Meraki

PhilipDAth · ‎Jun 6 2019

Are you sure the clients are being dropped into the correct VLAN? Have you got some MR firewall rules enabled, such as disable local LAN access? https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

PhilipDAth · ‎Jun 6 2019

My personal guess is yes. I would do it. Aaron Willette has test it to 500. https://www.willette.works/meraki-mx-sizing/ The "offical" Meraki documentation says it can do 250 (but it is very conservative). So if you feel you don't want to take on this small risk then you would need to get a pair of them, and put half the spokes on one and half on the other. Aaron also has a guide for doing this using templates. https://www.willette.works/active-active-meraki-sd-wan-headends/

PhilipDAth · ‎Jun 5 2019

>Both WAN1 and WAN2 Are you by chance using load balancing? If so, that will cause you an issue. You'll need to establish a flow perference for the VoIP provider to use just one of the WAN circuits unless it fails. I would be tempted to do this based on the public IP address (aka the destination address) being used by the VoIP provider in case the phones are using a different VLAN than you are expecting. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences#Internet_Traffic

PhilipDAth · ‎Jun 5 2019

The vMX is a good choice. This is the deployment guide for Azure. https://documentation.meraki.com/MX/Installation_Guides/vMX100_Setup_Guide_for_Microsoft_Azure It can only run in VPN Concentrator mode. It can easily do 250 tunnels. I'm more familiar with Amazon AWS environments, where it can cope with 500 tunnels.

PhilipDAth · ‎Jun 5 2019

You are not using bridge mode, because you are getting a response from 10.128.128.128, which is only used in Meraki NAT mode. Go back and re-check the settings and change the SSID to bridge mode.

PhilipDAth · ‎Jun 5 2019

Does the MX84 have an IP address directly on its WAN interface, or is it sitting behind another router doing NAT? It sounds to me like a firmware issue with the phones ...

PhilipDAth · ‎Jun 4 2019

I can't see any fields in the API that relate to the public IP address. So I don't think you'll be able to get this information. https://dashboard.meraki.com/api_docs#list-the-devices-enrolled-in-an-sm-network-with-various-specified-fields-and-filters

PhilipDAth · ‎Jun 3 2019

Yes I have had lots of those emails.

PhilipDAth · ‎Jun 3 2019

>Is there a way to copy an AP configuration across Dashboard Networks? An AP doesn't really have specific settings (excluding settings applied via tags). The AP gets it settings from the network configuration. So when you say copy the settings across networks you are really wanting to copy the network settings. An easy way to do this would be to create a new network and tell it to clone the existing network settings. https://documentation.meraki.com/zGeneral_Administration/Organizations_and_Networks/Cloning_Networks_and_Organizations_in_Dashboard

PhilipDAth · ‎Jun 3 2019

I meant put the "Z" at the remote site that is not using a Meraki firewall. It will happily work through NAT behind another firewall. The Z3 could be used in VPN concentrator mode, where it only uses a single interface to connect inside of their LAN. They would just add a route on their non-Meraki firewall for your subnet(s) via the Z3. https://documentation.meraki.com/MX/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z-series_Teleworker_Gateway

PhilipDAth · ‎Jun 3 2019

If you advertise the more specifix prefixes it should work.

PhilipDAth · ‎Jun 3 2019

>my concern is that they will loose the tunnel in case ISP1 fails because the standby MX ISP1 won't kick in until both ISP1/ISP2 at the active MX fail, correct If ISP1 completely fails, correct, you are dead. If MX1 fails however MX2 will take over the VIP address. There is no clean way of handling the failover for non-Meraki VPNs. Another option is to get them a little Z3 and have them pretend it is an MPLS router, and plug it like they would plug in an MPLS router in their environment. Then you can still use AutoVPN.

PhilipDAth · ‎Jun 3 2019

>Does anyone know if I can set the Meraki kit to use TLS 1.2? I'm not sure about this one - but this is only used by the test function. The actual TLS session is between the WiFi device and the RADIUS server. Those two need to be talking a compatibile protocol. I would be aiming to only support TLS1.2 these days.

PhilipDAth · ‎Jun 3 2019

Keeping trying @jdsilva, you are going to get the top spot soon, and it will be much deserved.

PhilipDAth · ‎Jun 2 2019

The best solution is to use a pair of MX in a warm spare configuration, and then use the VIP option. The remote VPN end points then build their VPNs to this redundant IP address. This only works for a single ISP. There is no great solution for building across two ISPs. If the remote party supports building a VPN to a DNS name then you could consider using a service like Amazon AWS Route 53 with DNS health checks. This feature allows a DNS entry to be updated based on weather the circuits are up or down (more specifically respond to pings in this case). https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

PhilipDAth · ‎May 31 2019

>6 MS 210 access switches (stacked) You can stack MS225 and MS210 switches together. MS225 switches have 10Gbe uplinks. So if you varied your parts list slightly to: 4 x MS210 2 x MS225 (all 6 switches stacked together) You could run dual redundant 10Gbe links back to your MS425. If you don't care about having the uplinks spread across two switches you would only need a single MS225. I would also consider creating two stacks of three switches, which each stack containing: 1 x MS225 2 x MS210 This has the same number of switches as before. When you upgrade a switch in a stack it upgrades all stack members and reboots them simultaneously. If you create two seperate stacks like this if halves the blast foot print. Also it a stack should malfunction for some reason it again only affects half of the ports. If it was me, I would create two smaller stacks for the access layer rather than one large stack. Also here is the campus switching design guide: https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MS_Switching/Large_Campus_Switching_Best_Practices

PhilipDAth · ‎May 31 2019

In my opinion, there is no good way to accomplish this. This is about as good as it gets.

PhilipDAth · ‎May 31 2019

When assigning group policies using this method the Meraki kit watches http (and only http) traffic to identify what the client says it is using. Typically group policies applied in this way can be slow to apply as a lot of web traffic is https based and being encrypted it can't see what the client it says it is. It has to wait till it sees that http request. This method doesn't tend to be very reliable. So don't use it for strict enforcement. Use it where it would be nice if it detected the OS correctly but not a big issue if it doesn't.

PhilipDAth · ‎May 31 2019

This guide includes a screenshot: https://documentation.meraki.com/Architectures_and_Best_Practices/Auto_VPN_Hub_Deployment_Recommendations#NAT_Traversal

PhilipDAth · ‎May 31 2019

Yes it could. It means there is something doing NAT in front of the MX. You could try upgrading the firmware of whatever that device is to resolve the problem. There is also a troubleshooting guide here: https://documentation.meraki.com/MX/Site-to-site_VPN/Troubleshooting_Automatic_NAT_Traversal_for_Meraki_Auto_VPN You could also manually forward a UDP port on that upstream router to the MX and configure the MX to use manual NAT traversal. https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Settings#NAT_Traversal

PhilipDAth · ‎May 31 2019

15.x code is beta.

PhilipDAth · ‎May 30 2019

A vMX is strictly a VPN concentrator. It does not do NAT. You should be used Azure itself to do NATing to any host you have in Azure.

PhilipDAth · ‎May 30 2019

Why not create a new switch template within your network template, and then apply that new switch template to your switch? https://documentation.meraki.com/zGeneral_Administration/Templates_and_Config_Sync/Managing_Multiple_Networks_with_Configuration_Templates#MS_-_Switch_Templates_and_Profiles

PhilipDAth · ‎May 30 2019

You wont need ot add a static route on the MX side. I would start at the ASA at HQ and see what it is reporting.

PhilipDAth · ‎May 29 2019

What does your RADIUS server log say? If it allowing or denying the users? If it is denying them what reason is it giving?

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges