Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About MerakiMed
Community Record
72
Posts
9
Kudos
1
Solution
Badges
Mar 19 2021
11:04 AM
1 Kudo
url https://media.p-n.io/..., server 99.84.203.69:443, category Questionable I do see where cloudfront was getting blocked. But this was from a PC and not a phone. I had been hopeful that traffic to google NS was the culprit. But alas not seeing it. But thank you for the idea! Content filtering blocked URL url https://dns.google/..., server 8.8.8.8:443, category Proxy Avoidance and Anonymizers
... View more
Mar 19 2021
10:40 AM
Brilliant. I'll have a look.
... View more
Mar 15 2021
2:20 PM
Thanks much Bruce. It's a simple hub network - just a bunch of VLANs off of a Nexus 9k. But with so many branch offices hanging off it I'll certainly want to get it right.
... View more
Mar 15 2021
1:51 PM
When I originally setup my Meraki hub device I put it behind the Cisco ASA firewall. It is setup in one arm mode. The problem is I'd like to reduce the amount of traffic running through the ASA by putting an interface of the Meraki outside and one inside. I can spot the place where I would change the WAN IP and then patch to the edge router. But I'm not spotting where the other ports are configured. I want the device and it's failover peer to remain hub but want it positioned more like a traditional firewall. Any advice appreciated.
... View more
Mar 12 2021
1:40 PM
Thanks for the tip on ping.pe - that tool is awesome and showed right away that 1/3 or so of all ISPs can't ping their provisioning servers while all can reach their www.ringcentral.com server.
... View more
Mar 11 2021
9:53 PM
This is more of a general WAN and TLS troubleshooting question than Meraki per se as I think we've mostly ruled out the Meraki MX67 as the cause. But I haven't run into this kind of issue in some time and perhaps an engineer will have a thought of the best way to approach this. The problem report which started about a week ago was Polycom phones were failing to be provisioned at ring central's provisioning server pp.ringcentral.com 199.255.120.237. This was true for at least one branch off with a Meraki MX and possibly more. Also note that the MX could not ping the provisioning server where as most other sites could. All traffic is permitted outbound and there was no content filtering nor AMP blocking going on. To make a long story short TAC suspected something in path between WAN1 of the MX and the provisioning server was causing the issue. To test I upgraded to v15.45 on the MX which gave the ability to select a network to source route via the tunnel to the data center/MX Hub. Once I sent the provision traffic (TCP 443 TLS) and it egressed the firewall and NATTed to the data center Ip block - then the phone could register no problem. And as the DC is close to the branch office this should cause no voice quality issues. A MTR traceroute from the Comcast Business connected MX67 is below. The ping and traceroute failure could be a red herring or it could be an indicator of an issue such as an asymmetric pathing problem to the provisioning server. I am dreading involving Comcast on this as their folks give very basic support even on escalation. And Ring Central is also difficult to get to an actual engineer to look at the reverse path, look at the traffic etc. How would some of the engineers approach this issue? I took a look at RIPESTAT https://stat.ripe.net/widget/bgplay#w.resource=26447 in hopes of perhaps seeing some BGP path changes that could be relevant. But it seems to only look back two days. Any other tools I could use to troubleshoot this myself without involving Comcast or RC? Or if I do reach out to one of them - any tips to getting so someone who could really dig into the issue? Sending all the VOIP traffic over the tunnel isn't ideal. The last hop in the MTR is Comcast. https://mxtoolbox.com/SuperTool.aspx?action=arin%3a66.208.228.242&run=toolpage Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. x.y.68.137 0 10 0.8 0.8 0.6 1.1 0.2 2. 68.87.200.49 0 10 0.7 0.7 0.7 0.9 0.1 3. 68.87.200.53 0 10 0.9 0.9 0.7 5.0 1.7 4. 162.151.18.133 0 10 0.9 0.9 0.8 11.7 3.6 5. 96.110.41.109 0 10 4.5 4.5 4.3 4.9 0.2 6. 96.110.46.42 0 10 4.3 4.3 4.0 4.7 0.2 7. 96.110.37.178 0 10 5.0 5.0 4.8 6.4 0.8 8. 68.86.88.18 0 10 4.5 4.4 4.2 4.5 0.2 9. 66.208.228.242 0 10 4.0 4.0 3.9 4.1 0.1 10. ??? 100 10 0 0 0 0 0 11. ??? 100 10 0 0 0 0 0
... View more
Mar 11 2021
8:37 PM
The end of the mystery appears to be in the treatment of traffic nearing pp.ringcentral.com from the external IP of the MX67 which is provided by Comcast. And the issue may involve multiple sites as we use Comcast a lot. I'll ask a troubleshooting specific to this kind of suspected asymmetric traffic problem. I've dealt with a couple in the past but man it's time consuming and frustrating.
... View more
Mar 11 2021
9:01 AM
Nope - definitely not blocking. I starting thinking blocking based on the retransmits. Today I found that the phones still aren't provisioning. So I'm not sure why the pcaps changed last night. I was doing it all remotely and couldn't corroborate what was happening with the phones themselves.
