Meraki

PhilipDAth

You just gave me an idea. Go to the very bottom of the Meraki Dashboard, any page, and click on "cookie preferences". Disable both "Performance" and "Targeting" cookies. I don't have the RAM issue - but for me this makes the Meraki Dashboard much more snappier. You don't need a stop wach - it is very noticable.

PhilipDAth

That is interesting. I would not have expected a health check to change the underlying mechanism of how the VPN is built. Is it possible to create a "null" health check that always just returns "true"?

PhilipDAth

If the client has lots of sites, I would use dual VMXs, but then use BGP over IPSEC from each VMX to an Amazon AWS VPN or Transit gateway. Currently, I rely on using Lambda scripts performing automations to detect scripts and update configs to handle the failover. This is so much cleaner. If the customer has a small number of sites, I'm now just as likely to use this approach to go from MXs in a DC straight to Amazon AWS.

PhilipDAth

I just did an experiment with using BGP over IPSec to Amazon AWS with MX 19.2.3. https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN And it now works (never used to)! I have stood up two tunnels to an Amazon AWS VPN gateway. Fully HA. For clients using dual VMXs - I think this will be my new preferred way of making them HA inside of Amazon AWS as well.

PhilipDAth

Is this *really* a static route over a VTI, or is this just manipulating a policy map?

PhilipDAth

When this happens, there is usually some warning on the page (often at the top), and you need to scroll to find it. Try doing just one of the changes, and see how that goes. Keep repeating till you find the change it is not happy with.

PhilipDAth

If you have 8 modules not coming up, you need to swap the send/receive fibre in your cable. They'll be the wrong way around.

PhilipDAth

Since the supplicant is not responding - you need to look at that end. For example, if it is a Windows machine, check the event viewer. Make sure the machine has a valid user/machine certificate. What are you using to issue your certificates?

PhilipDAth

This doesn't sound like a Meraki question. It doesn't even sound like a Cisco question.

PhilipDAth

Make sure you configure an RF Profile. https://documentation.meraki.com/MR/Operate_and_Maintain/User_Guides/Radio_Settings/RF_Profiles Most companies should be using the "Open Office" Profile. ps. This will also disable "Client Balancing" by default.

PhilipDAth

I would like to see that feature too.

PhilipDAth

Make sure the SSID does not have "Deny Local LAN" enabled. https://documentation.meraki.com/MR/Design_and_Configure/Configuration_Guides/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

PhilipDAth

When you say 10G Ethernet, I'm going to assume you mean fibre-based 10 10Gbe. I would look at the Catalyst 9300X series. I would look at the C9300X-24Y-M and stack it to get to the required port density. Also note that you can add a C9300X-NM-8Y-M module for an additional 8 x SFP28 ports in each switch. https://documentation.meraki.com/MS/Product_Information/Overviews_and_Datasheets/Catalyst_9300X-M_Datasheet

PhilipDAth

In that case, if you want HA Internet, I would use an additional pair of MX at site A and B to provide the Internet access. They would be a warm spare pair. The ENS would plug into those. You would then plug your current branch MXs in behind those.

PhilipDAth

What is a B&G person? Basically you just add the new APs to the Meraki Dashboard network, give them a name, fill in their physical address for the map, physically remove and replace the AP, and then remove the old AP from the Meraki Dashboard network.

PhilipDAth

I am not familiar with Comcast EDI/ENS. Is this a layer 2 or 3 service? In either case, I will refer to it as a WAN. For this kind of configuration, you connect the WAN to the Internet. You could do this by doing that at one location, or by buying such a service from Comcast on the EDI directly. You'll use this topology, except you don't need an Internet connection for the branch. https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS > Goal is to configure Site A and Site B in a failover setup to provide internet to all sites in case of an outage at either location. This would only be possible if sites A and B were adjacent in layer 2.

PhilipDAth

Keep an eye on the upcoming ISE licence changes as well. https://community.cisco.com/t5/security-knowledge-base/licensing-updates-with-cisco-ise-3-5/ta-p/5334843

PhilipDAth

Thanks for letting everyone know. Also, for those following, you can check the status page. https://status.meraki.net/

PhilipDAth

Thanks for joining the community.

PhilipDAth

Is it only one switch reporting this? Are you running a current stable or better firmware? Personally, I prefer stacks of 4 switches. If the stack doesn't have a lot of config, could it be broken into two stacks?

PhilipDAth

We don't know what the Access Manager licences will cost or how they will be licensed yet. The current plan is for it to go GA in November 2025. https://documentation.meraki.com/Access_Manager#Licensing What has been discussed is that you will need the premium product licencing option in each family that you want to use it. This could change. MR Advanced/Advantage: https://documentation.meraki.com/General_Administration/Licensing/Meraki_MR_License_Guide#MR_Features_by_License_Type MS Advanced/Advantage: https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_MS_Licensing#Features_Highlights MX Secure SD-WAN Plus: https://documentation.meraki.com/General_Administration/Licensing/Meraki_MX_Security_and_SD-WAN_Licensing It might also be possible that these premium product family licences are only needed if you want to use Adaptive Policy.

PhilipDAth

Make sure you have LLDP enabled on your Cisco switch ("lldp run").

PhilipDAth

Let me reinforce what @alemabrahao has correctly recommended. You need to configure your Cisco switches to use "spanning-tree mode mst" or you WILL have problems.

PhilipDAth

You could probably do this using Adaptive Policy - but that requires premium licences. Search this page for "inline traffic tagging". https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy_Overview

PhilipDAth

Check out the Meraki example automation scripts. There might be something there as we.. https://github.com/meraki/automation-scripts There is also the "Bulk Network Creation" tool. It hasn't had any love for a long time. It lets you create a CSV file of devices to add to networks. https://documentation.meraki.com/General_Administration/Templates_and_Config_Sync/Using_the_Bulk_Network_Creation_Tool

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges