Meraki

jdsilva · ‎Feb 20 2020

Hi @adamhughes ! Welcome to the community!

jdsilva · ‎Feb 20 2020

@Grant3779 wrote: I'm "hoping" I can send a ping to the MX Internet / WAN address but the source of the ICMP would be from a LAN device behind another interface on the MX. Yes, that works.

jdsilva · ‎Feb 20 2020

@mazharud wrote: Is it on the first Tuesday of each month? Yes, that is when it's updated.

jdsilva · ‎Feb 18 2020

Yes, it will work the same way.

jdsilva · ‎Feb 18 2020

You can configure OSPF in either routed or concentrator mode, but you must have VLANs disabled. https://documentation.meraki.com/MX/Site-to-site_VPN/Using_OSPF_to_Advertise_Remote_VPN_Subnets

jdsilva · ‎Feb 17 2020

@Mikekaleny wrote: My understanding is that I'll need to use a default static route at the hub MX pass traffic to the core. Is that correct? Hey @Mikekaleny., Not a default, but you will need a static. The way Meraki has implemented OSPF on the MX allows it to _advertise_ AutoVPN learned routers via OSPF, but it cannot _learn_ routes via OSFP. This means that no matter what LSA's the MX has in its LSDB it will never, ever install an OSPF route (I suspect it doesn't even run Dijkstra... But that's just a guess). So to allow your MX to reach networks in the core you need to add a static route (you also add this route into AutoVPN so your spokes can reach the core). You should avoid using a default route as this will cause inconsistent behavior with the default route on the WAN port used to reach the Meraki cloud.

jdsilva · ‎Feb 12 2020

There is not. This is a pain point or ours as well.

jdsilva · ‎Feb 12 2020

I think you might need the -L flag to tell curl to follow the redirect. curl -L <rest of your stuff>

jdsilva · ‎Feb 12 2020

Hi @beltranesteva, unfortunately what you're asking is not currently possible. Webhooks are limited to what is available on the Network-wide > Alerts page and that's it.

jdsilva · ‎Feb 7 2020

Hey @RichardChen1, Personally, I prefer this reference for API info: https://api.meraki.com/api_docs But use whichever you prefer. Just providing options 🙂 As far as I'm aware there isn't an API endpoint to pull the live traffic data. I don't think you will be able to do what you are asking. Sorry.

jdsilva · ‎Feb 7 2020

There is no functionality within the 802.11 spec that would provide this type of service. You will need an outside application to accomplish this.

jdsilva · ‎Feb 5 2020

Yup, vMX can be a spoke.

jdsilva · ‎Feb 5 2020

@FinnurT wrote: My question is, if the spoke site tunnel goes down, will the site MX see the /30 route and route it to the hub and through there without any intervention, same for when tunnel comes back up will it move it back as now there is more specific ? Hey @FinnurT. If I understand your question correctly the answer is No, this will not work. And the reason is that Non-Meraki VPN routes are not propagated to AutoVPN peers, therefore you spoke with never get the route to the destination over the Non-Meraki VPN from the hub. Aaron Willette with Meraki has a good blog post on this topic here: https://www.willette.works/merging-meraki-vpns/ Or did I not understand the question correctly?

jdsilva · ‎Feb 4 2020

Congrats everyone! Great work all around.

jdsilva · ‎Jan 24 2020

I've noticed some really great posts from you lately @antonis_sp ! Glad to have you contributing and a part of the community.

