About alemabrahao

alemabrahao

I'm sorry @cmr, I believe you are confusing with MS210, the MS120 is only L2 does not have L3 functionality.

alemabrahao

No, echa un vistazo a la documentación: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Traffic_and_Bandwidth_Shaping

alemabrahao

Have you tried disabling all security policies? It's a known issue.

alemabrahao

Do you have VLAN tag configured on the Access points? Have you tried cleaning ARP table or DHCP lease? Have you opened a support case?

alemabrahao

It does not have L3 function.

alemabrahao

In fact, what you said doesn't make much sense, if the switch is connected directly to the MX or not, the operation will be the same, the difference is that you will have fewer jumps if you connect directly to the MX. Connecting the switch directly to the MX will also not make the network more protected or less protected. My suggestion is that you use VLANs for network segmentation. Because that way you will be isolating the Broadcast domains not to mention that you can work with different network policies for each of the VLANs. But remember that security is far beyond the firewall, there are several mechanisms to protect the network that are not much more effective than the firewall itself, just think about it ok? Topology speaking your network is very simple so it should work fine for you. As for the issue of limitations regarding the MX84, in fact what may be the limiting factor is the number of clients on the network, as there is a maximum number of clients supported.

alemabrahao

Have you tried a factory reset? Have opened a support case?

alemabrahao

There is the recommended topologies. https://documentation.meraki.com/Architectures_and_Best_Practices/Recommended_Topologies/MX_and_MS_Basic_Recommended_Layer_3_Topology

alemabrahao

Do you have any L3 or L7 rules configured? Have you tried doing a packet capture or even checking the MX logs?

alemabrahao

Although it is not a good practice to have different AP models in the same environment, I believe this is not the problem. What firmware version are you running?

alemabrahao

I noticed this: Stateless Operation ACLs configured on Meraki switches operate statelessly: each packet is evaluated individually. Thus while traffic may be allowed in one direction, the response can still be blocked. When creating ACL rules, it is important to keep this in mind and create rules that allow desired traffic in both directions. So you really need to create in both directions.

alemabrahao

Do you have any restriction configured on your SSID? What type of athentication are you using? Can you show the SSID configuration?

alemabrahao

The most specific rule should be at the top. Your rule looks ok. But what is the source IP that you are testing? A question, what is the network gateway? Is it switch itself? If not, you must create the ACL on the device that is the network gateway.

alemabrahao

No, it's not necessary to create on both directions. https://documentation.meraki.com/MS/Other_Topics/Switch_ACL_Operation

alemabrahao

It's exactly what @PhilipDAth said. @a5it is using ChatGPT for give all answers. 🤣 If it's possible, with Cisco ISE you have more flexibility.

alemabrahao

ChatGPT again?

alemabrahao

Normally, this is a application that was not classified by the NBAR. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Next-gen_Traffic_Analytics_-_Network-Based_Application_Recognition_(NBAR)_Integration https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/prot_lib/config_library/pp5900/nbar-prot-pack5900.html

alemabrahao

Becomes a very generic question with little information. Can you provide more details? Such as settings, AP model, software version, etc.

alemabrahao

Why would you want to do this type of setup? What's the point? What happens is that even if you force it to use an interface that does not have an active connection to the Internet, the MX will forward it to the WAN that is working. Maybe what you want to do to solve it another way.

alemabrahao

First thing you have to try to locate the source of your problem. If it's a rogue AP within your infrastructure, it's easier to solve, if it's something external, it's a little more complicated. Is it only affecting 2.4Ghz or 5Ghz as well? Take a look at this article. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal#Overview_of_Air_Marshal_Containment

alemabrahao

Do not forget that the DHCP process is via broadcast and most importantly, your AP is probably configured with the native VLAN for the management VLAN, so depending on how your SSID is configured, clients will try to obtain an IP from that VLAN.

alemabrahao

That's exactly the point, about support making any changes, as far as I remember I don't remember hearing about support making these changes. I'm curious and a little skeptical about this.

alemabrahao

@PhilipDAth , I'm not sure about that, because it's a L2TP standard.

alemabrahao

One more consideration, this is the standard for L2TP, so there's nothing that can be changed on Meraki's side.

alemabrahao

Have you considered using on Anyconnect?

alemabrahao

Alessandro Abrahao

Community Record

Badges