About PhilipDAth

PhilipDAth

Why don't you try going to the 14.x firmware. It is very solid.

PhilipDAth

It is likely to cause a port bounce, so I would do it when it is quiet.

PhilipDAth

Has anyone used the Cisco rftool for a real project? https://rftool.cisco.com/ It seems ok from playing with it, and is 1/10 of the cost of things like Ekahau Site Survey Pro. It only supports Cisco APs (including Meraki) but that is not a problem for me.

PhilipDAth

Change the subnet mask from a /24 to a /23 to allow twice as many clients.

PhilipDAth

Not to the best of my knowledge. App updates happen when the app store and the iOS device. Systems manager is not involved in that process.

PhilipDAth

It sounds to me like you are trying to integrate with a captive guest portal rather than the dashboard. In that case, go with RADIUS - but the users will need to authenticate twice - it wont be SSO. You can use the Excap API instead if you want it to be seamless. https://meraki.cisco.com/lib/pdf/meraki_whitepaper_captive_portal.pdf

PhilipDAth

I would choose to use the MX if the inter-vlan bandwidth requirements are low. If the intervlan-bandwidth requirements are high I would use the MS225.

PhilipDAth

This documents the fields that the scanning API returns. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Scanning_API#Scanning_Data_Elements

PhilipDAth

I haven't tried myself, but this is the general guide for it. https://documentation.meraki.com/MX/Monitoring_and_Reporting/NetFlow_Overview

PhilipDAth

Are you running 10.x (or better) firmware on your Merak switch?

PhilipDAth

Are there any firmware upgrades for the TP-Link?

PhilipDAth

You could try using an acces-list with FQDN's. Never tried to block Google this way myself. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Firewall_Settings#FQDN_Support

PhilipDAth

I'm guessing you have an MX, and the first screenshot is from the VLANs on that. And that the second screenshot is from the switches, and that no layer 3 VLANs exist on them. First, all the links between the MX and switches, and from switch to switch should be left as trunks. I would change every other port to being an access port in VLAN1 with a voice vlan of 2. https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_the_MS_Access_Switch_for_Standard_VoIP_deployments After that - you are pretty much finished.

PhilipDAth

Click on the client in the Dashboard, and then apply the policy to them.

PhilipDAth

I think you are in a bit of bind because Meraki DHCP wont let you specify the parameter that you need ("http://10.10.14.3/nevotv/default.aspx"). Do you have another DHCP server someone in the network, so you could configure the Meraki kit to forward the DHCP queries, rather than being a DHCP server?

PhilipDAth

Becase all layer 3 interfaces are located in the MS425 core stack, I think you should enable multicast routing on each of those layer 3 interfaces. The downstream switches should be able to do IGMP snooping and use the core layer 3 interfaces for sending queries too. Generally you want the source of the multicast streams to be as close to the core as possible. I think your design should be fine.

PhilipDAth

You can run AutoVPN over MPLS. This is the deployment guide. It allows for full SDN. https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS You can use MPLS with simple failover to AutoVPN: https://documentation.meraki.com/MX/Deployment_Guides/MPLS_Failover_to_Meraki_Auto_VPN There is also a super new beta feature called NO-NAT available in the 15.x code. The documentation for this has been removed as it is being updated, but you could consider this option as well.

PhilipDAth

I don't think that will work well with Meraki kit. How about putting an outdoor AP permanently outside as a repeater?

PhilipDAth

I would make the bootfile name exactly: http://10.10.14.3/nevotv/default.aspx

PhilipDAth

Can you show the two way conversation? It could just be the end of a TCP connection and it is getting a RST. I can see a FIN being sent first. So it seems ok to me.

PhilipDAth · Re: 192.168.0.0/16: DHCP server on standby MX

Was the Internet connection for the standby MX up and was it showing as online? Was the LAN interface of both the primary and standby MX plugged into the same layer 2 domain, so that they could see each other?

PhilipDAth

I have been told 1Mb/s per camera and it is stored in the cloud exactly as it is stored in the camera with regard to quality.

PhilipDAth

When I hear people are using more than a couple of ISPs I ask why? Typically if you take that some money and invest it in just two ISPs you can get a much better service. Sometimes they are doing it for historic reasons that no longer apply.

PhilipDAth

> If we restrict one MX to connect to ASA in this case using TAG, & make use of the "site to site outbound firewall" to restrict what traffic goes through the tunnel, do you think it should be workable? No. It is not a matter of the firewall rules. The source and destination encryption domain need to match on each end of the VPN. > was to do NAT of traffic before tunnelling You can't do that in this case.

PhilipDAth

If the dashboard says cellular is active - then it must be online because it sent this status update over the 4G connection.

PhilipDAth

Community Record

Badges