Meraki Community

PhilipDAth

Best tip - turn off 2.4Ghz on your WiFi. Often the congestion is not solvable. If you are in an area with many businesses - it may not even be caused by your company.

PhilipDAth

It would be good if trial licences and NFR licences were available (they are not). Also a special warning - if you are quoting this up for a customer with an existing Umbrella portal it is cruical that you get Cisco to tie the quote to the customers existing Umbrella org - at that stage. It can not be fixed at order time. Otherwise a brand new Umbrella org gets spun up and you'll have to go through the whole licence migration process to get it moved from the new org to the actual org being used. It is really painfull getting SecureConnect correctly quoted and ordered and deployed for existing Umbrella customers.

PhilipDAth

I am not confident that content filtering is applied to client VPN users. I would test this specific case.

PhilipDAth

From my experience, 99% of these are resolved by rebooting the switch in the dashboard. Because this is a stack - I would reboot all stack members.

PhilipDAth

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/Wireless_Layer_3_Roaming_Best_Practices#Concentrator-Based_Layer_3_Roaming

PhilipDAth

Check out this example. https://documentation.meraki.com/MS/Layer_3_Switching/Layer_3_Switch_Example

PhilipDAth

Can you change your Express route to only advertise the on-premise routes, rather than a default route?

PhilipDAth

Wow. Good find.

PhilipDAth

Have you got a proxy in your organisation or anything doing SSL inspection? The "self signed" certificate is the suspicous bit. You are talking to something - but it is not Meraki.

PhilipDAth

>using "admin" as the username, All Meraki devices should strive to be the same. I don't think it is good when just one family member does something different to all the other family members.

PhilipDAth

Alas that doesn't clear the DHCP leases. I wish it did.

PhilipDAth

The way I do it is to turn off DHCP for a little bit, and then turn it on again.

PhilipDAth

What does the Ubiquity switch log report? Have you configured the spanning tree priority on your switches to make sure they are the spanning tree root? https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_Spanning_Tree_on_Meraki_Switches_(MS)

PhilipDAth

I loved using the MS350-24X for core switches. Having both SFP+ and 10GBaseT capability in one switch was super flexible.

PhilipDAth

Look in the event log, and search on "Content Filtering". That will show you everything that content filtering is blocking. I assume you have content filtering configured to block it.

PhilipDAth

To move the VMX between AWS accounts you'll need to first delete it, and deploy then it get into the new account. The public IPs will definately change. The new AWS account wont have access to the IPs in the old account. If the VPC is using the exact same private IP address then you could specify to use the same private IP address - but more than likely - it wont be the same. There will be considerable disruption during the change.

PhilipDAth

I spend halve my day on MS Teams calls. I'm using 30.6 without issue. I haven't tried 30.7 yet.

PhilipDAth

>The AP can't setup static IP even I have changes to static but on the status IP doesn't change and keep (Via DHCP) This happens when the AP is unable to talk to the Meraki cloud using the static IP. Rather than going ofline, it changes over to using DHCP. If you have an upstream firewall see if the traffic is being allowed. You could also try putting the same config on a notebook and verifying that it can access the Internet ok.

PhilipDAth

When you are looking at the client, click ont he little "Flag" symbol to let Meraki know that it is not correct.

PhilipDAth

That is one of the best descriptions I have even seen.

PhilipDAth

I'm not of the impression that re-marking is based on load. I think it happens permanently. But I do agree - you'll need to check it on the outgoing port.

PhilipDAth

With Cloud OnRamp, it goes via Umbrella to SD-WAN. If you want to reduce your requirements to just DNS filtering then then you can Umbrella DNS Essentials, and use DNS integration. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Manually_Integrating_Cisco_Umbrella_with_Meraki_Networks

PhilipDAth

If you want something even tighter, then you could use 802.1x and a RADIUS server on the LAN ports, and actually authenticate each device (or you could do it by MAC address). This method would prevent a client from being able to do DHCP until authenticated. https://documentation.meraki.com/MX/Access_Control_and_Splash_Page/MX_Access_Policies_(802.1X)

PhilipDAth

In that case, create a firewall rule blocking all access. Then for hosts you want to authorise - apply the built in group policy "Allow list" to override the firewall and grant access. I think all devices will still be able to get a DHCP address - but unauthorized devices wont be able to send traffic across layer 3 interfaces.

PhilipDAth

What you could do is create a new VLAN, and put all the devices with the OUIs you want into it, and then configure DHCP to service just that VLAN.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges