About PhilipDAth

PhilipDAth · ‎01-25-2019

You should reach out to a Cisco Meraki partner or a Meraki SE for assistance with designing a network of that size.

PhilipDAth · ‎01-25-2019

Here is a challenge for you - try and find a client with a 160Mhz capable radio to be able to use it.

PhilipDAth · ‎01-25-2019

If you do an nslookup on the MX250 IP address it doesn't resolve to that name by chance does it?

PhilipDAth · ‎01-25-2019

I often struggle with this decision, and usually end up going for a stack. When using a warm spare switch you can not build a LACP channel across the two switches. When using a stack you can build a LACP channel across the two switches. When using a warm spare switch you can firmware upgrade one switch at a time, so at least one switch is always up. When using a stack you can only upgrade the entire stack, and the entire stack will reboot - so a guaranteed outage.

PhilipDAth · ‎01-25-2019

How funny, thanks @NolanHerring. That is where I am going for lunch, in case anyone wants to join me in about 2 hours time. 🙂

PhilipDAth · ‎01-25-2019

It sounds like the switches were not processing multicast traffic correctly. Are you running 10.x (like 10.43) code on the switches? Also check out this excellent post on multicast configuration when you have more than one switch. https://community.meraki.com/t5/Switching/Multicast-Basic-s/m-p/25867#M2125

PhilipDAth · ‎01-25-2019

Symantec had a terrible history with their CA certifcate service. The industry gave up trusting them. https://www.thesslstore.com/blog/final-distrust-symantec-ssl-certificates/ I would say if you downloaded it directly from the Meraki dashboard it is likely to be safe

PhilipDAth · ‎01-25-2019

It's not what you would expect, is it. The URL categorization is a service provided by BrightCloud. It is used by Meraki and many other vendors. https://www.brightcloud.com/tools/url-ip-lookup.php I guess you could regard a VPN service as "Internet Security" - I guess it depends on your view point.

PhilipDAth · ‎01-23-2019

Did the slow down happen after you added the MX100, or after you added the AD controller? Which one of the two changes resulted in the slow down?

PhilipDAth · ‎01-23-2019

Test the AD controller directly. From a CMD prompt go: nslookup server <ip address of AD controller> www.google.com Does www.google.com repsond in a reasonable period of time?

PhilipDAth · ‎01-23-2019

I assume you mean you have added the AD controller as a DNS server under DHCP. I would try running a DNS query against the AD controller and make sure it can resolve queries properly.

PhilipDAth · ‎01-23-2019

I haven't personally used it, but this script has had some attention for being able to create firewall rules from the CLI using Python for the MX platform. https://create.meraki.io/build/mx-firewall-control-python-script/

PhilipDAth · ‎01-23-2019

This is an overview page and includes a link to a webinar if you want to lean more. https://meraki.cisco.com/solutions/sd-wan

PhilipDAth · ‎01-23-2019

Actually the second port can be re-configured, but it can only be done by support, and you have to open a ticket to do it. On the whole it is a pain in the arse, so I wouldn't do it unless you already have the kit and really need to. If it is a for a small low density area, have you considered using the MR30H? https://meraki.cisco.com/products/wireless/mr30h

PhilipDAth · ‎01-23-2019

For Gig1/1/2 and 2/1/2 you wont need to configure anything on the ports themselves. You just need to aggregate that. Follow this guide: https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Switch_Ports#Selecting_Aggregate_ports

PhilipDAth · ‎01-23-2019

For GigabitEthernet1/0/1 you want something like: Below is the most probably config for For Gig1/0/4GigabitEthernet1/0/1. Note that "switchport voice vlan 7" only has affect for an access port - and the port is forcibly configured as a trunk port. Also "spanning-tree portfast" will do nothing, as it is also only used for an access port.

PhilipDAth · ‎01-23-2019

Good discovery @NolanHerring - thanks for letting everyone know.

PhilipDAth · ‎01-23-2019

Stop it, I'll get a big head.:-)

PhilipDAth · ‎01-23-2019

I just had a thought. Because you are plugging in a new "default gateway" (aka it is moving from the Dell to the Meraki) the MAC address of that gateway is changing. Perhaps this might just require someone to clear the ARP table on the remote end. Did you try doing some pings from the MS250 to the indivudual hosts during the last cut over? I guess you should do some pings now before the next cut over - to verify that the devices will respond to a ping.

PhilipDAth · ‎01-23-2019

I don't know for certain. I believe that when the user logins their MAC address becomes "authorised" on the Meraki side. That MAC address authorisation will remain in affect for the configured period. The ongoing authorisation has nothing fuether to do with AD until it expires.

PhilipDAth · ‎01-23-2019

The checks are done when AutoVPN is enabled (so the template should be configured to be a spoke). The subnet must be unique amongst all AutoVPN networks (or will be rejected).

PhilipDAth · ‎01-22-2019

Hmm, that is interesting. I was just looking at a clients MX, and they have manual port forward configured and have dual WAN circuits. We are using SD-WAN - and the WAN ports are running AutoVPN active/active - and it is working. One thing of note though is that their WAN2 has a public IP directly on it - so no NAT is required for AutoVPN to WAN2.

PhilipDAth · ‎01-22-2019

ps. I gave up on using Powershell for scripting. One of the issues with it is that when you start powershell running for a one off job (such as a triggered event or task scheduler (for example)) it has to instantiate the whole .Net engine. This can take a couple of seconds. If you are trying to run a lot of single fire operations this creates big problems. The .Net instantiation is a really slow process, and inherent in the powershell architecture - so can not be fixed. .Net apps suffer the same issue when you recycle their application pools in IIS. I have clients with apps where IIS can't process any requests for 5 minutes after a pool recycle. You may find moving off to other scripting languages like Python will be your best fix.

PhilipDAth · ‎01-22-2019

First I would remove all the compulsory sleep operations you have. The rest is taking long enough without adding those. Start-Sleep -Milliseconds 200 The next thought on my mind is weather this is static routes on an MX or MS. If it is on an MX have you considered using route tracking? https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior#Static_Route_Tracking

PhilipDAth · ‎01-22-2019

Did the MS250 come online in the Meraki Dashboard? It needs to do that to get its config. It sounds like you only had a single port in your port-channel in the VM environment. It should still work not having a port-channel configured on the Meraki side, but just something to consider. I notice if I try to manually configure the port speed I only get 1Gb/s options as well. Did the link light come on for the 10Gbe SFP+? Is the server definately using 10Gb-SR as opposed to LRM or something else? Below is an example of an MS250 that has a 10Gbe SFP+ plugged into port 25 going to a VMWare server environment. This is how it should look.

PhilipDAth

Community Record

Badges