Meraki

Ryan_Miles · ‎Jul 28 2022

It won't work. Meraki APs don't act like client bridges/clients in such that they won't roam seamlessly. The mesh process takes time to form a connection. https://documentation.meraki.com/MR/Deployment_Guides/Mesh_Deployment_Guide#Mesh_convergence_time You'd want to use something like an autonomous Cisco AP in universal workgroup bridge mode.

Ryan_Miles · ‎Jul 25 2022

It’s covered here https://documentation.meraki.com/General_Administration/Templates_and_Config_Sync/Managing_Multiple_Networks_with_Configuration_Templates#Local_Overrides

Ryan_Miles · ‎Jul 25 2022

You would need to note the max power load per the MS225 data sheet Then, check the max output power of the RPS2300 in both configurations and do the math. It appears you'd want the 1150 W if supporting two 24 port switches or a 48 port full power switch.

Ryan_Miles · ‎Jul 15 2022

This doc mentions the scenario you presented. https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshooting#VPN_Registry_Disconnected If internet is lost the private WAN interface would be marked as down. But AFAIK (as doc mentions) the tunnel should remain up for a few hours. Not sure if there's an exact timer. In scenario #2 I believe it would be the same with the tunnel remaining up for a few hours on private WAN link.

Ryan_Miles · ‎Jul 13 2022

@latintrpt While janky this also works. Basically use the MX itself as the media converter. And keep in mind this is totally unofficial, not supported. So, if you do this you're on your own.

Ryan_Miles · ‎Jul 13 2022

Looks like you should be using /32 masks on the allow rule. Not /24. If you fix that is there any change?

Ryan_Miles · ‎Jul 13 2022

You cannot turn a SFP LAN port into a WAN port. Sounds like you need provider to change their handoff or get a media converter. Or, swap to a MX with SFP based WAN ports.

Ryan_Miles · ‎Jul 12 2022

They're speaking about configuration templates which you create in dashboard and bind networks to them. https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/MX_Templates_Best_Practices

Ryan_Miles · ‎Jul 11 2022

This is a new PDL bug. Feel free to open a Support case and they can attach it to the master case. Or, wait it out and it should be resolved soon. This is apparently cosmetic only.

Ryan_Miles · ‎Jul 5 2022

By default you'll only see those stats when there are 2 WAN uplinks and therefore performance probes going across each WAN link. If you contact Support single link monitoring can be enabled which would show the extra fields in the API output.

Ryan_Miles · ‎Jul 3 2022

From one of mine "serial": "xxxx-xxxx-xxxx", "network": { "id": "networkID", "name": ".core" }, "readings": [ { "ts": "2022-07-03T15:41:56Z", "metric": "pm25", "pm25": { "concentration": 3 } }, { "ts": "2022-07-03T15:41:55Z", "metric": "tvoc", "tvoc": { "concentration": 4310 } }, { "ts": "2022-07-03T15:41:46Z", "metric": "humidity", "humidity": { "relativePercentage": 48 } }, { "ts": "2022-07-03T15:41:36Z", "metric": "temperature", "temperature": { "fahrenheit": 76.6, "celsius": 24.78 } }, { "ts": "2022-07-03T15:41:36Z", "metric": "noise", "noise": { "ambient": { "level": 33 } } }, { "ts": "2022-07-03T15:41:30Z", "metric": "indoorAirQuality", "indoorAirQuality": { "score": 82 } }, { "ts": "2022-05-07T22:44:46Z", "metric": "battery", "battery": { "percentage": 100

Ryan_Miles · ‎Jun 26 2022

Details on containment here

Ryan_Miles · ‎Jun 24 2022

Toggling enable/disable of a WAN port does do a soft reset (not a reboot) on the MX from what I've always seen. So, connectivity is interrupted briefly. I can't explain why it would never come back. What's the current status? Site still unreachable?

Ryan_Miles · ‎Jun 24 2022

What version firmware? I've not seen this behavior. I also just tested doing something similar here. Brought up a MX67C with only a WAN 2 link (and WAN 2 set as primary uplink on traffic shaping page). Then configured static IP for WAN 1 and then connected physical connection. I don't see any disruptions when doing this.

Ryan_Miles · ‎Jun 24 2022

One correction. It can be enabled on combined networks. It doesn't support template bound networks today.

Ryan_Miles · ‎Jun 23 2022

You can create a network in dashboard now, add the switches, complete the configuration. When you install the switches they will check in with dashboard and pull down their config. No need to SSH or install a config prior to physical deployment (other than if you need a static mgmt IP on the device - then use the local status page). You might want to check out this video (I have zero affiliation with him) https://www.youtube.com/watch?v=DaxjRoXEG18&ab_channel=TheITWay

Ryan_Miles · ‎Jun 23 2022

The config lives in dashboard. If a Meraki device fails you replace it in the same dashboard network and it will assume the same config. The only thing you'd need to redo is setting a static WAN IP (if using that).

