Meraki

CptnCrnch · ‎Aug 19 2020

Perfect explanation, thanks for the update @GIdenJoe! Very helpful as a future reference. 👍

CptnCrnch · ‎Aug 19 2020

"Secret" is the shared secret that has to be the same on the RADIUS server and your Dashboard. To be able to use it, your MX has to be configured as RADIUS client on that server. The secret has to be configured in this step.

CptnCrnch · ‎Aug 19 2020

@Ahoste: Are you referring to this documentation? https://meraki.cisco.com/lib/pdf/meraki_datasheet_sfp.pdf

CptnCrnch · ‎Aug 18 2020

Have you enabled the Bonjour Gateway on your MR36? https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/Bonjour_Forwarding

CptnCrnch · ‎Aug 18 2020

@Johan_Oosterwaa: Please take a look at https://tools.ietf.org/html/rfc7170 (Tunnel Extensible Authentication Protocol (TEAP) Version 1) or https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol#Tunnel_Extensible_Authentication_Protocol_(TEAP) as a starting point. 🙂 Also, the link provided to the blog entry about bow it's configured might help further. Btw. and again: Windows is the only OS that differentiates machine from user authentication.

CptnCrnch · ‎Aug 18 2020

Netflow timeouts are not dependent on the platform you're sending Flows from. It mostly depends on what you're trying to achieve with it and what your Flow destination is able to make out of that setting. At least for Stealthwatch, a 60 second timeout is considered "best practice". Guess you should be good to go with that for PRTG too.

CptnCrnch · ‎Aug 18 2020

Exactly @PhilipDAth. Windows 10 2004 is the first edition that supports TEAP. Btw. you can leverage certificate based authentication for machine and user. 😉

CptnCrnch · ‎Aug 18 2020

@PhilipDAth as we're in the Wirless corner, I didn't think about L2TP over IPSec. 😉 TEAP on the other hand is already there, I was able to fiddle around with it last year in October: https://www.ise-support.com/2020/05/29/using-teap-for-eap-chaining/ As Windows is the only OS that seperates User from Machine based authentication, there's no need to dream further. 😉

CptnCrnch · ‎Aug 17 2020

That‘s not something that would be Meraki-specific. It mostly depends on your RADIUS and endpoint infrastructure: Cisco ISE would allow you to leverage Anyconnect Network Access Manager and EAP chaining („propietary„ solution) Another option is using Cisco ISE other with Win10 2004 and TEAP (the new standard for EAP chaining)

CptnCrnch · ‎Aug 16 2020

I don‘t think that Forti VPN client supports L2TP. At least the config looks like „standard“ IPSec.

CptnCrnch · ‎Aug 14 2020

Smooth upgrade on MR42 and MR45 so far! 😎

CptnCrnch · ‎Aug 13 2020

Just call support, this should be solved within minutes.

CptnCrnch · ‎Aug 13 2020

SIG is (simply speaking) the "new hotness": You don't only get DNS based security but will be able to use Umbrella as dedicated Web proxy that goes beyond the possibilities of the current "Intelligent Proxy". Apart from that, you're able to use Umbrella as L3-firewall (L7 somewhere in the future). https://umbrella.cisco.com/trends-threats/secure-internet-gateway

CptnCrnch · ‎Aug 13 2020

@PhilipDAth wrote: You can use Umbrella with a Z3. It supports native integration via the API. For the "legacy" DNS stuff: yes. SIG is not included there, so that'S why I was specifically asking about that.

CptnCrnch · ‎Aug 13 2020

I hear ya...Cisco WLC != Cisco Meraki AP though. 😉 Guess we'll see many other interesting facts if the discussion continues, but as already written: I don't think this will bring you further with that request to be allowed to use that. 😉 I don't know, possibly Meraki is really using this space (because it's reserved) for some kind of internal stuff. At least I'd be really curious to get some deeper insight into that. 🙂

CptnCrnch · ‎Aug 13 2020

Strcitly speaking, it's reserved for documentation (see the RFC). 😉 One could argue if Meraki is simply following standards / RFCs or if you should be able to use it (and violate the RFC). On the other hand I don't think that the forums will help you further with this question.

CptnCrnch · ‎Aug 13 2020

I guess that‘s a thing since RFC5737 (perhaps even since RFC1166) came out which declared 192.0.2.0/24 as reserved IP space: https://tools.ietf.org/html/rfc5737 These blocks are not for local use, and the filters may be used in both local and public contexts.

CptnCrnch · ‎Aug 13 2020

You‘re referring to Umbrella as Secure Internet Gateway (SIG), right? At least, Meraki docs are only referring to MX, not Z3: https://documentation.meraki.com/MX/Site-to-site_VPN/MX_and_Umbrella_SIG_IPSec_Tunnel so I don‘t think this would work out. Maybe / hopefully I stand corrected.

CptnCrnch · ‎Aug 12 2020

DNS settings affect the Meraki box you're configuring, e.g. for being able to talk to the dashboard. That does not affect your client devices at all, these would receive their DNS settings via DHCP (possibly).

CptnCrnch · ‎Aug 11 2020

I don't think there's a "one fits all"-solution to that and also depend on the country you're residing in because of regulatory challanges. You'll find many sites that won't strictly be needed in the "Web file sharing" category though. Also, blocking Advertisements is a more commonly seen topic here. Please see those as suggestions. As said above: I don't think anybody will be able to give you a turn-key solution to your specific environment.

CptnCrnch · ‎Aug 11 2020

Hallo Max, schön dich dabei zu haben! 🙂

CptnCrnch · ‎Aug 10 2020

On the other hand, the security benefit you're getting from Umbrella might be worth every penny. I've had too many PoCs with customers leveraging a huge security base where serious sh*t was found by Umbrella within days that would have gone unnoticed even further.

CptnCrnch · ‎Aug 10 2020

I'd guess this is documented somewhere Meraki-internally. You could get in touch with support, or perhaps @ConnorL can help out.

CptnCrnch · ‎Aug 9 2020

Application blacklist is part of a security policy. If some device will violate this policy, you could do (almost) whatever you want with it, e.g. deny network access.

CptnCrnch · ‎Aug 9 2020

You currently seem to be in the same spot many of our customers are in when they realize that the „free“ NPS within their Windoze systems are running fine for the most basic things...as long as there are no issues. 😉

About CptnCrnch

CptnCrnch

Chris

Community Record

Badges