Meraki

jdsilva · ‎Jun 12 2020

What is the goal of this design? My initial answer is simply that you shouldn't do this as it doesn't add any value while greatly increases complexity, but let's hear the use case and go from there.

jdsilva · ‎Jun 11 2020

Can you elaborate on the use case a bit more? I've never seen any DHCP server hand out /32's... Not to say that it can't happen, I'm just curious to understand why you would need that and how it works in practice.

jdsilva · ‎Jun 10 2020

All Meraki AP's have support for Air Marshal. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal But the better question is do they have a dedicated scanning radio, or do they have to do opportunistic scanning with their main radios? The datasheet @Adam2104 linked to shows the MR30H's have a dedicated radio, which is by far the better option.

jdsilva · ‎Jun 10 2020

I also wanted to know how on earth you pulled that off. Fun story!

jdsilva · ‎Jun 9 2020

Hey @DBlum I'd start with this KB entry: https://documentation.meraki.com/MX/Site-to-site_VPN/Troubleshooting_Non-Meraki_Site-to-site_VPN_Peers#Event_Log:_.22failed_to_pre-process_ph2_packet.2Ffailed_to_get_sainfo.22 That seems to match your error messages.

jdsilva · ‎Jun 9 2020

Hey @Jason-907. First I'll say that if you re-bind this network once you're done it'll wipe out the changes you've made and bring the network in line with the template again. So watch out for that. Once you unbind the network from the template I'm guessing that VLANs are disabled. You'll need to enable them first using this API call: https://api.meraki.com/api_docs/v0#enable/disable-vlans-for-the-given-network Once that's set to enabled you'll be able to create the VLANs you need.

jdsilva · ‎Jun 5 2020

You arrange your own data plan.

jdsilva · ‎Jun 5 2020

It seems either something changed or you got a support person that didn't know they could provide them. I have for sure in the past got these numbers from support. https://community.meraki.com/t5/Wireless-LAN/MTBF-MR74-and-MR53/m-p/50833#M7771

jdsilva · ‎Jun 4 2020

10.0.0.1 does not refer to any interface. In this case it's a virtual IP (VIP). It's not actually assigned anywhere.

jdsilva · ‎Jun 4 2020

Great work everyone!

jdsilva · ‎Jun 2 2020

Nice! They finally got updated! Thanks @BenLaakso

jdsilva · ‎Jun 2 2020

@Terry_Watson wrote: You have highlighted another issue in that if I do not configure all the subnets on the branch MX, how do I tell the branch MX to allow these subnets over the Auto VPN? There must be a way as there would be little point in having a core/distribution layer in the Meraki solution. I'm looking into that now! This is doable, though slightly painful. You are also able have static routes participate in AutoVPN. Since the MX can't learn routes from the MS anyway, you're going to need to add one or more static routes to the MX for subnets downstream of the MS. If you add one route for each subnet (instead of one supernet route) you will then be able to add each static route (subnet) into the AutoVPN individually.

jdsilva · ‎Jun 2 2020

ACLs are available on L2 only switches, so these are not tied to an L3 SVI on a switch. This is a good question and I've never had to dig into the answer before... I've used these ACLs a few times and they do what they are supposed to do. So thinking about it I would hazard a guess that the ACLs are applied somewhere in the ingress side of the switch backplane, before a MAC table lookup is done to determine egress port (egress port being one of the physical ports for L2 forwarding, or an SVI for L3 forwarding). One big thing to remember with these ACLs is that they are stateless.

jdsilva · ‎Jun 2 2020

Hey @Terry_Watson, You said these are two different sites? So is the intention to run AutoVPN between the two MX's at each location? If so then you do not need OSPF to propagate routes between MX's as that is handled by the Cloud. In the Site to Site VPN settings, there's a section to select with local networks participate in the VPN. By selecting a network to participate you are actually configuring a route to be propagated to VPN peers via the Cloud control plane. It's due to this that no OSPF is needed. https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN But on the LAN side of an MX appliance @CptnCrnch has it bang on, the MX can advertise routes, but it will not install OSPF learned routes in its routing table. Also, watch out for the VLANs must be disabled requirement to even enable OSPF!

jdsilva · ‎Jun 2 2020

While @MerakiDave is most likely correct (he's great with getting us answers here on the community!) the "official" way to get these numbers is to simply call support and ask. They'll happily provide you with MTBF numbers for any Meraki device.

jdsilva · ‎May 29 2020

Hey @jinelcrimp8, This is a Meraki community, and Meraki doesn't have controllers. You might get better responses on the Cisco community. https://community.cisco.com/t5/technology-and-support/ct-p/technology-support

jdsilva · ‎May 29 2020

My experience in the past with this is usually support will run through basic troubleshooting with you, and still try and help out, but if for any reason the problem could be remotely related to the SFP they will stand down and request that you replace it with an official one.

jdsilva · ‎May 27 2020

https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration#SNMP_Traps You need to call support and get them to enable it. You configure it globally on the Network-wide > Alerts page (visible after it's been enabled). It cannot be configured per-device.

jdsilva · ‎May 26 2020

I'm not sure I would say that's true, but it depends on your exact use case. Meraki has two support designs for integrating MPLS into SD-WAN. They are: https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS and https://documentation.meraki.com/MX/Networks_and_Routing/Integrating_an_MPLS_Connection_on_the_MX_LAN In the former, there's no practical way that I can think of to utilize dual MPLS links. In the latter you could likely do something with route preference to make it work, just just equal cost the two links and use both simultaneously. If I missed the mark on your ask please let me know and we can see what I didn't understand.

jdsilva · ‎May 26 2020

Hey @Gabriele, There's a design limit of 128 clients per radio built into the AP's. https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Approximating_Maximum_Clients_per_Access_Point But, that said, in real world operation you will probably find that acceptable performance levels will require you to design for far less users per radio. I'd say a good rule fo thumb is to keep it under 30, depending on the type of usage.

jdsilva · ‎May 25 2020

The only time I've ever seen two MX's with the same MAC is when they are configured together in Warm Spare. In that scenario the spare unit will use the MAC of the Primary (on the LAN only) anytime it transitions to Master.

jdsilva · ‎May 25 2020

Hi @nikmagashi, Firewall rules on the MX are not able to filter traffic that is destined for any interface on the MX. So your example where you say that you can still reach the gateway IP of other VLANs is normal operation, assuming those gateway IP's are all on the MX. This is a quirk of the MX and unfortunately not something you can prevent.

jdsilva · ‎May 22 2020

Sorry, I take that back! I should know better to double check before I answer! It looks like tunnel-group-id is honoured, but it needs to be the VLAN number, not the name. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise#Supported_RADIUS_Attributes

jdsilva · ‎May 22 2020

So the answer is no to tunnel-group-id, but I see there is Filter-Id in the response. You can use that to assign a Group Policy to the user/device, which in turn can specify a VLAN. Maybe that approach will work for you? https://documentation.meraki.com/MR/Group_Policies_and_Blacklisting/Using_RADIUS_Attributes_to_Apply_Group_Policies https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

jdsilva · ‎May 22 2020

@Roques wrote: Is it possible? Through an API? Would love your feedback on this topic. You can't run the Summary Reports via the API, but every bit of info that's in the Summary Reports isavailable via the API. So you could build yourself a script that pulls all this info and presents it on a per AP basis.

About jdsilva

jdsilva

Community Record

Badges