Meraki

PhilipDAth · ‎Oct 19 2017

If you think I helped it would be great if you could give me some Kudos.

PhilipDAth · ‎Oct 19 2017

What do you need OSPF to do? Meraki kit itself does not need it, as the routes to remove VPN sites are learnt via the cloud. You only need it [usually] when interfacing to something non-Meraki. This guide says how to use OSPF to allow an MX to advertise remote VPN subnets. https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Using_OSPF_to_Advertise_Remote_VPN_Subnets

PhilipDAth · ‎Oct 18 2017

I don't know the answer for sure - but I don't recall ever seeing an option to configure the logo.

PhilipDAth · ‎Oct 18 2017

Unless you can find something already made, you'll need to use the Dashboard API: https://documentation.meraki.com/zGeneral_Administration/Other_Topics/The_Cisco_Meraki_Dashboard_API

PhilipDAth · ‎Oct 18 2017

@GreenMan that is a false sense of security saying it is not vulnerable because it does not support 802.11r. The issue affects more than just 802.11r. The issue is more fundamental. An worse still - it is the clients that are most vulnerable. It is more important to get every client patched.

PhilipDAth · ‎Oct 17 2017

Do realise that fixing the infrastructure devices is not enough. Every single client has to also be fixed. In fact, fixing the clients will have a greater impact than patching the infrastructure devices.

PhilipDAth · ‎Oct 17 2017

I've pretty much given up using USB sticks. Get a 4G "hot spot" instead that has Ethernet ports on it. The convert port 3 on your MX64 to a WAN port (via the local status page) and plug that into the hot spot. Life will then be simple.

PhilipDAth · ‎Oct 17 2017

Is there any chance that pfSense has some kind of VPN support on it (such as IPSec/PPTP, etc) and Windows is attempting some other kind of VPN before L2TP and getting a response from pfSense which is causing the issue? I would try and make sure all types of VPN are disabled on pfSense.

PhilipDAth · ‎Oct 16 2017

I agree with @Adam, you are not going to see "dumb" devices show up in the topology diagram.

PhilipDAth · ‎Oct 15 2017

What about the port on the Meraki pointing to the device? Is it still auto/auto and is the machine plugging into it set the same?

PhilipDAth · ‎Oct 15 2017

I'm going to guess a duplex mis-match. What does each end report the duplex as? How is the port configured on the HP switch? 1000/full, auto/auto?

PhilipDAth · ‎Oct 13 2017

We can probably solve this now we know the IDS is triggering. Go: Security Appliance/Threat Protection/Intrusion detection and prevention Under "Whitelisted Rules" click "Whitelist an IDS rule". Select the rule that is firing above the in the log.

PhilipDAth · ‎Oct 13 2017

I think you might be affected by the IP Reputation/URL filtering issue. This was resolved in 13.3. I think you should upgrade to the beta firmware. You can read about the issue here: https://documentation.meraki.com/MX-Z/Content_Filtering_and_Threat_Protection/Content_Filtering/Content_Filtering_Troubleshooting "Sometimes, sites will be blocked even though their URL category is not blocked. Usually this happens when the IP has a bad reputation but the URL reputation is good. This happens commonly with very large domains like Google that own many IP addresses and sometimes purchase new IP addresses that have not yet been re-categorized to take their new owner into consideration. In situations like this, these IPs sometimes have a category of 'Phishing and Other Frauds,' or various other categories that may actually be blocked:"

PhilipDAth · ‎Oct 13 2017

And you are saying that if you disable AMP it starts working? If there is nothing in that log then it should mean that AMP is not blocking your traffic. The beta firmware is pretty good. You are unlikely to find any issues if you upgrade to it.

PhilipDAth · ‎Oct 13 2017

If you go: Security Appliance/Security Centre/Events Does anything come up?

PhilipDAth · ‎Oct 13 2017

If you look in the event log for the network - what is the exact reason it gives for the blocking the traffic?

PhilipDAth · ‎Oct 13 2017

Try removing the L7 rules and see if that fixes it. If not put them back. Repeat with the contenting filtering rules. One of those items should get it working again. Tell us which one it was.

PhilipDAth · ‎Oct 13 2017

I've deployed a lot of MX's - and they have never blocked Windows Updates without being configured to do so. Have you configured are layer 7 firewall rules? Can you configured any content filtering rules?

PhilipDAth · ‎Oct 12 2017

You have to create a "Policy Base VPN" in Azure. Then you can build the VPN directly from Meraki to Azure.

PhilipDAth · ‎Oct 12 2017

Self signed? Did you not deploy an enterprise CA server and use that to issue the certificate?

PhilipDAth · ‎Oct 12 2017

Have the Windows 7 got your CA certificate in their trusted root certificate authority list?

PhilipDAth · ‎Oct 12 2017

Band steering requires that the client send an active probe request - and not all clients do. Those that don't wont see the SSID. If the issue you are seeing is that clients can not even see the SSID then disable it - otherwise this is not related to your problem. Upgrading to the beta firmware is a good idea to try. The beta firmware has lots of issues resolved in it.

PhilipDAth · ‎Oct 11 2017

The coverage pattern is almost a 360 degree ball. There is slightly less signal directly behind the AP. The coverage pattern for the MR18 is here: https://meraki.cisco.com/lib/pdf/meraki_datasheet_MR18.pdf I wouldn't worry about it.

PhilipDAth · ‎Oct 11 2017

Apple devices are very much tied to Apple (consider Apple push notifications). Have you got any way to log the DNS queries being made (even if by a packet capture)? If so use that method to get a definitive list of what is needed.

PhilipDAth · ‎Oct 11 2017

Try whitelisting *.apple.com.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges