Meraki

Kamome · ‎May 7 2020

There's some solution you can try. 1. Use USB LTE Modem If ISR's 4G card uses SIM, you can use USB LTE modem with that SIM. Every MX device have USB port for that purpose. But you must use compatible modems. Here's the list. https://documentation.meraki.com/MX/Cellular/3G%2F%2F4G_Cellular_Failover_with_USB_Modems 2. Use MX67C/MX68CW MX67C and MX68CW have integrated cellular module, so you can just throw SIM into MX's SIM slot. No need for additional USB modem. First, make sure that your carrier's LTE frequency is supported by MX. Although your carrier is not in tested carrier list, it's possible to use LTE if carrier's frequency is in the list. https://documentation.meraki.com/MX/MX_Overviews_and_Specifications/MX67_and_MX68_Overview_and_Specifications#Cellular_Interface 3. Use LTE router There are some LTE routers have wired LAN ports like these:https://www.amazon.com/NETGEAR-Modem-Gigabit-Ethernet-Ports/dp/B01MQRHQYT. You can use these kind of LTE router to connect cellular network as MX's wired WAN2. I have several sites with this configuration. 4. Use Meraki MG21. It's almost like third option, but you can configure and administrate with Meraki dashboard!

Kamome · ‎Apr 29 2020

You can add static route to hub Meraki device. https://documentation.meraki.com/MX/Networks_and_Routing/MX_Addressing_and_VLANs

Kamome · ‎Apr 29 2020

First, could you tell more specific configuration? I can't understand " i am getting Relay DHCP to another Server & where i gave DHCP server IP & when i gave DHCP server IP". Usually, "The DHCP option must be a valid integer." means you gave incorrect address or format. Second, yes. You need to add DHCP subnet to AutoVPN tunnel to relay DHCP request to that server.

Kamome · ‎Apr 24 2020

If you want to force VPN traffic to certain WAN link, you can try to create SD-WAN Policy. Under VPN traffic, set filter as custom filter, and set protocol/source/destination as Any. This means all VPN traffic. Set preferred uplink as WAN 1, and failover is uplink down With this settings, all VPN traffic will use WAN 1 until it goes down. Plus, "Do not create VPN tunnels over the secondary uplink unless the primary uplink fails." is for Active-Active VPN tunnel setting, and it doesn't do anything with load balancing.

Kamome · ‎Apr 13 2020

such clean much satisfaction wow

Kamome · ‎Feb 20 2020

I have one organization with per-device license, and other one is co-termination. Customer of per-device organization demanded to me to move some of their license to co-termination organization. I know that I cannot move from per-device to co-termination on my own, but if I open case and request to do that, is it possible?

Kamome · ‎Jan 27 2020

Have you tried in this form? (Without braces in API key) curl -v -L -H 'X-Cisco-Meraki-API-Key: 61f0c114336be2a5828f9e95388dca8d0f91178b' -X GET -H 'Content-Type: application/json' 'https://api.meraki.com/api/v0/organizations'

Kamome · ‎Jan 21 2020

When I was reading through Meraki syslog documentations, I found this list. https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples According to list, only MS can generates VRRP change log via syslog. But in the Dashboard's Event Log, I can see MX VRRP change log as well. So, does MX generates VRRP change log via syslog too?

Kamome · ‎Jan 8 2020

vMX and public cloud. I didn't do cloud related work in last few years, but now I have to do it. Already got installed vMX on AWS and testing now!

Kamome · ‎Dec 11 2019

Access to Spare device via interlink or downlink. Most of my customers are concerned about device accessibility when spare device's uplink is gone bad. For now, there is no way to access spare device's local status page without Internet connection. But sometimes, I have to access to it in order to check status and change uplink configuration to bring it back up.

Kamome · ‎Dec 10 2019

I'm using Vivaldi browser. It's based on Chromium. I had same slowdown with MS Edge Dev, also based on Chromium.

Kamome · ‎Dec 10 2019

I was in n90-ish for a long time, but for now, I'm in n25.

Kamome · ‎Dec 9 2019

I've using Meraki dashboard for about 3 years, but in last few months, dashboard feels quite slow than usual. From login page to accessing each configuration page is slow, and today, one of my site is struggling to get configuration from cloud. That site doesn't have any kind of issue in the past. Does anybody feel similar with me? I'm in Asian region, so I suspect that there can be kinda pattern to this case.

Kamome · ‎Dec 9 2019

@ww It's because of customer's information security policy. They want to observe every traffic -including site's Internet traffic- and must goes through center gateway in order to pass IPS, WAF and other do-dads.

Kamome · ‎Dec 9 2019

@PhilipDAth Site1 and 2 are MX65 appliance and connected local ISP's Internet.