jdsilva · ‎Jan 24 2020

FWIW I have a feature request in to be able to set Internet failover between WAN interfaces based on % packet loss. In my testing the MX does not reliably fail over to the alternate WAN until >80% packet loss. I would encourage everyone to make wishes and also request this through their reps if this type of functionality is important to you. It might help my feature request become reality 🙂

jdsilva · ‎Jan 24 2020

You're very welcome @Twitch . I appreciate the kind words 🙂

jdsilva · ‎Jan 23 2020

To add to what @Nash said, I've been the last two years and there's always quite a few breakout sessions in addition to self paced walk in labs and even a DevNET session or four. Here's what was on the bill for 2019 in San Diego: Meraki Integrations with the Cisco Security Architecture - BRKSEC-2069 Powerful network automation with Meraki APIs - DEVNET-1217 Building high capacity networks with Cisco Meraki - BRKEWN-1683 Powerful, programmable cloud networking with Meraki APIs - BRKRST-1733 High Density Access Networking with Cisco Meraki - PSOCRS-1105 Simple, Secure, Digital Workplace with Cisco Meraki - INTRST-1105 Taming Branch Security with Cisco Meraki - BRKSEC-2702 Integrating the Meraki SDWAN Solution with the traditional Enterprise network - BRKCRS-2103 SD-WAN Deep Dive: Cisco SD-WAN powered by Meraki - BRKCRS-1579 Delivering an Intent Based Network with Cisco Meraki - BRKCRS-2104 Cloud Managed Security from the WAN to the Endpoint with Cisco Meraki - PSOSEC-1622 DevNet Workshop-Infrastructure as Code 1001 - Network Provisioning, Management, and Monitoring with Meraki Dashboard API - DEVWKS-1069 The Hybrid Campus: How to deploy a combined Cisco SD-Access and Meraki solution - BRKCRS-2105 DevNet Workshop-Infrastructure as Code 1002 - Building, Configuring and Deploying WiFi Engagement Captive Portals with Meraki -DEVWKS-1110 Infrastructure as Code 2002 - Hardening your Meraki Network with Code (and APIs) - DEVNET-2434 Cisco Meraki MV: Camera as a Sensor for Enterprise, Not Just a Tool for Security - PSOIOT-1200 Cloud Managed Security & SD-WAN from Cisco Meraki - BRKSEC-2998 Cisco for SMB Customers - BRKGEN-1003 Expand Your Managed Services and Revenue with Cisco High Velocity Cloud-Based Offerings for SMBs - PSOSPG-1700 If you haven't already you can create an account on the CiscoLive website and get access to the recorded past sessions. Here's the search link I used to get these: https://www.ciscolive.com/global/on-demand-library.html?search=meraki&search.event=ciscoliveus2019#/ So while there won't be ECMS2, there is literally a ton of Meraki training available. Perhaps that can help you build your case to attend?

jdsilva · ‎Jan 21 2020

OK, one last possibility and then I'm tapping out on this one 🙂 You can also configure Syslog message to send security events: Judging by the docs, IDS signature messages are included in these (among a few others). https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples So if you're running a syslog server somewhere (or maybe a SIEM?) you can pipe these messages into that, and then presumably have that send you emails.

jdsilva · ‎Jan 21 2020

Oh! If all you want is to know that they've happened then that can actually be done. If you go into Organization > Summary reports, select you appliance network at the top under "Networks(s)", and then scroll WAYYYYY down to the bottom right where you will find the section "Top Security Threats by Signature". There you will find all the IDS/IPS rules that have been triggered, and how many times. You can then set up an auto email of this report to yourself on a reoccurring frequency (daily? weekly?). So not real time alerting by a long shot, but maybe that would work for you?

jdsilva · ‎Jan 21 2020

Not that I know of 😞

jdsilva · ‎Jan 21 2020

Hey @jlopez_sv81, Yes, by default the MX will NAT all LAN traffic to the single WAN interface IP. Previously, you couldn't actually disable this behavior at all, but the more recent 15.x version have a No NAT feature that's in beta that can be enabled by support.

jdsilva · ‎Jan 20 2020

**EDIT** Removing my comment. I was totally wrong and @ww called me out on it 🙂

jdsilva · ‎Jan 20 2020

Hopefully this will help?

jdsilva · ‎Jan 20 2020

@Thygesen the image you're showing us is not the Summary Report. You need to navigate to Organization > Summary reports as @ww said.

About jdsilva

jdsilva

Community Record

Badges