrandonS · ‎Apr 8 2021

That seems to indicate the trouble is server side. Can you check anything else on the server? For a sanity check you could use papertrailapp.com it is a free cloud syslog server and pretty quick and easy to configure and test with, if nothing else.

BrandonS · ‎Apr 1 2021

I’m not sure the point of using pass through mode to accomplish this, but you can disable wireless and probably most importantly you want to disable DHCP. Keep in mind you will still need the license for it to operate too.

BrandonS · ‎Mar 22 2021

Negatory. Google “MX sizing guide” to see more detail of throughout on different models.

BrandonS · ‎Mar 18 2021

Hello. Can anyone help me understand why I would choose one of these over the other for use with a MR76 with the intention to expand coverage in a particular direction over a parking lot? They seem almost the same from the data sheets. And is it required to use two antenna per MR? And is it ok to point them in different directions or are they supposed to aim the same direction? Last, I am curious if anyone knows if external antennas cause the MR to draw more power or not. MA-ANT-25 vs. MA-ANT-27 Thanks in advance.

BrandonS · ‎Mar 11 2021

Definitely take this up with support. Both for not seeing anything in any logs and also why did it block that URL at all? It seems in a legit category that I assume you were not actively blocking? Or were you?

BrandonS · ‎Mar 10 2021

Just a guess, but try whitelisting the client or toggling AMP and/or IPS/IDS and content filtering off to see if it changes.

BrandonS · ‎Mar 10 2021

I don't think you can find what you are looking for in the dashboard. Remember ping does not work everywhere. I can't ping pp.ringcentral.com either. They must not allow it. Having a phone and doing a packet capture should help you isolate the trouble quickly though.

BrandonS · ‎Mar 1 2021

I just confirmed I can switch between various orgs on different shards. I am using SMS for 2FA though. Following to see what you find out.

BrandonS · ‎Feb 26 2021

Maybe the MR came up as a repeater? I have seen this happen with bad cables. It can get power, but not network.

BrandonS · ‎Feb 26 2021

I didn't notice, but some other services I use reported SMS issues today. Probably an upstream provider they use like Twilio, etc. had a problem.

About BrandonS

BrandonS

Brandon Svec

Community Record

Badges