About RomanMD

RomanMD · ‎07-13-2021

You have not posted the screen with the static route you are trying to configure, but it is not possible to add a static route with a destination subnet of a vlan defined on the MX itself.

RomanMD · ‎07-13-2021

I think it is important to have more details in order to understand your topology. What is the SSID configuration: NAT, Bridge, L3 roaming, etc..? Are there any settings like 802.11r or 802.11w enabled? Are they(APs) connected to the same switch infrastructure? Are they(APs) in the same management Subnet? If the SSID is bridge, is the vlan allowed on all APs?

RomanMD · ‎07-13-2021

Is that the authentication for client? Does your AP have a static IP, or is it DHCP? Is the AP connected to a controller or is EBW? Is the policy checking for NAS ID? I am just thinking that after reconnect the AP is getting a new IP and the Radius packet a sourced from different IP if the policy is not checking for the NAS ID... but I am not radius expert at all... and last but not least - go away from EAP-FAST on ISE<2.6 and iPhones 🙂 I had too much trouble with TLS version miss-match.

RomanMD · ‎07-13-2021

Alternatively, if your clients are connected via Meraki MR access points you could use isolation there. I think what you are trying to achieve, is Adaptive policy, which should be supported by MX'es at a later stage.

RomanMD · ‎07-03-2021

The other option would be, to have Local Dashboard accounts.. isn't it? I think local Dashboard accounts are allowed regardless other authentication options are enabled for the organization.

RomanMD · ‎07-03-2021

You know what, a setting that's often ignored: Go in the Radio profiles and disable Client Balancing which is enabled by default. I have experienced a lot of problems because of Client Balancing, and that should not be enabled if one wants to have a stable environment.

RomanMD · ‎07-01-2021

According to your initial request I think further clarifications are needed. What devices do you manage? Access points only? Or do you have also Meraki MX and switches? I am asking, because you say "but I need a DHCP option 150 to be configured on the Meraki wireless". The DHCP options are set on the DHCP server. So if you have a Meraki MX or L3 switch which acts as DHCP for the Voice vlan - then you can set the option in the Meraki. Otherwise, if the DHCP is still a 3rd party machine (Windows, Linux, Infoblox, etc.) then you have nothing to configure in Meraki.

RomanMD · ‎07-01-2021

Option 150 is not predefined DHCP option, but you always can configure any custom options with values type String, HEX or IP. So, the answer is - yes, you can configure option 150, either on L3 switch or on MX appliance.

RomanMD · ‎06-23-2021

I would connect the Internet Port of the MX to the router via a L2 switch. I would connect with a PC to the same VLAN and start the Wireshark to see the DORA process. Also, make sure that the configuration in Internet Port 1 for VLAN Tagging says "Don't use vlan tagging".

RomanMD · ‎06-23-2021

Hi, 1. you need to know if this is Single Mode or Multi mode fiber. Since you say this is OM4, then it must be Multimode. For multimode: MA-SFP-10GB-SR MS420 does not support 40Gb QSFP modules. 2. same as in the first point.

RomanMD · ‎06-18-2021

@rhbirkelund it only works like this if you have you housekeeping in Excel 😂

RomanMD · ‎06-18-2021

Never used the action batches at all, but I believe that for removing the device the action is "remove" not "delete". Not sure about the Warm Spare config.

RomanMD · ‎06-18-2021

Maybe I've not understood you correctly, but for site-2-site vpn you can either have a default route checked if your MX is in Spoke mode or Exit Hub if it is in Hub mode. If that is what you are trying to accomplish then the /networks/{networkId}/appliance/vpn/siteToSiteVpn should help you do the changes.

RomanMD · ‎06-17-2021

Description:List the uplink status of every Meraki MX, MG and Z series devices in the organization If you don't have any of those devices in the organization, then you will have an empty array, but that's nothing you can't handle. Just check the length of the response array, if it is 0 -> skip and go further or whatever logic you need.

