Meraki

PhilipDAth · ‎Dec 4 2017

@cmiarshvac - except for when someone unplugged the coax cable from their machine - anywhere on the network - taking the whole coax segment down. I always had that happening when people were moving machines around.

PhilipDAth · ‎Dec 4 2017

November 2017 Meraki Employee Community Members of the Month @MerakiDave 55 kudos @GeorgeB 20 kudos @RyanB 12 kudos

PhilipDAth · ‎Dec 4 2017

I don't know the answer, but does this help? https://documentation.meraki.com/SM/Apps_and_Software/Using_Apple%E2%80%99s_Volume_Purchase_Program_(VPP)_with_Systems_Manager#Revoking_a_User's_App_License

PhilipDAth · ‎Dec 4 2017

The easiest way is to get a cheap backup connection (or a 4G hot spot with Ethernet ports) and plug WAN2 of each MX into this backup circuit. This keeps both units online and their configs and firmware up to date. Then on primary circuit failure you move the cable from WAN1 on the first MX to the second MX.

PhilipDAth · ‎Dec 4 2017

HI @Jake I wouldn't do that. Setup one SSID for staff and use WPA2-Enterprise mode. Every user and machine is authenticated using their AD credentials. There are no splash pages - staff get in without having to think. Then for guest create a splash page.

PhilipDAth · ‎Dec 4 2017

Thanks @CarolineS. I'm guessing Meraki employees are not eligible ...

PhilipDAth · ‎Dec 3 2017

When statically configuring the IP address make sure you use valid DNS servers (such as Google's 8.8.8.8 and 8.8.4.4). Make sure the serial number on the MX100 matches the serial number of the device in the Dashboard that you are looking at.

PhilipDAth · ‎Dec 3 2017

You can use the current switches.

PhilipDAth · ‎Nov 30 2017

I'm sure you can see the writing on the wall - but the CLI will be getting deprecated from Cisco Enterprise kit. How long, who knows. Everything you know about CLI will be worthless inside of 10 years. One Cisco developer (as in works for Cisco Enterprise) told me he thought Cisco would stop developing the CLI within 7 years. Everything is going SDN - DNA Controller, APIC EM, etc. So now it is a question about which SDN you want to learn going forward .... Python with DNA Controller with a terribly limited GUI, or Python with Meraki with a great GUI. I've changed course, and now back the Meraki path.

PhilipDAth · ‎Nov 30 2017

No one should be using option 5 these days (that was for IEN 116 name servers that pre-date DNS servers). Using the "DNS name servers" is the same as setting DHCP option 6.

PhilipDAth · ‎Nov 30 2017

You could check with your WISP, but they are probably already using encrypted protocols. Yes you could connect it via the WAN ports, and build a "non-Meraki" VPN between the two MX devices. https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Configuring_Site-to-site_VPN_between_MX_Appliances_in_Different_Organizations

PhilipDAth · ‎Nov 30 2017

Note that the Meraki MX family does not support IPv6. If you want IPv6 let me give you some other [reasonably priced[ Cisco options: Cisco 897, comes with Advanced IP, has ADS:/VDSL/Gigabit WAN/SFP and an 8 port Gigabit LAN switch. Cisco 891F, comes with Advanced IP, FastEthernet WAN, Gigabit WAN and an 8 port Gigabit LAN switch The new Cisco 1100 series, comes with IP Base - but runs IOS-XE The 890 series will do around 170Mb/s with "everything turned on". More than likely, they would beat the crap out of your 2811 at a fraction of the 2811 price. I like the 890 series because they come with Advanced IP. They can even do MPLS (I measured them doing 700 Mb/s of L3 MPLS VPN !!!). The Cisco 1100 series is the lowest end platform that runs the "new" IOS-XE. It is comparable to the 890, but it only comes with IP Base. You would probably want to add a security licence to it.

PhilipDAth · ‎Nov 29 2017

In "normal" NAT'ed mode (where you plug your Internet circuit directly into the MX and have a private LAN on the other side) you can't do dynamic routing. You would, as you have noted, configure a static route(s) on your MX pointing to the 4948 for every L3 VLAN it has configured on it. And on the 4948 you could have a single default route pointing to the MX. Depending on how big your home network is, an MX65 could be a good choice since it has 10 LAN ports, and 2 of those are PoE ports. If you have less than 10 devices you don't even need a separate switch anymore. https://meraki.cisco.com/products/appliances/mx65

PhilipDAth · ‎Nov 29 2017

Scheduled AP reboots - if you use Meraki switching you can attached a schedule to a switch port. We use this to power down our VoIP phones and access points at night time when no body is here.

PhilipDAth · ‎Nov 29 2017

Those URLs will very a little bit depending on where in the world you are. Does the below work? *.windowsupdate.com *.microsoft.com

PhilipDAth · ‎Nov 29 2017

Yeah, used it a few times. The thing that catches most people out is that it only applies to new TCP flows. So you make a change, and it doesn't look like it is working. You go away and get a coffee and then it is working.

PhilipDAth · ‎Nov 29 2017

Correct. Note it only affects new TCP flows. Because of this it doesn't always appear to "kick in" immediately.

PhilipDAth · ‎Nov 29 2017

Yes, and if you have Meraki WiFi kit it is even easier - you just select the existing WiFi network you want to push to the devices.

PhilipDAth · ‎Nov 29 2017

Use my method method. Use content filtering, black list *, and then add in the allowed URLs to the wihtelist.

PhilipDAth · ‎Nov 28 2017

1. The APs will only mesh with other AP's using the same channel. Clients can be served on that same channel at the same time. 2. If left to default settings, it will try and mesh with both radios. If you wanted to only mesh on the 5Ghz radio saving the 2.4Ghz radio for clients only, then you need to override the 2.4Ghz channel being used on the AP so that it is different to the others (remember, can only form a mesh link to another AP if it is on the same frequency). 3. You can only mesh with other APs in the same Meraki network. APs in another organisation can not join your mesh network, and will have no effect on it (apart from using up spectrum and bandwidth).

PhilipDAth · ‎Nov 28 2017

Yep, I think changing the default route is considerably messier. I would probably use WPAD first (which is also painful) until you can get the new MX licences.

PhilipDAth · ‎Nov 28 2017

You should need to make the remote sites default gateway point over the WiFi link to the site with the Baracuda, and then have the MX at that site point its default route at the Baracdua. You could also simply configure proxy settings on the machines to point directly to the Baracuda. WPAD is a system of doing this automatically. https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol But ... Why do you need a Baracuda? The MX already has excellent content filtering and reporting ...

PhilipDAth · ‎Nov 28 2017

This article talks about the load monitoring feature. I don't think it is turned on by default, so you might have to ask support to turn it on for you. https://documentation.meraki.com/MX-Z/Monitoring_and_Reporting/Load_Monitoring On the whole you never have performance issues with Meraki MX kit as long as you stay within the sizing guidelines. https://meraki.cisco.com/products/appliances#models

PhilipDAth · ‎Nov 28 2017

That would be correct. Listening to the complexity that you describe, I think you should get a Cisco partner involved.

PhilipDAth · ‎Nov 28 2017

You can get some of this (at least a feel for this) via the Dashboard, except for memory utilisation.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges