Meraki

nst1 · ‎Oct 31 2018

i have more that 2

Pugmiester · ‎Oct 31 2018

Hi @jdsilva Thanks for the pointer. I hadn't realised the best practice guide had been updated. I've stripped out the HA dedicated patch cable and together with dual connections from each MX to each switch, everything is looking rock solid. I think we have a winner.

BlakeRichardson · ‎Oct 30 2018

@maxhest Threatgrid from what I have read isn't cheap. Its based on the amount of users and amount of file uploads so licensing varies a lot depending on your needs. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Grid_Integration#Threat_Grid_and_Meraki_MX_Integration

NolanHerring · ‎Oct 30 2018

@MacuserJim Not a bad idea, however, I don't want it to function at all because I don't want any traffic from a BYOD device using the specific WAN connections for corporate use. So blocking 100% is the only choice to ensure this.

PaulMc · ‎Oct 30 2018

Where do I find / generate certificated in O365? Googling like crazy here, but can't find anything at all..

jdsilva · ‎Oct 30 2018

Yup, this would work just fine. The caveat would be that is WAN2 fails you won't be able to stop your specific VLAN from using WAN1 in the event that WAN2 fails.

PhilipDAth · ‎Oct 29 2018

What you could do is configure the WiFi for pre-paid billing. You can then pre-print the cards with have PIN numbers on them. You can say that the PIN code expires after a set period of time. https://documentation.meraki.com/MR/Splash_Page/Configuring_a_Prepaid_Card_Billing_SSID

Mister_245 · ‎Oct 29 2018

@PhilipDAth wrote: MX units typically get poor performance with DES and 3DES. Make sure you have selected AES type algorithms. Thanks for the tip! During testing I have found that vpn is not the only issue anymore. We get really poor performance through the MX67 for a lot of things but not online speedtests 🙂

MacuserJim · ‎Oct 26 2018

No, you can't use the wireless radio for the device uplink.

Julian96 · ‎Oct 26 2018

Thank you very much for your contributions, I will try what is proposed by MacuserJim

Android914 · ‎Oct 25 2018

@MacuserJim wrote: Sorry, I was making the assumption that would be checked. If it is not checked then it would not uninstall. It would also not install it automatically, the user would need to download it manually from the App Store or from within the "Meraki MDM" app. Okay, that's what I thought. Thanks for the information!

ArpTableCorrupt · ‎Oct 25 2018

No More alerts for the as of this morning 6:30CST AM We had quite a few users from Friday 10/19 - lunchtime yesterday 10/24 that would randomly get blocked access to our File Server, which caused headaches. Would like the ability to "whitelist" an internal server on the IDS & not the "whole ball of wax, LAN/WAN" Being that there is no way to limit "whitelisted" IDS to internal traffic only, it prevented me from being able to whitelist the Rule ID 1-48205. Would like access to a "Meraki Security Threat" team, so when I call support in the future, someone can get me a definitive answer if this is a "waiting on patterns to catch up" or "you are being hacked sir".

BlakeRichardson · ‎Oct 24 2018

Congrats!

OCT_OMG · ‎Oct 24 2018

Have you tried disabling the default traffic shaping rules and entering a custom expression for the hostnames backblaze.com and backblazeb2.com (without the *.wildcard)?

bowersjj · ‎Oct 24 2018

Meraki support verified there is no API endpoint for modifying the MX subnet without having VLANs enabled on the network. Feature request has been submitted.

NolanHerring · ‎Oct 23 2018

Spence, For my solution you will need to have your primary ISP as WAN1 (your DSL) and your secondary (LTE) as WAN2. Then my setup should function as long as you have support make the 'cell firewall rules' apply to WAN2. However if your doing Full-tunneling then all your traffic will go over the AutoVPN to your HUB, so any 'local' internet usage will go over that and you can't block it (that I'm aware of). You would need to do split tunnel and then only send intra-net (internal) traffic over your AutoVPN tunnel. This way Internet traffic will drop off locally, either WAN1 and WAN2, and then with my method you can block guest to Internet over WAN2 (LTE) when it kicks in.

nealgs · ‎Oct 23 2018

Have to agree with PhilipDAth on this one - remove Admin or local admin rights to the PC for users. We're just going through a windows 10 migration and only IT staff now have Admin rights - any software installs come through IT helpdesk. Yep it does increase support calls etc, but does mean less chance of dodgy software causing mayhem on the network etc due to virusesssssss etc. We did block shareware related sites, but had to open up sourceforge.net in order to download some software for IT to use - lol.

MacuserJim · ‎Oct 19 2018

You would need to do this one by one. You'll need to create a new network in the new org, unclaim hardware from the old org, claim it in the new org, and work with Support to un-claim license in the old org, then you can claim it in the new org. It is pretty straight forward, but is tedious. You could leverage APIs to help automate some things, but it is still going to require some work.

RodrigoC · ‎Oct 19 2018

That there is a Meraki Indoor! Whether or not you can replace that device with a newer MR depends entirely on your Dashboard. Since the Indoor predates Cisco Meraki's current licensing model, your Dashboard could be operating in Legacy mode (no licenses required, but no non-legacy devices supported). If you want to replace this device with a more current MR product, you would have to upgrade your Dashboard to Enterprise mode, which would require you to purchase licenses for all your active devices. If your Dashboard is already running Enterprise mode, then you can swap that Indoor for any Meraki AP you please! 😃 - Rodrigo

Glasbatron · ‎Oct 17 2018

Thanks JD. So the other nightmare we also have is that the Client currently only has the rights to the dashboard and that may not change, I guess the AP's will have to go to them for initial configuring before sent out to myself. I will have a play and once set up let you know how I have got on. Thanks for the help

mel-astrosat · ‎Oct 15 2018

Hi Jim. I received word back from Meraki support. It transpires that pcaps on site to site VPN are only possible with Meraki Peer to Peer VPNs. They are not possible on non-Meraki peers. Thanks for your help, it is appreciated. Cheers. Mel

PhilipDAth · ‎Oct 14 2018

I've just re-bound a bunch of networks from one template to another (and the second template was a copy of the first) - and it does reset the IP addressing.

Banfield75 · ‎Oct 11 2018

I´m on it 🙂 Waiting for an answer.

TonyBoy · ‎Oct 11 2018

This is my cisco config ------------------------------------------------------------- router eigrp 100 network 192.168.23.0 network 192.168.253.0 network 192.168.254.0 redistribute connected passive-interface Vlan254 eigrp router-id 192.168.16.1 ! ip default-gateway 192.168.23.254 ---------------------------------------------------------------

Corblimey · ‎Oct 9 2018

No, The EE sim is working fine (although the Meraki registers it as Tesco for some reason). The best way to check functionality and make sure it is live is in Appliance Status -> Tools, then run a Traceroute and MTR on the line, comparing to the WAN connections. On the Traceroute I had pings - but followed by a "N!" when it was not correct On the MTR I had 100% packet loss when not correct Now it's sorted they look similar to the same tests on the WAN lines.

About MacuserJim

MacuserJim

Community Record

Badges