RomanMD · ‎06-16-2021

There is no trick for this. Most probably you are trying to access the shared folders via name which cannot be resolved. You can try to access them via IP address, or make sure you access them via FQDN which can be resolved. Also, worth looking if there are any group policies/firewall rules which will block port 445.

RomanMD · ‎05-19-2021

Unfortunately, you don't seem to be able to do much when the org is in Co-Term. I also found it frustrating but all the Endpoints are mostly for the PDL model.

RomanMD · ‎05-18-2021

The most obvious way is to loop thru the user list: import meraki API_KEY = 'xxxxxxxxxxxxxx' dashboard = meraki.DashboardAPI(API_KEY) network_id = 'xxxxxxxxxxxxxxx' required_username = 'myuser@name.com' users = dashboard.networks.getNetworkMerakiAuthUsers( network_id ) for user in users: if user["email"] == required_username: pprint(user) Pythonic way would be to substitute the for loop with list comprehension: myuser = [user for user in users if user["email"]==required_username] pprint(myuser)

RomanMD · ‎05-18-2021

The Meraki world is not different than normal Cisco world. Having that vlan100 on both MX and core switch and acting as management vlan for switches doesn't sound good for me. That's the only thing that I want to point. We have similar setup in our location. I have the management vlan on MX which is a native vlan on the MX port and acting as management for switches, then another vlan on the switch core for management of the access points. I need another vlan just because S2S VPN, but in your case another vlan for AP's is not needed.

RomanMD · ‎05-18-2021

I don't have the full picture of your network but assuming you only have Mx, switch and Client VPN, and everything is behind the switches then: what is the Management VLAN all about? Is it the management for the switches only? Then it does not make any sense to have the vlan100 interface on the stack. It is better just to have that as native vlan on the MX port. If it is for some other purposes, then again... what's the purpose?

RomanMD · ‎05-16-2021

Have you checked the RADIUS logs from which IP the requests are coming from? If my memory serves me well, when I was testing the Client-VPN the request to Radius were coming with the source IP of the highest vlan id. Now, that you moved the VLANs to the switch, the IP from which the requests are going out to RADIUS have also, probably, changed. Can you verify that?

RomanMD · ‎05-03-2021

I do two three different things: 1. either store in the environment variable 2. either store in the database in the setting table (usually using this when the scripts run on Django) 3. either way - I have an encryption/decryption algorithm, so the key is not stored in plain text. It does not mean that the key is fully safe, as long as one will have access to the algorithms, but at least having the encrypted API key does not make much sense for some ....

RomanMD · ‎05-03-2021

Hello, it is possible, of course. It is possible to create/update almost any settings from from dashboard, but this requires you to be familiar with some programming/scripting language. Assuming that by "blocking IP" you mean that you want a L3 firewall rule or an inbound firewall rule, here are the Endpoint descriptions. https://developer.cisco.com/meraki/api-v1/#!update-network-appliance-firewall-l-3-firewall-rules https://developer.cisco.com/meraki/api-v1/#!update-network-appliance-firewall-inbound-firewall-rules

RomanMD · ‎04-22-2021

NBAR2 will not disturb the clients at all, but NBAR2 will not be available in a mixed environment. I have just discovered this hard way few days ago when my script had trouble adding one AP to a network. You want to read "Disabling NBAR" paragraph. https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Network-Based_Application_Recognition_(NBAR)_integration_with_MR_access_points

RomanMD · ‎04-20-2021

I am totally with Philip. Don't mix. Either build the environment with MR46 (preferred), either only Wifi5. You will start running into different issues and unavailability of certain features like NBAR2. When you'll have the env ready and working and later on you will want to add another wifi5 AP, you will have to disable traffic analysis, add new ap, enable traffic analysis. This one problem, and I am not sure which other may appear...

RomanMD · ‎04-20-2021

I have a replication of Cisco WLC controllers infra in few locations and it is exactly like you said. Except, I am doing exactly like WW suggested - on the switch I have a trunk port with native vlan for management, and other vlans to tunnel different type of clients, including Guests.

RomanMD

Community Record

Badges