... View more
Mar 11 2021
6:23 AM
Thanks for pointing that out. So I went and searched in Event Log and.. 1) It appears I can't search based on the URI destination. 2) I searched based on the client IP of the phone and nothing shows up there. 3) I went back and searched Security Center once more but by client IP. Nothing. II may just need to open a ticket to find out why the filtering started on an ostensibly allowed category and why the traffic denied or allowed is only visible if I run a pcap but not in event log or security center.
... View more
Mar 10 2021
8:53 PM
In Content Filtering I went to the Allow URL and added pp.ringcentral.com. The next time I did a packet capture for that phone it showed registered 200 OK. Good call! So two add on questions - why could I not see this blocked traffic in Security Center? And I wonder why/how the content filtering changed such as to put the kybosh on my phones provisioning.
... View more
Mar 10 2021
8:39 PM
Thanks much. I pasted a screen grab of the pcap of a phone that's trying to provision in the original question.
... View more
Mar 10 2021
8:06 PM
in the last week phones stopped being able to be provisioned in Ring Central. They need to get to pp.ringcentral.com:443. Pings to that site from a branch office with Meraki is failing. But pings and https traffic to other sites works. My first through to troubleshoot tomorrow will be to have a phone that needs to be provisioned and do a packet capture to see what's going on during that attempted provisioning. But it's been some months since I looked at firewall looking. Is it possible to view all conversations allowed through the MX for a time period? I went to Sec & SD WAN/Security Center and selected all dispositions allowed or not. I started to enter the IP address of the provisioning server at RC 199.255.120.237 and the search box suggested I really wanted was remote_ip:199.255.120.237. Ok good enough. I hit enter and the time window is set to an overly generous 2 weeks. But still nothing shows up in the results. Am I searching for these conversations in the wrong place? Also a snapshot of the conversation is below. It looks like a phone 10.1.61.24 it trying to provision and the RC server is requesting a certificate 1.2TLS. Then the client ends up sending the cert but resending and resending. Any thought what's going on? Invalid certificate? Thank you.
... View more
Mar 10 2021
6:55 AM
This is good news and I'm looking forward to testing. One question however: In the AnyConnect on MX vs ASA document below - in the Authentication section - nothing is mentioned about RADIUS nor Active Directory authentication of users. Is that an oversight? I searched the document for radius and active directory /AD and not spotting anything. Ideally I'd also like to be able to use Azure 2FA. Not sure if that's on the horizon. If I go to the Dashboard and look at Client VPN I see RADIUS. Does that apply to AnyConnect connections? https://documentation.meraki.com/AnyConnect_on_ASA_vs_MX?mt-draft=true
... View more
Nov 19 2020
3:21 PM
1 Kudo
I just got my first Meraki MX68W. It seems perfect for the micro offices with its built-in WiFi. BUT - I don't spot a mechanism for a guest network where I could allow guests Internet access only and no LAN nor internal WAN access. Anyone have a work-around idea on this?
... View more
Nov 17 2020
5:54 AM
Thanks. That saves me from hunting further! It's surprising though in that it seems like it would be nothing to add. Guess I could put it in as a wish.
... View more
Nov 16 2020
9:15 PM
I'm having a problem with 1-3% packet loss on my Internet interface. On a Cisco ISR I would use "show interface" to have an idea of what's going on at layer 2. In the MX I have Uplinks tab which shows me ping stats to a target. Are these hidden away somewhere? I tried clicking on the ports in Summary. Hovering shows be speed and duplex. But how can I see what kind of errors are incrementing?
... View more
Nov 9 2020
6:26 PM
I heard from my VAR that if you got the MX68W with its built in WiFi that you could not add an additional MR* access point. But he was unclear on the details. Can you tell me if that's true, that if you deploy an MX68W with the built in WiFi that you can't add say an MR45 to add additional WiFi to that office? Or is the limitation not exactly that? Also - when you get the MX68W, does it include two POE ports?
... View more
Nov 5 2020
12:17 PM
AP spoof 52 minutes ago 7 days ago e0:cb:bc:90:3d:fc (7 dB) E0:CB:BC:90:3D:FC Any idea why an MR would see itself as an AP spoofer?
... View more
Nov 5 2020
10:25 AM
On of my MR's is seeing spoofing from another AP. But I'm not sure which AP has that wireless MAC address. I want to rule out that it's a sister Meraki. Where can I find the wireless MAC address of a MR45 that might be seen as spoofing an SSID? And on a related matter - how can I turn down the radius on a specific AP or stop the specific AP from advertising an SSID. These settings seem related to the network as a whole.
... View more
Nov 1 2020
8:11 AM
1 Kudo
Thank you. I'd really like to be able to use the AnyConnect. But that would mean putting beta code on the hub devices. Hmm.
... View more
Nov 1 2020
8:00 AM
I heard that AnyConnect compatibility with Meraki MX is coming soon. Does anyone know when it will be available and what needs to be configured on the back end?
... View more
Nov 1 2020
7:57 AM
1 Kudo
Oh I see. So in Uplink, Add a Second WAN port which will be interface 2. Make it DHCP so it can phone home and go from there. Is that it?
... View more
- « Previous
-
- 1
- 2
- Next »
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2975 | Oct 26 2021 1:33 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 2975 | |
| 1 | 3531 | |
| 1 | 2054 | |
| 1 | 4527 | |
| 1 | 2055 |
© 2024 Cisco Systems, Inc.