Ryan_Miles · ‎Jun 23 2022

Meraki switches are cloud managed. The local status page is for limited config tasks (mainly giving a device a static IP). You need to do the config via dashboard or use API.

Ryan_Miles · ‎Jun 17 2022

Does Informacast support webhooks? I googled it and found nothing.

Ryan_Miles · ‎Jun 17 2022

Keep in mind the failover times shown in that doc are ranges based on a number of variables. A typical WAN link down & failover to WAN 2 is very fast. MX primary to MX spare failover is also very fast. Upstream or "soft" failures can cause some additional "down" detection time and impact failover time. The LAN side topology could also factor into failover times albeit the impact should be quite minimal. By that I mean some might choose to single connect each MX in a HA pair to downstream switches. Others will choose to dual connect each MX causing a STP blocked pathway. If the MXs are doing AutoVPN then there is a little more time required to failover tunnel(s) from primary to spare. Additional hub factors (DC failover, OSPF or BGP timers) could also influence the failover time.

Ryan_Miles · ‎Jun 10 2022

Dev beta 1 just came out this week for Mac OS Ventura. It seems something changed or broke with client VPN. L2TP no longer works. If anyone else here is a Apple dev tester and finds a solution to get client VPN please let me know. Btw, I did post on the Apple dev forum and submitted feedback to Apple. Hoping they have a magic fix or I'll be rebuilding two Macs 😞

Ryan_Miles · ‎Jun 8 2022

As mentioned here if you need to set a static IP on a MX you can use the local status page accessible by the dedicated mgmt port (if your MX model has one) or connect a laptop to a LAN port. After initial setup you no longer use any LAN port in Concentrator mode. Reference Mgmt of any MX regardless of mode is via the WAN port(s) talking to dashboard. At a branch a guest tunneled SSID looks like this example config. In my example VLAN 600 only exists in the DMZ and the upstream edge MX. The DMZ MX is what places the tunneled guest onto the (local to the DMZ MX) VLAN. And yes your DHCP server, whatever it is, needs to be scoped to have enough IPs for all guests. And yes in Concentrator mode the HA VRRPs go out on the WAN interface. Again, you don't use any LAN ports. All that said, is your branch using a MX appliance and if so is it doing AutoVPN back to the same guest anchor MX? If so, this likely won't work as outlined in this doc mentioning the double tunnel problem. Also, is there a specific reason to tunnel guests back to a central location? The far easier way to provide guest WLAN in Meraki is by using NAT mode. Guests are segmented from corp devices, P2P isolation is enabled, no need to manage any DHCP scopes, and no need for more MXs sitting in a DMZ.

Ryan_Miles · ‎Jun 7 2022

To clarify, AP licenses are not model specific. LIC-ENT is the AP license SKU and works for any Meraki AP. So, just make sure you have enough licenses to cover the APs you have in use.

Ryan_Miles · ‎Jun 6 2022

It would essentially be this. I have this set up in my lab. I'll attempt to answer all the questions from above. The VPN MX will only have one IP on the WAN 1 interface. This is the mgmt IP and how it talks to dashboard (of course via upstream NAT). A guest SSID can tunnel via L2 from the AP to the MX and egress onto a L2 VLAN present on the switchport connected to the MX. In my example, that's VLAN 600. That VLAN only exists on the link between the VPN MX and the core switch, and the core switch up to the edge firewall which has the L3 interface and DHCP scope for VLAN 600. In concentrator mode you don't use the MX LAN ports at all. As long as there's a route between the AP and MX the tunnel should form over the LAN path. For your branch question. With a tunneled SSID the addressing works the same way it would with a WLC. The client VLAN only exists at the VPN MX and doesn't need to exist as the edge/branch. In my example below I have firewall rules in two places. On the guest SSID I use L3 firewall rule deny to Local LAN. The Local LAN object means 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Also, at my edge MX I have another rule denying VLAN 600 to the RFC1918 nets. Redundant but it's a failsafe should the MR rule be changed or I want a wired guest.

Ryan_Miles · ‎Jun 1 2022

Two options. Option 1 - Clone the MX68 network and place the MX75 (or whatever MX you move to) in the new network. It will copy all of the config over Option 2 - Remove the MX68 from the network (with the remove button on the MX page) and then add the MXxx back to this network and it will assume all settings. The couple of exceptions I can think of that get reset when you do either option is making sure the LAN port mapping aligns as MX models can have different LAN port counts. https://documentation.meraki.com/MX/Other_Topics/MX_Cold_Swap_Replacing_an_Existing_MX_with_a_Different_MX#Port_Mapping_for_different_MX_models And, if you have site to site VPN configured I believe it resets back to disabled when you remove a MX from a network or clone a MX network. So, just reenable S2S VPN if needed.

About Ryan_Miles

Ryan_Miles

Ryan Miles

Community Record

Badges