Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ToryDav
About ToryDav
ToryDav
Building a reputation
Member since Sep 24, 2019
Apr 26 2024
Community Record
130
Posts
53
Kudos
3
Solutions
Badges
Feb 5 2023
5:24 AM
Hi @alemabrahao, thanks for the reply. ZeroSSL is actually the name of the company I get my SSL certificate from. I just don't know how to get the correct certificate chain as the bundle they provide doesn't seem to work for Meraki AutoVPN https://zerossl.com/
... View more
Feb 3 2023
1:33 PM
Hello, Do you think it is possible to use a certificate from Zero SSL? I have applied a static IP on my MX, configured public DNS A record to resolve to my desired domain name, generated the CSR in Dashboard, pasted that into the feild where applicable for Zero SSL to generate my Cert. I get back the certificate and ca_bundle, but when I upload these I get error messages back and can't seem to get anywhere. Anyone have a recommendation to get this working for a free or low-cost certificate? I like Zero SSL, but if I can't use them.. Error : " There were errors in uploading the certificates. Unknown Error Failed verifying Device Cert with Cert Chain " I'd love to finally see this work so I can better help my customers move over to Anyconnect on MX.
... View more
Labels:
- Labels:
-
Client VPN
Jan 23 2023
12:08 PM
1 Kudo
Fantastic, I followed the steps found in the solution provided by @Inderdeep and was able to add my Meraki devices into DNA-C sites inventory. There are a few product types that didn't appear though, but what I really needed / expected to come over has, so this is a win for me. More testing to come.
... View more
Jan 23 2023
12:06 PM
Thank you, this is good to know! At the moment, I'm not really looking for a way to push configuration although it would be a nice to have. At this time I am only looking for up/down monitoring and network visibility, a way to consolidate my Catalyst + Meraki into a single dashboard (DNA-C). Getting these into my DNA-C Sites Hierarchy would just be nice. Telemetry information would also be nice.
... View more
Jan 23 2023
11:27 AM
2 Kudos
@Inderdeep I will happily try it. I did find the info how to do this thanks to you. I will report my success or failures here.
... View more
Jan 23 2023
10:55 AM
I hope I put this in the correct location. I am trying to understand if this integration is possible, or road-mapped, or if it was abandoned.
... View more
I don't think STP would cause DHCP request to be denied. The DHCP discover messages may actually be getting lost, causing the DHCP process to fail. Where is the DHCP service running in relation to the client? (What does the path look like?) Filter your event logs for STP elections / root bridge changes, if you have an STP problem such as constant topology changes DHCP likely isn't the only thing affected. Are there any other problems occurring?
... View more
Dec 9 2022
11:22 AM
🤔Perhaps it might
... View more
Dec 9 2022
10:44 AM
And to be clear the vlan doesn't exist, upstream is entirely Layer 3. We are just setting VLAN 10 for management to avoid using default VLAN 1. My understanding is that once you insert the vlan tag into the box shown below, isn't that traffic tagged with that VLAN ID? This is a required field, so traffic is always tagged unless using default vlan 1, is that not true?
... View more
Dec 9 2022
10:40 AM
Thats what I understand too, however, In this case a static IP was set in VLAN 10 on the switch, the Switch -> switch settings page was also set to match (VLAN 10), however as soon as this was done the switch went down in the dashboard. The upstream port was set as switchport access vlan 10 or trunk with native vlan 10, it would not come up using that VLAN, so it seemed as though the traffic was being tagged (and dropped). Using the same IP and VLAN 1 did the trick and it comes right up which was a bit odd.
... View more
Dec 9 2022
8:59 AM
Hi All, I just would like to clarify something regarding the default VLAN 1 management traffic MS switches use. If my MS switch has a routed port upstream with a default gateway (untagged traffic) then I am forced to use VLAN 1? Changing to for example vlan 10 on my LAN IP of the switch (and changing the VLAN tag in switch -> settings); and putting the uplink on an access vlan 10 port isn't going to work right? Trunking/tagging for management in my case isn't possible because the port upstream used for management is a routed only port. Are we really stuck with VLAN 1 for MGMT in this case?
... View more
Nov 29 2022
3:03 PM
Which statement? Assuming the statement about keeping VLAN 1 - The link RaphaelL shared is it. I have seen issues in the field with this though - a lot of issues in mixed vendor environments due to STP where there are rapid STP Per Vlan instances of spanning tree running.
... View more
Nov 29 2022
1:57 PM
What concerns would you have when removing VLAN 1 entirely from a Meraki MS/MX/MR network and dropping untagged traffic across all interconnections (trunks)? I know there are some requirements to keep VLAN 1 as native VLAN in a mixed Meraki/Catalyst/Nexus environment, so this question focuses on Meraki hardware only for discussion sake. To meet network security best practices I often wonder, why not remove VLAN 1 from the MX, tag all the subnets across the MX LAN ports to MS switching and configure all the trunks to drop untagged traffic. I don't see any issue but have heard sometime dropping untagged traffic could cause problems, I just haven't seen these problems myself. Thoughts? Opinions?