Kamome · ‎Dec 9 2019

I have an organization with routed hub and full-tunnel configuration. This one works well until one of network have to use split network. So, I unchecked Default route option in Site-to-Site VPN configuration. But it still works as full-tunnel VPN. Site1 : Default Route -> Hub Site2 : Default Route -> WAN Uplink Center MX : Default(0.0.0.0/0), Internal Summary -> Center L3 (In VPN Yes) I can understand why this is happening. Every site that participates in VPN network always gets default route from Center MX, and it overwrites site's default WAN route despite of Default route is unchecked because AutoVPN route's priority is higher. But problem starts here. Based on my prior knowledge, I excluded 0.0.0.0/0 from Center MX to not to advertise it via AutoVPN, so it won't take over default route when site's Default route setting is disabled. Site1 : Default Route -> Hub Site2 : Default Route -> WAN Uplink Center MX : Default(0.0.0.0/0), Internal Summary -> Center L3 (In VPN No) As soon as I saved this configuration, Site1(Default route is checked) cannot use Internet. Only able to use advertised summary network. Site2(Default route is unchecked) is okay. So, I've captured packet from Center MX, and traffic from Site1 is coming from Site-to-Site VPN interface, but reply traffic is going towards LAN interface. Therefore, it seems that "VPN Participants" option in Site-to-Site VPN decides not only "selects which network/route will be advertised via VPN" also "decides which traffic is VPN traffic". Why this is happening?

Kamome · ‎Dec 8 2019

Meraki doesn't support authentication with Azure AD directly for now. But you can use intermediate NPS server which joined to Azure AD. It seems your university uses MS Azure, so I think that create Windows server that runs NPS service as VM will do the trick.

Kamome · ‎Dec 8 2019

C2960-24PC-L have 370W of PoE budget. But it only supports 802.3af, which only can push 15W per port maximum. https://www.cisco.com/c/en/us/support/switches/catalyst-2960-24pc-l-switch/model.html#~tab-documents https://en.wikipedia.org/wiki/Power_over_Ethernet#Standard_implementation On the other hand, MR42 consumes 20W at peak, so it requires 802.3at which can push up to 30W per port. https://meraki.cisco.com/products/wireless/mr42#tech-specs Therefore, I think you have to use one of these methods: use external DC power, buy PoE injector supports 802.3at, or buy new PoE switch supports 802.3at.

Kamome · ‎Dec 5 2019

Also, 123 is for NTP, and 161 is for SNMP. If you don't use SNMP, you can disable it. But need to open NTP in order to MX can keep correct time.

Kamome · ‎Dec 5 2019

First, I recommend to check this article from Meraki document : https://documentation.meraki.com/MR/Monitoring_and_Reporting/Low_Power_Mode According to article, it seems your PoE switch doesn't support 802.3at(PoE+), therefore PoE just couldn't push more power to AP. Second, if you use external DC power, AP will use only DC power, and tells to switch that it doesn't need PoE. So, you cannot use PoE and DC power simultaneously.

Kamome · ‎Oct 29 2019

I have an organization that using MAC whitelist to control company's Android tablets. But, recently some client got splash screen even though it's already whitlisted. When such client pops up, I have to switch it to normal one and add whitelist again to work properly. So, I searched high and low, and found this thread. https://community.meraki.com/t5/Wireless-LAN/WIFI-MAC-Whitelisting-breaks/m-p/35463 It was same situation with me. Some replys suggests to use Group Policy, and sure I did. But even clients with Group Policy still have same problem - users arbitrary get splash screen even it's in whitelist or group plicy with bypass splash. And end of thread, it's because of Meraki's backend problem. But when I asked about it to Meraki TAC, they only says "It's not exact on which particular issue, case or bug identification number. What I can suggest is if to call us immediately when issue occurs so we can trace where is the issue is happening." So, it's been 7 months after last reply. Does anybody knows about breaking MAC whitelisting and Group Policy situation's updates?

Kamome · ‎Oct 23 2019

I'm using old Buffalo 54G router with dd-wrt firmware as wireless bridge to connect my old HP laser printer equipped with wired Jetdirect addon into home wireless network. If you have some old wireless router supports dd-wrt, how about recycle it as useful bridge? - Supported devices : https://dd-wrt.com/support/router-database/ (Search your router model name) - Tutorial for wireless bridge : https://forum.dd-wrt.com/wiki/index.php/Wireless_Bridge

Kamome · ‎Sep 26 2019

I have configured three SSIDs - one for employee's computer, one for employee's mobile devices, and last one for salesperson's tablets. SSID for table was configured with Meraki RADIUS login page to prevent unauthorized connections. And for authorized tablets, I've added these as whitelisted client with tablet's MAC address so it can bypass access control and connect to network directly. Everyting works fine untill today. One of customer called me that some of their whitelisted table cannot use network because they encounterd Meraki RADIUS login page - which is not suppposed to do that for whitelisted tablets. So, I've created new group policy to bypass splach screen and added problematic tablets' MAC address into it. After that, everyting is working fine as it should. But I'm still cannot understand why suddenly whitelisted client got splashpage, and why just few of these are affected. Is anybody experienced whitelisted not functioning?

Kamome · ‎Aug 5 2019

There is built-in Whitelisted group and you can add client to it through Clients page. https://documentation.meraki.com/MR/Group_Policies_and_Blacklisting/Blocking_and_Whitelisting_Clients If a client is whitelisted, it will ignore access controls, and always allow to connect network.

Kamome · ‎Aug 5 2019

You can control MAC without RADIUS, but it's little complicated. I'm using sign-on splash page with Meraki authentication. With this configuration, nobody can login to SSID because I didn't make any accounts for normal users(only network admin have Meraki account). And if I want to allow a client to use that SSID, I've added client's MAC as whitelisted client, so client can override SSID's authentication settings thus can use SSID. But if you use this method, you can add less than 2000 clients because of limitation of Meraki's whitelisted client count.

About Kamome

Kamome

Jinuk Jung

Community Record

Badges