Meraki

PhilipDAth · ‎May 24 2019

I have a couple of Windows 10 machines we use it with as well. They work ok.

PhilipDAth · ‎May 24 2019

You need to deploy NPS with the MFA plugin.

PhilipDAth · ‎May 24 2019

Yes.

PhilipDAth · ‎May 23 2019

I don't like mixing different WiFi technologies within a single site, especially if a client can see both the old and new technolgy at the same time. I've had issues in the past with clients trying to connect to newer technology APs when the conditions are bad rather than using the older AP next to them. So that precluded me from using the MR55's at HQ. The MR55's should ideally be plugged into MGig switches. So that precluded me from re-locating the MS355 switches. The MR67W has an 802.11ac AP, while the MR18 is 802.11n. So I preferred the newer technology. So all of my sites had a minimum of 802.11ac. I considered re-locating the web server, but I didn't know what it is for. Sometimes if you are doing heavy data processing you want the data local to the site. For example, I have a customer in the print industry. Customers can upload files many hundreds of meagbytes. They then transfer these to the local rasterisers and then to the local printers.

PhilipDAth · ‎May 23 2019

You will need to make contact with your local Merkai sales rep. Their is an internal "Country of Origin" tool that have access to which will answer this question.

PhilipDAth · ‎May 23 2019

That was quite an involved challenge requiring a lot of knowledge about various Meraki products and their capabilities and network topology as well. Thanks for the acknowledgement.

PhilipDAth · ‎May 23 2019

I don't agree @rhbirkelund. A domain validated certificated is just that - domain validated only. You can do this manually, or you can do it programatically (which Lets Encrypt does) - but it is that level of validation that establishes the security or safety of the system, and not weather a user proceses the request themselves via a website or a program does. Probably the biggest plus with Lets Encrypt is that it only issues certificates for 3 months. This is a huge step forward for security when a breach or theft occurrs, as it sets the maximum time scope. It's like a password change policy. The old human issues certificates can be issued for up to 2 years - 8 times longer.

PhilipDAth · ‎May 23 2019

The other big issue is the iPad Touch doesn't have a GPS chip - so it can't report its real location. It uses a simulated system of which SSID it is connected to and which public IP it is connecting to the cloud from to "guess" its location, but this is not something you could rely on down to a single building.

PhilipDAth · ‎May 23 2019

With Cisco Enterprise kit the management plane is used to intiate connections into the device and control it. It can often bve unecrypted using telnet and SNMP v1 or v2c. Also anyone having dirtect access can attempt a DOS attack and prevent you getting into your own kit. So there is some good reason to protect this. Meraki kit uses an encrypted outbound stream to the Meraki cloud. So I don't personally bother with a seperate management network. You can also disable the Meraki local status page to further protection. The only special exception you could consider is when using SSIDs with WPA2-Enterprise mode. However a feature was recently added to allow RADIUS traffic to be sent over a seperate VLAN. Personally I tend to use the one VLAN. Changing the native VLAN is mostly related to preventing VLAN hopping attacks. If this is of a concern you should use a different native VLAN on trunk ports between switches. For safety, this should be a VLAN not in use in the network. You want every valid VLAN to be tagged between switches. You don't really need to use it in other places. Personally, I wouldn't worry about it.

PhilipDAth · ‎May 23 2019

You don't so much as import or sync owners - but the devices can authenticte against Azure AD, and then you see those owners in the Systems Manager portal. We set it up using the first link you supplied. We have only used it with modern Android devices.

PhilipDAth · ‎May 23 2019

Meraki should trust LetsEncrypt. Their CA is dual signed by someone else who I can't remember as well, so it really should be trusted. Maybe try using SSL tester to make sure it isn't something dumb like a weak hash for weak cipher is being used. https://www.ssllabs.com/ssltest/

PhilipDAth · ‎May 22 2019

The only way to do that would be to operate the MX in layer 2 mode - but that fundamentally changes a lot of things, so you wouldn't want to do that. You could use a switch/VLAN on the outside of the MX, and plug your device into that (outside of the MX firewall). Otherwise no.

PhilipDAth · ‎May 21 2019

You would need to upgrade to the 15.x beta code. Then on the address page you'll see a NO-NAT page.

PhilipDAth · ‎May 21 2019

I hate to say it say it but you are going to need to try the SIM in another device like a phone. Perhaps it has a SIM lock on it or something dumb like that.

PhilipDAth · ‎May 20 2019

>From there, can i know which mac is from PC or IP phone? If they are in different VLANs then enabled the VLAN column in the dashboard in the clients view.

PhilipDAth · ‎May 20 2019

You will see all mac addresses being forwarded through the port.

PhilipDAth · ‎May 20 2019

I think I would use two SSIDs, one for client isolation and for for devices that are shared. I would stick to using bridge mode. You can read about client isolation here: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Wireless_Client_Isolation

PhilipDAth · ‎May 19 2019

Any chances the devices have recently had a manufacturer firmware update?

PhilipDAth · ‎May 19 2019

I wonder if anyone else has run into this problem before. I have a client using a vMX in Azure and they are reporting 4% packet loss to all the VMs in Azure from the spokes. It doesn't matter which VM is being pinged, and it doesn't matter which spoke the ping is being done from. Spokes can ping other spokes with zero packet loss. The issue happens consistently 24x7. You do about 100 pings and you will loose about 4 of the packets. The packet loss tends to be spread out. If you do a ping within the Meraki dashboard there is zero packet loss between the vMX and any spoke that I test. There are no interesting events in the event viewer, and the status bar for the vMX and spokes is solid green. The VMs in Azure can ping the vMX with zero packet loss. The issue only happens when traffic is routed through the vMX to a remote spoke (or from a remote spoke being routed through the vMX to the Azure VMs). The vMX and all MX's are running 14.39. I have tried rebooting the vMX and a small selection of MX's. I have also had a small number of the Windows VMs rebooted. The VMs are running different versions of Windows Server as well (so there is nothing in common). Nothing has made a difference. Any one had issues with small amounts of packet loss to VMs in Azure connected via a vMX?

PhilipDAth · ‎May 17 2019

I'm with @jdsilva, try and old fashioned cross over cable.

PhilipDAth · ‎May 17 2019

I want to tell you the answer is "no". However if you enjoy a lot of grief it should be possible using a RADIUS proxy solution. I think Jump Cloud is quite well known in this space: https://jumpcloud.com/ But if it was me I would tell the person making the request "no". But that's me. I don't like lots of complexity and grief.

PhilipDAth · ‎May 16 2019

I don't see any issues with managing both, and I can't see it making any difference which one you do first.

PhilipDAth · ‎May 16 2019

What is the authentaction for? WPA2-Enterprise mode? Group policy assignment? Client VPN? Yes, I would also use two authentication servers where possible.

PhilipDAth · ‎May 15 2019

If the policy is "open" why do you need to list anything?

PhilipDAth · ‎May 15 2019

That could be nasty to find. I'm going to guess something in the area (maybe not on your WiFi network) is using up RF spectrum on some kind of check in cycle. Hopefully you are using 5Ghz to minimize this issue.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges