Meraki

PhilipDAth · ‎Nov 27 2017

That would not be a good design. If you want to use AutoVPN everywhere, then traffic to the remote AutoVPN branches must go via the MX at the DC - and not directly to the WAN tail.

PhilipDAth · ‎Nov 27 2017

Your scenario discussed will work. There are two common scenarios when deploying with a WAN. You run a VPN over the existing WAN, and this is the guide used for that: https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS The other is where you simply route over the private network (and you can fail over to AutoVPN): https://documentation.meraki.com/MX-Z/Deployment_Guides/MPLS_Failover_to_Meraki_Auto_VPN My preferred approach is to use the first method, where a VPN runs over everything. I also configure the DC exactly the same as a branch. I typically plug a backup Internet circuit into the second WAN port on the DC unit so if branches also have a separate Internet circuit they can fail over.

PhilipDAth · ‎Nov 27 2017

Apart from any config you may have done on the local status page, all other config is kept in the cloud. So it is as easy as removing the old unit from the network and adding the new unit, and the new unit will download the existing config from the cloud.

PhilipDAth · ‎Nov 26 2017

I'm going to assume you are using your MX in NAT mode (the default). You have two WAN ports. You currently have one connected to the Internet. You should use the other WAN port for this stub network.

PhilipDAth · ‎Nov 24 2017

How is your MR18 getting power?

PhilipDAth · ‎Nov 24 2017

I would recommend not using a VPN over your WiFi circuit. You can assign a /30 stub of private IP addressing as mentioned. I recommend you following this guide for configuring the MX's to use a private MPLS network with VPN failover. In your case, the WiFi link would be the "MPLS" network (the only important bit is that this is a private network), https://documentation.meraki.com/MX-Z/Deployment_Guides/MPLS_Failover_to_Meraki_Auto_VPN

PhilipDAth · ‎Nov 24 2017

Are you referring to transparently sending client traffic through a proxy, such as like WCCP? If so you can't do this. Your closest option would be to use a WPAD configuration. https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol

PhilipDAth · ‎Nov 24 2017

That suggests a physical connectivity issue. Does your MR18 plug directly into a switch, or does it go via something else like a power injector? Have you tried plugging it into a different port on the switch?

PhilipDAth · ‎Nov 23 2017

Plus spanning tree support.

PhilipDAth · ‎Nov 23 2017

Are you connecting from "outside" of the MX? You can't VPN to it from behind it.

PhilipDAth · ‎Nov 23 2017

Try using content filtering. Blacklist the URL pattern: * Then add in the URLs you want them to be able to get to. Note it only takes affects on new flows, so if you change it you don't always see the impact immediately.

PhilipDAth · ‎Nov 23 2017

I don't believe that they have this capability.

PhilipDAth · ‎Nov 23 2017

What firmware version are you using?

PhilipDAth · ‎Nov 22 2017

If you don't need L3 configured on a VLAN why not just remove the layer 3 config, so it is a layer 2 VLAN only? Or are you using the switches for routing as a default gateway? IP summarisation is the only clean way to handle this - which is what you have already started doing.

PhilipDAth · ‎Nov 22 2017

I remember how I did this now! Go: Security Appliance/Site to Site VPN Under "VPN settings/Local networks" you can put in all the subnets you use in AWS from all the availability zones in the region.

PhilipDAth · ‎Nov 22 2017

It constantly scans the domain controllers event log for login and logout events. Yes, the more users the more resources required. Now you know why Meraki publish a guide suggesting boxes based on the number of users. The more users the more RAM and CPU are required. If you are worried about users changing their MAC and IP addresses then you are not going to be protected with either way. You probably need to deploy additional measures such as 802.1x, IP Source guard and dynamic ARP inspection at the switching layer (I'm not sure the Meraki line up have IP Source Guard and Dynamic ARP inspection available yet).

PhilipDAth · ‎Nov 22 2017

I think Meraki relies on a "logoff" event. If another user log's on using the same IP address then that also updates it. I'm not sure why you would need a session time out if you are tracking the actively logged in user?

PhilipDAth · ‎Nov 22 2017

I'm going to guess it is devices attached to your WiFi and then simply not authenticating. It could also be a device attaching and then trying to authenticate with the wrong credentials.

PhilipDAth · ‎Nov 22 2017

You can't use splash pages if you have Active Directory integration turned on. Have you by chance got Active Directory integration enabled? https://documentation.meraki.com/MX-Z/Access_Control_and_Splash_Page/Access_Control

PhilipDAth · ‎Nov 21 2017

Yes, well done!

PhilipDAth · ‎Nov 21 2017

There is no such function. What you can do is clone the current network to a new network ("such as test") and the put just your test AP into that network. Also turn off the alerts for your test network.

PhilipDAth · ‎Nov 20 2017

I assume we are talking about "Organisation/Summary Report". Are you using the "new version"? I think there is a link in the top right hand corner to change to this one. Then you can click on "customize report" in the top right hand corner. Note there is currently a bug where if the browser window is too narrow that the "customize report" button does not work.

PhilipDAth · ‎Nov 20 2017

What kind of device is being used? MX? MS?

PhilipDAth · ‎Nov 17 2017

The template applies an initial subnet configuration - I never use that. You can then just go in afterwards and apply the IP addressing scheme you want.

PhilipDAth · ‎Nov 17 2017

You can't do that. But I can give you a clever work around. Create two identical SSIDs. Configure one to only operate 10:45 am - 1:00 pm, and the other to only operate 7:00 pm to 8:00 pm. A bit messy - but at least it works.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges