About PhilipDAth

PhilipDAth · ‎08-16-2020

For Apple you need the devices in Device Owner mode (such as via DEP or enrolled via Apple Configurator on a Mac) to enforce things. And when you do it this way, the licences are bought through the Systems Manager Apple account.

PhilipDAth · ‎08-16-2020

I've done it for vessels that operated near the coast where it was not essential to the vessels operation. You'll want to use devices without PoE built-in (like MX64, MX67) because they can run off 12VDC (use a 5A fuse). All other PoE devices require a 54V feed (or you plug into 100/240VAC). In the case we did, we used both cellular data and a data link that ran over a radio band (I don't know anything else about the data radio, it was an existing system). You might be interested in my Meraki GPS project as well. https://www.ifm.net.nz/cookbooks/meraki-gps.html

PhilipDAth · ‎08-16-2020

You could achieve something by disabling the local status page (under Network-Wide/General) and then making your process that someone has to enable it (which causes a log entry to be made), make their change, and then disable it.

PhilipDAth · ‎08-16-2020

@CameronMoody , the Systems Manager FAQ lists Android 4.4.4 as supported when it is not. https://documentation.meraki.com/SM/Other_Topics/Systems_Manager_FAQ

PhilipDAth · ‎08-16-2020

As I understand it, Android 5.x is still supported but I don't know this for a fact.

PhilipDAth · ‎08-16-2020

You should also make sure you choose an account that is not used for anything else "Apple". It should be 100% exclusively used by Systems Manager and Apple DEP.

PhilipDAth · ‎08-16-2020

Changing the certificate and ID - I think you are going to need to re-enroll all of the devices (which involves wiping them). Perhaps the Apple reseller can update this otherwise it can only be done via Apple Configurator and plugging the device directly into a Mac (can't be done on a Windows machine). Hopefully the Apple reseller can update DEP.

PhilipDAth · ‎08-16-2020

Are these clients sitting behind a hot spot by chance? What type of client is it? Windows 10?

PhilipDAth · ‎08-16-2020

Yes, but the switch stack will constantly show a warning because a stack cable is missing.

PhilipDAth · ‎08-16-2020

Like @CptnCrnch says, I don't see anything in the screenshot mentioning L2TP. So I would say no.

PhilipDAth · ‎08-16-2020

Does your solution only require unicast to work, or does it also need multicast? If it only requires unicast it should work fine. Chromecast multicast is "link local" by design (by using a TTL of 1) so Chromecast tells networking kit not to distribute its multicast packets to other VLANs. The networking kit won't be able to override the TTL advertised by Chromecast.

PhilipDAth · ‎08-16-2020

I'm with @GIdenJoe . There are a lot of layer 2 loops in that design. You should have the distribution switches plugged into the core switches. If geography does not permit this, then you may need to co-locate a pair of switches with the MXs and make them the core switches, and have a separate server switch block (if that is the reason why the "core" switches can not be near the MXs). I would follow the campus design guide: https://meraki.cisco.com/lib/pdf/meraki_campus_deployment_guide.pdf

PhilipDAth · ‎08-16-2020

Has anyone used the firewall object beta and 1:1 NAT? I can't seem to get the inbound 1:1 NAT to work. A packet capture shows the packets being received by the MX, but not leaving the LAN interface.

PhilipDAth · ‎08-13-2020

You can keep using the v0 scripts. To use the v1 API you'll need to re-write the scripts. The v1 API is a lot more logically laid out.

PhilipDAth · ‎08-13-2020

Oh I see, SIG is some kind of VPN tunnel system. Ok - I've never seen support for that. But with native umbrella protection, why would you need it?

PhilipDAth · ‎08-13-2020

This is a screenshot from one of our clients using a Z3 with the native Umbrella Integration. They do not have the Umbrella DNS servers configured anywhere. It is all natively integrated.

PhilipDAth · ‎08-13-2020

It sounds to me like some critical communication is being blocked. Is there anything doing firewalling between the device with SM and the Internet?

PhilipDAth · ‎08-13-2020

You can use Umbrella with a Z3. It supports native integration via the API. I don't know how many VPNs it would support. I expect the number would be small. It is only intended to be a spoke.

PhilipDAth · ‎08-13-2020

> Well, it's Cisco best practice to use 192.0.2.1 as virtual ip for web authentication. No, I don't think that is the case. They merely use it in their documentation - you know - the block reserved for documentation.

PhilipDAth · ‎08-13-2020

You don't really get to choose the size in either Amazon or Azure. And the VMX only terminates VPNs, so user count is not really a factor. Check out this guide. https://www.willette.works/meraki-mx-sizing/ Basically you can do up to 500 concurrent VPN tunnels. If you need more than this you need to use multiple VMX appliances.

PhilipDAth · ‎08-12-2020

Could you get someone to do a post on meraki.cisco.com/blog/ please about this please. I would like to publicise it further. Also if they could include some kind of cool graphic in the post that would be great.

PhilipDAth · ‎08-12-2020

There is no such API and I haven't seen any talk of one being created. You could try making a wish. https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Make_a_Wish Make sure you include the use case, rather than just saying you want it.

PhilipDAth · ‎08-12-2020

If the MX is the default gateway an easy option is to use group policy. https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies If your case, you could use the built-in group policy called "Blocked".

PhilipDAth · ‎08-12-2020

Thanks for that @helgaali . I've talked to many customers about this, but haven't actually had the opportunity to do one of these yet.

PhilipDAth · ‎08-12-2020

Seems a good a location as any. I guess if you were looking at the global population it should probably be China or India. If it was by active networks then either Europe or the US.

PhilipDAth

Philip D'Ath

Community Record

Badges