Meraki

PhilipDAth · ‎Feb 24 2018

If hostname visibility is enabled then you can usually figure it out based on where the traffic is going to. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Hostname_Visibility

PhilipDAth · ‎Feb 23 2018

You can only block DNS entries. So you can block www.website.com but not www.website.com/login.

PhilipDAth · ‎Feb 23 2018

Thanks for the feedback! I don't think I have tested it out on a network with no devices in it. I'll give that a try sometime.

PhilipDAth · ‎Feb 22 2018

With regard to having an IVR to select a "network down emergency" and the comment about the average response time being 2 minutes; The longest I have waited on the phone to get an answer is 40 minutes. 5 to 10 minutes is more typical. I can probably count on one hand the number of times I have had a sub 2-minute answer. Maybe I have just been unlucky. Looking at the average is a bit distorted. What is the 90th (or 95th) percentile, the time in which 90% of all calls are answered? If it is more 10 minutes you probably need to change the IVR ...

PhilipDAth · ‎Feb 22 2018

I have nothing to do with 800-171. Note that only meta-data goes to the Meraki cloud, not actual customer data (or in your case "controlled" data"). You might have to be careful around AMP - but it could only possibly submit something that was sent over an unsecured channel - would hopefully no one wanting 800-171 would be doing. When I have worked with Government bodies, once I explain the different between meta data and their actual user data they seem to be ok. You can also look at the general "trust" page: https://meraki.cisco.com/trust

PhilipDAth · ‎Feb 22 2018

Hi @RodrigoC. There needs to be some kind of formal escalation process. The majority of my support interactions have been good. I have also had a couple that I have not been happy with. I have also requested escalation - and been left with the feeling that it went no where and there was no effect. I'm well connected on the Meraki side of things (if I do say so myself) so I can turn to other channels, but not all customers/engineers have other accessible channels like this. Can I make some more suggestions: * When you ring in, change the IVR is ask if this is a "Network down" emergency (like Cisco TAC). Give priority to "network down" events. * An escalation request should trigger an automatic review by a manager. That manager should probably ask the customer if they would like the ticket "re-keyed" for a different engineer to look at. * Managers should have a pool of much more experience engineers to draw on ("consultants" if you like) to seek their feedback. These people may or may not need to get involved in the actual case.

PhilipDAth · ‎Feb 22 2018

Is the spoke using a full tunnel to the hub and access the Internet that way - and you want to block some Internet requests? Normally I would use the content filtering and block the URL. Not sure how to go about this with only an Enterprise licence.

PhilipDAth · ‎Feb 22 2018

Are the MX's in different organisations, and as a result you are not using AutoVPN?

PhilipDAth · ‎Feb 22 2018

You are correct, that is not supported.

PhilipDAth · ‎Feb 21 2018

It is very simple. Just click on the link I provided and fill in the form and what you would like.

PhilipDAth · ‎Feb 21 2018

You could create a BVI group out of Gi0/0 and Gig0/1 and put them into the same layer 2 domain. Then probably use a /29, so the two MX WAN interfaces are in the same subnet as the 1921. Personally, I would buy a 4 port Ethernet module for the router and use that instead. Much simpler. You probably need the part EHWIC-4ESG. Note that if you only have Ethernet connections then it will be cheaper to buy a Cisco 891F - and the 891F will probably be faster than a 1921.

PhilipDAth · ‎Feb 21 2018

Here is a specific configuration guide covering what you are doing. https://documentation.meraki.com/MR/Splash_Page/Configuring_RADIUS_Authentication_with_a_Sign-on_Splash_Page

PhilipDAth · ‎Feb 21 2018

The cloud will act as a NAS client, sending requests to your RADIUS server. You server then sends back accept or reject messages to allow or deny access. We are talking about guest WiFi with a splash page here. The AP is not authenticating the user. The AP will not be talking to your RADIUS server. The Meraki cloud is the only thing that will be sending RADIUS messages to you.

PhilipDAth · ‎Feb 21 2018

In this case, the NAS client will be the Meraki Cloud, and the cloud will need to be able to talk to your RADIUS server over the Internet. Consequently your RADIUS server would have to be accessible via a public IP address.

PhilipDAth · ‎Feb 21 2018

You can add as many administrators as you like. It is often easier to create a network in your organisation for the client in particular, give them access to just that network, and move the kit into that. If your organisation only includes the demo kit I guess it is a bit easier and you can just give them full access,. I think the Meraki "Try and Buy" program is often easier to use than loaning your NFR kit. https://meraki.cisco.com/lp/free-demo

PhilipDAth · ‎Feb 21 2018

I believe WhatsApp uses the below domain to login, so blocking this using content filtering will probably do it. c.whatsapp.net Or go more aggressive, and just block: whatsapp.net whatsapp.com

PhilipDAth · ‎Feb 21 2018

The answer is "it depends". You will often need a RADIUS server that is connected to the Internet. Have a read over this guide on creating custom captive portals (or are going to use a custom portal - or a built in one?) https://meraki.cisco.com/lib/pdf/meraki_whitepaper_captive_portal.pdf

PhilipDAth · ‎Feb 21 2018

Why of why do they put software like that on machines.

PhilipDAth · ‎Feb 20 2018

@jdsilva is correct - you really want the VoIP system to mark its own packets. I would be really surprised if it doesn't do this already. What makes you think it is not already marking its own traffic? Otherwise you'll probably need a Meraki switch to mark the traffic on ingress. Can I also recommend you check out the Meraki VoIP deployment guide. https://meraki.cisco.com/lib/pdf/meraki_whitepaper_msvoip.pdf

PhilipDAth · ‎Feb 20 2018

Try this extreme step. Unplug everything from the LAN side, then power cycle the MX. Now its dynamic DHCP table will be empty. try re-assigning the fixed IP address and then plug everything back into the LAN.

PhilipDAth · ‎Feb 20 2018

Well, I had a customer with another brand of firewall I will not mention. They had already decided to move to Meraki and the hardware was ready and available. Their existing firewall started regularly crashing (several times an hour) and their Internet ground to a halt. They had no idea why and no visibility. I was asked to urgently attend the site and do the Meraki MX deployment immediately. 10 minutes after I had plugged in the Meraki I had almost all the answers. The circuit has being maxed out with One Drive traffic. I blacklisted the computer asking the person to contact me. Internet performance returned to normal and the company was able to work again. The IT manager (as in the person who asked me to come to site urgently to fix the issue) contacted me saying that had a window pop up on their computer asking them to call me. A short investigation later revealed that the IT managers husband, at home, had dropped 25GB of "Game of Thrones" into their One Drive. This was rectified, and I removed the black list. So the story finished "Happy ever after".

PhilipDAth · ‎Feb 20 2018

If you look at your screenshot you are not accessing google.com, but google.com.ph. Added google.com.ph to your whitelist.

PhilipDAth · ‎Feb 20 2018

What specific Google URL is not working?

PhilipDAth · ‎Feb 19 2018

Changes only take affect on new client connections. If it is only you on the network then give the MX a reboot to force it to happen. Otherwise you probably just need to wait longer (like 10 minutes).

PhilipDAth · ‎Feb 19 2018

Separate your domain names with a comma. If you specify "google.com" it also covers mail.google.com, maps.google.com, etc.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges