Meraki

jdsilva · ‎Dec 17 2018

AHEM! _I_ found the gnome. There's picture proof above 😛

jdsilva · ‎Dec 17 2018

Woohoo progress! It could be something as stupid as the format of the MAC being sent. xx:xx:xx:xx:xx:xx instead of xxxx.xxxx.xxxx for example. I'm not familiar with that RADIUS error so that's just speculation.

jdsilva · ‎Dec 17 2018

What do the Event Logs in the Dashboard say? What do the RADIUS logs say?

jdsilva · ‎Dec 17 2018

What do you have the access policy type set to? It will need to be either MAB or Hybrid.

jdsilva · ‎Dec 14 2018

Congrats @mmistretta and @vicapelli! Nice work!

jdsilva · ‎Dec 14 2018

I've been battling MX's rebooting lately, not MR's 😞 We also don't use the MR52 so I can't provide any help there. But we have lots and lots of MR42's and I can't say we've run across this problem. Following to see where you end up here.

jdsilva · ‎Dec 13 2018

[Mod note: There was a funny image here, but for whatever reason LinkedIn is picking it as the "main" image when we attempt to share this blog post there. And the funny image isn't appropriate out of context! So, removing it.]

jdsilva · ‎Dec 13 2018

^^ Phil just called us models @CarolineS. I feel so pretty!

jdsilva · ‎Dec 13 2018

It's unlimited on the Meraki side for this. You'd have to go to a RADIUS server to control simultaneous logins. Most RADIUS servers have this functionality.

jdsilva · ‎Dec 13 2018

Oooh, good question. I've never seen that option anywhere... So I'm thinking no. I'm interested to see if I'm wrong.

jdsilva · ‎Dec 13 2018

Hey @LuisPi. Nope, sorry, this isn't possible on the MX.

jdsilva · ‎Dec 12 2018

Nope, no trick. You can't do this. First time connection to the cloud needs to be via wired.

jdsilva · ‎Dec 12 2018

https://support.google.com/chrome/a/answer/187202?hl=en

jdsilva · ‎Dec 12 2018

I thought you could enforce GP in Chrome? I'm sure you can...

jdsilva · ‎Dec 12 2018

There isn't much in the dashboard for Internet flows. There is a graph under Security > Appliance status that kinda shows this: I can't think of anything else 😞

jdsilva · ‎Dec 12 2018

It is possible. But as @NolanHerring's post implies, you have some work ahead of you. The framework is in the dashboard to do this, but you're either going to have to build your own application to do all the actual work, or find a third party who does this and procure their services.

jdsilva · ‎Dec 12 2018

Yes, there's a way for sure. I'm not terribly knowledgeable on AD FS, but for us we enter "meraki" in our browser and it logs us right in with no further action. "meraki" has our domain suffix appended to it for meraki.domain.ad, which is an alias to urlredirect.domain.ad, which resolves to our ADFS server. After hitting that we're redirected to the dashboard consumer URL and we're in. So I'm assuming there's a way in ADFS that you can detect which URL was used to get there, and then redirect to the dashboard after a successful auth. Sorry I can't be more help.

jdsilva · ‎Dec 12 2018

The correct solution here is to convince your customer this is the wrong solution.

jdsilva · ‎Dec 12 2018

Hi @mklein, That's no different than @MacuserJim's suggestion, just using the API instead of the dashboard. It's simple network cloning.

jdsilva · ‎Dec 11 2018

Good plan. If I have an MX available my preference is to use the MX for rules and not the AP. Your first example is correct. You have to keep in mind that Meraki has a "permit everything" rule at the end you can't change. So your approach should be allow as specifically as you can, and then block broadly everything else. Your second example would likely work, but from an administrative point of view it's harder to read and understand, and more prone to errors if modifications are needed. Especially if it's not you in the future making changes.

jdsilva · ‎Dec 11 2018

And to add one more thing, this is what deny local LAN blocks: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

jdsilva · ‎Dec 11 2018

If I understand correctly, yes they will supercede. The firewall rules under Wireless are enforced on the AP directly, and the rules under Security are enforced on the MX. So if you block something at the AP it's blocked there, and the MX never sees that traffic.

jdsilva · ‎Dec 11 2018

Our shards seem fine. Maybe it's resolved now?

jdsilva · ‎Dec 11 2018

I'm not sure there's an "easy" way here. I'd suggest that you connect up the MX to the cloud, and then run the Mgmt interface of the MS to the MX so you have a stable control plane to work with here. And then as you say, just migrate the L3 interfaces one at a time. Moving DHCP is going to be a pain. I would suggest ahead of time you shorten the lease time on the MS down to something really short (1 hour? 30 minutes?) and let all your clients get the new short leases. This will ensure the clients re-dhcp to the MX within a reasonable period.

jdsilva · ‎Dec 10 2018

In this case, to be specific, what you want to do is forward ports. And unfortunately you cannot forward the same port to multiple internal IP's at the same time. You have two choices: You can forward different external ports to your internal camera on port 9000. So 9000 goes to cam1 port 9000, port 9001 goest to cam2 port 9000, port 9002 goes to cam3 port 9000, and so on. You do this in the "Port Forwarding" section on the Firewall rules page. You can use multiple external IP's to forward port 9000 to multiple cameras. So 1.1.1.1 port 9000 is forwarded to cam1 port 9000, 1.1.1.2 port 9000 is forwarded to cam2 port 9000, and so on. This is done using either 1:1 NAT or 1:Many NAT on the Firewall rules page.

About jdsilva

jdsilva

Community Record

Badges