... View more
Current Firmware - MS 15.17 Model: MS120-8LP Severity - None (informational) I removed VLAN 1 from my network and changed the management vlan to vlan 10. all my equipment uses DHCP for the LAN management IP in my lab, so the change was easy - however I noticed that the MS 120 still displays vlan 1 on the LAN IP. I can assure you VLAN 1 no longer exists. My uplink does not carry vlan 1 The local status page shows the correct information, just displayed wrong in dashboard. Switch is healthy and I can ping its address, so there isn't any issue. Just wanted to submit this. Let me know if I should submit this elsewhere. Thank you. Tory Davenport
... View more
Oct 27 2022
7:25 AM
Just to confirm - Hit the STOP button in Azure? That's how I was testing.
... View more
Oct 25 2022
2:08 PM
I was shutting the VM down or rebooting it from within Meraki Tools. How can I test failover then? I like the OGS feature you mentioned, however part of this is that we want to distribute users more evenly until Azure gets a vMX large and we can overcome the Medium session limitations.
... View more
Oct 24 2022
9:02 PM
Hi! I am working on this setup and would like to know what other peoples experience is with this setup. All users will connect to their respective Primary Servers. When a Primary Server fails, the AnyConnect Client will automatically connect them to the Backup Server. Credentials will be required from the user to complete authentication to the Backup Server. Reference -> https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Failover_and_Load_Sharing The issue I have with this is, while I can connect to the backup server listed in the profile after about 1-2 minutes, this doesn't happen automatically. The client receives an administrator reset message and then has to click to connect. My question is.. What is your experience in terms of the above expected behavior?
... View more
Labels:
- Labels:
-
Client VPN
-
Other
Sep 23 2022
10:36 AM
Hi, Client is looking to use Always on and trusted network to enforce VPN to connect when users are from home and when they are in the office they don't want to have them to be prompted. I followed the instructions provided here https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Client_deployment#AnyConnect_Profiles But the profile shown uses cisco.com for the dns suffix. My guess is this is because its just an example. But this doesn't work when I test it using customer dns suffix and dns servers. We are using auto-generate certificates and DDNS, is this even possible or do I need custom hostname certificates? UPDATE - I did get this working for basic Meraki Authentication, Always on and Trusted Network Detection, but I need it to work with SAML (Azure AD). When on an untrusted network, SAML not be able to reach single sign on web page for Azure AD because Internet access is blocked, so it doesn't allow you to even attempt to authenticate. I will keep at it and update if I find a solution.
... View more
Labels:
- Labels:
-
Client VPN
Hi, I'm looking for a brief explanation on if we can configure Users/Machines to Authenticate to an MR SSID using custom radius (Windows/ISE/Clearpass) with a certificate instead of using credentials. Is this possible? Is there a guide on how to configure it on the Meraki side? When I select "my custom radius server" I don't see anything about Certificates in the configuration, this may be transparent to the AP, but I am looking for clarification as it would be my first time with certificates. I've only configured and tested radius with AD credentials before a few time.
... View more
Labels:
- Labels:
-
Other
Jul 26 2022
1:53 PM
2 Kudos
Hi @PhilipDAth Thank you Philip! You ROCK. You have helped me understand the design requirements immensely, which seems to add more flexibility to what I am trying to do.
... View more
Jul 26 2022
10:34 AM
Hi All, I have some vMX deployed in Azure right now and I am following this reference architecture, but I am having trouble with the following document. https://documentation.meraki.com/MX/Other_Topics/Deploying_Highly_Available_vMX_in_Azure This documentation is in my opinion quite vague. There are two diagrams shown that appear to be two different solutions, but that isn't exactly said in the document. #1 #2 I am trying to create scenario #1, but I can't actually seem to get the routing to work over the "secondary" vMX. The reason is because even with the VNET peering, the VNETs behind both vMX VNETs, still need a manual change to the route table during a failover scenario to change the next hop for traffic going to my spoke. When I configure these vMX I have to add the subnets for the VNETs behind the vMX VNETs, in my case 10.50.1.0/24, they both are configured with this, and thus they both advertise that route to the spoke.. So my question is in solution #1, is this actually more "active / active"? Or is the primary/secondary controlled via setting the hub priority in the dashboard? For example So how do we get true active passive in solution #1 without the Azure function, my guess is we cannot. Should I just build this with both vMX in the same VNET, two different public IPs with both connecting to the same private subnet and use Azure function to change the next hop in the route table?
... View more
I don't believe you can monitor simultaneously with Dashboard and DNAC.
... View more
Jul 13 2022
5:55 PM
I don't think you can use the same cisco anyconnect enterprise application with different anyconnect servers
... View more
Jul 13 2022
1:12 PM
@PhilipDAth Has there been any update on this? I am looking for a way to stamp out vMX in Azure and was thinking Terraform also. Are there any other options?
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 4464 | Feb 5 2023 5:41 AM | |
| 2627 | Mar 28 2022 3:09 PM | |
| 4043 | May 20 2021 3:37 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 7 | 10806 | |
| 4 | 4432 | |
| 3 | 2138 | |
| 2 | 5702 | |
| 2 | 9162 |
© 2024 Cisco Systems, Inc.
