Meraki

PhilipDAth · ‎May 22 2018

How many users do you have?

PhilipDAth · ‎May 22 2018

How does the MX64W fit into the picture then?

PhilipDAth · ‎May 22 2018

I'm confused by your question. You configure the MX64 to use RADIUS authentication for VPN users. You point that at the DUO RADIUS proxy (which then points to NPS in Windows).

PhilipDAth · ‎May 22 2018

You need to be using bridging rather than NAT mode, and you need both the client devices and the ChromeCast devices to be located in the same guest vlan.

PhilipDAth · ‎May 22 2018

You can use it using Duo and the RADIUS proxy server (which you'll need to deploy on premise). We have tested it using push notification and it works great. https://duo.com/docs/radius

PhilipDAth · ‎May 18 2018

@Adam is right, the MX will limit the performance to a level where it will operate correctly. So you can happily plug in a much faster circuit. You wont be able to use its full capacity, but the MX will operate without issue on it.

PhilipDAth · ‎May 17 2018

I checked abs the Meraki site is definitely using TLSv1. 2 and and supports strong elliptical curve encryption algorithms. Are you sure the date is correct on your machine?

PhilipDAth · ‎May 17 2018

Is this via the normal dashboard?

PhilipDAth · ‎May 15 2018

Meraki sunglasses?

PhilipDAth · ‎May 15 2018

I crack myself up.

PhilipDAth · ‎May 15 2018

What about a green adhesive dot on the forehead?

PhilipDAth · ‎May 15 2018

Actually it looks like they try to connect to these three URLs: captive.apple.com www.airport.us www.thinkdifferent.us

PhilipDAth · ‎May 15 2018

I think Apple devices try and connect to captive.apple.com to determine Internet access.

PhilipDAth · ‎May 15 2018

Any chance the DHCP scope is running out of IP addresses?

PhilipDAth · ‎May 15 2018

I agree with @BrandonS. I would compared the TCP/IP settings on a machine on your LAN that you can ping to one that you can not. There will probably be a difference. My second guess is Windows Firewall is blocking it.

PhilipDAth · ‎May 15 2018

You might need to update the version of Powershell you are using - or the OS. 🙂

PhilipDAth · ‎May 15 2018

Negative. Did you know using timestamps is a really useful method for resolving throughput and tcp re-transmission issues on asymmetric crciuits, like ADSL? It fixes far more problems than it causes - so I really wish people didn't do this. The threat posed by timestamps and the implementation in OS tcp stacks was resolved long ago.

PhilipDAth · ‎May 14 2018

What is the user doing that is using a lot of bandwidth? Video? File sharing? If it is video you may effectively cripple them. If you don't want them using video it should be disabled on the server. A lot of the Cisco Spark functionality is *free*. Once you use it you wont want to go back to Skype for Business. https://www.webex.com/products/teams/index.html So you know what I think the best way to solve the Skype for Business problem is. Replace it with something better.

PhilipDAth · ‎May 14 2018

This wont be possible. They'll have to use the Meraki Dashboard.

PhilipDAth · ‎May 12 2018

The appliance will not work - at all - without a licence. On the whole, transparent web caching is a useless technology these days. Most content is not cache-able. On the whole I would not advise clients to use web caching.

PhilipDAth · ‎May 11 2018

The MX82 is no longer a current model. This is the spec sheet for the current MX84: https://meraki.cisco.com/products/appliances/mx84 You can read about MX's in general at this page: https://meraki.cisco.com/products/appliances You can buy either an "Enterprise" licence which does basic firewall and SDWAN, or an "Advanced Security" licence which enables malware scanning, content filtering, etc. There is a more detailed break down: https://documentation.meraki.com/zGeneral_Administration/Licensing/Cisco_Meraki_Licensing_Guidelines_and_Limitations#MX_Licensing_Options

PhilipDAth · ‎May 11 2018

Go "Security Appliance/Traffic Shapping". Whatever port you select under "Uplink selection/Global Preferences/Primary Uplink" because the port used for client vpn. Note it can take 10 minutes to kick in after you change it. From where you can configure "Flow Preferences/Internet Traffic" to override this and make all your Internet traffic go back out WAN1 (if that is what you want).

PhilipDAth · ‎May 11 2018

Yes, that compare function is not giving the best answers. Use this sizing guide instead: https://meraki.cisco.com/lib/pdf/meraki_whitepaper_mx_sizing_guide.pdf

PhilipDAth · ‎May 11 2018

I believe you can request higher limits - try contacting support if you need a higher limit.

PhilipDAth · ‎May 10 2018

The first thing to note for the core switches (which will shape a lot of the rest of the answer) is the management IP (which is primary only used by the switch to talk to the cloud) must be in the subnet to the uplink to the Internet. The management network can not use the switch as the default gateway. The management network does not use the routing table in the switch. The default gateway of the management interface must point to the IP address of your firewall/router providing Internet access.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges