Meraki

jdsilva · ‎Jun 16 2020

Welcome!

jdsilva · ‎Jun 12 2020

What is the goal of this design? My initial answer is simply that you shouldn't do this as it doesn't add any value while greatly increases complexity, but let's hear the use case and go from there.

jdsilva · ‎Jun 10 2020

All Meraki AP's have support for Air Marshal. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal But the better question is do they have a dedicated scanning radio, or do they have to do opportunistic scanning with their main radios? The datasheet @Adam2104 linked to shows the MR30H's have a dedicated radio, which is by far the better option.

jdsilva · ‎Jun 10 2020

I also wanted to know how on earth you pulled that off. Fun story!

jdsilva · ‎Jun 5 2020

You arrange your own data plan.

jdsilva · ‎Jun 4 2020

10.0.0.1 does not refer to any interface. In this case it's a virtual IP (VIP). It's not actually assigned anywhere.

jdsilva · ‎Jun 4 2020

Great work everyone!

jdsilva · ‎Jun 2 2020

Nice! They finally got updated! Thanks @BenLaakso

jdsilva · ‎Jun 2 2020

@Terry_Watson wrote: You have highlighted another issue in that if I do not configure all the subnets on the branch MX, how do I tell the branch MX to allow these subnets over the Auto VPN? There must be a way as there would be little point in having a core/distribution layer in the Meraki solution. I'm looking into that now! This is doable, though slightly painful. You are also able have static routes participate in AutoVPN. Since the MX can't learn routes from the MS anyway, you're going to need to add one or more static routes to the MX for subnets downstream of the MS. If you add one route for each subnet (instead of one supernet route) you will then be able to add each static route (subnet) into the AutoVPN individually.

jdsilva · ‎Jun 2 2020

ACLs are available on L2 only switches, so these are not tied to an L3 SVI on a switch. This is a good question and I've never had to dig into the answer before... I've used these ACLs a few times and they do what they are supposed to do. So thinking about it I would hazard a guess that the ACLs are applied somewhere in the ingress side of the switch backplane, before a MAC table lookup is done to determine egress port (egress port being one of the physical ports for L2 forwarding, or an SVI for L3 forwarding). One big thing to remember with these ACLs is that they are stateless.

jdsilva · ‎Jun 2 2020

Hey @Terry_Watson, You said these are two different sites? So is the intention to run AutoVPN between the two MX's at each location? If so then you do not need OSPF to propagate routes between MX's as that is handled by the Cloud. In the Site to Site VPN settings, there's a section to select with local networks participate in the VPN. By selecting a network to participate you are actually configuring a route to be propagated to VPN peers via the Cloud control plane. It's due to this that no OSPF is needed. https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN But on the LAN side of an MX appliance @CptnCrnch has it bang on, the MX can advertise routes, but it will not install OSPF learned routes in its routing table. Also, watch out for the VLANs must be disabled requirement to even enable OSPF!

jdsilva · ‎May 29 2020

My experience in the past with this is usually support will run through basic troubleshooting with you, and still try and help out, but if for any reason the problem could be remotely related to the SFP they will stand down and request that you replace it with an official one.

jdsilva · ‎May 27 2020

https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration#SNMP_Traps You need to call support and get them to enable it. You configure it globally on the Network-wide > Alerts page (visible after it's been enabled). It cannot be configured per-device.

jdsilva · ‎May 26 2020

Hey @Gabriele, There's a design limit of 128 clients per radio built into the AP's. https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Approximating_Maximum_Clients_per_Access_Point But, that said, in real world operation you will probably find that acceptable performance levels will require you to design for far less users per radio. I'd say a good rule fo thumb is to keep it under 30, depending on the type of usage.

jdsilva · ‎May 25 2020

Hi @nikmagashi, Firewall rules on the MX are not able to filter traffic that is destined for any interface on the MX. So your example where you say that you can still reach the gateway IP of other VLANs is normal operation, assuming those gateway IP's are all on the MX. This is a quirk of the MX and unfortunately not something you can prevent.

jdsilva · ‎May 22 2020

Sorry, I take that back! I should know better to double check before I answer! It looks like tunnel-group-id is honoured, but it needs to be the VLAN number, not the name. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise#Supported_RADIUS_Attributes

jdsilva · ‎May 22 2020

So the answer is no to tunnel-group-id, but I see there is Filter-Id in the response. You can use that to assign a Group Policy to the user/device, which in turn can specify a VLAN. Maybe that approach will work for you? https://documentation.meraki.com/MR/Group_Policies_and_Blacklisting/Using_RADIUS_Attributes_to_Apply_Group_Policies https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

jdsilva · ‎May 15 2020

If you call support and ask they will provide them.

jdsilva · ‎May 14 2020

Official Meraki stuff is here: https://community.meraki.com/t5/Learning-Hub/ct-p/hub

jdsilva · ‎May 13 2020

@jriordan HAHA ok well I can't win... Might as well turn everything off again 😛

jdsilva · ‎May 13 2020

I'm in!

jdsilva · ‎May 11 2020

Hi @mugrene, To do this you will need to apply the content filtering rules through a Group Policy. https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies I would think the best way is to create your GP with the schedule and content rules you want, and then apply it to the VLAN you want to enforce those rules on.

jdsilva · ‎May 7 2020

No, you can't do this.

jdsilva · ‎May 5 2020

Well done everyone! Great work all around.

jdsilva · ‎Apr 30 2020

Are you pinging between Widows machines? Turn off Widows FIrewall.

About jdsilva

jdsilva

Community Record

Badges