Meraki

alemabrahao · ‎Apr 24 2023

Or maybe Okta could be an option: https://help.okta.com/en-us/Content/Topics/integrations/cisco-meraki-radius-intg-gateway.htm

alemabrahao · ‎Apr 24 2023

You need at least a /29 as you will need 3 addresses, one for each MX and one more for the VIP. That is, you have to check with your ISP about the possibility of increasing your range (and it certainly must have some cost).

alemabrahao · ‎Apr 24 2023

You need to use the virtual IP. The virtual IP address (VIP) is shared by both the primary and warm spare VPN concentrator. VPN traffic is sent to the VIP rather than the physical IP addresses of the individual concentrators. https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#WAN_Virtual_IPs

alemabrahao · ‎Apr 24 2023

Maybe it will help you. https://apicli.com/2021/12/13/meraki-mr-802-1x-with-azure-active-directory/ About MFA you need to be more specific. Where is your client wants enable the MFA? https://learn.microsoft.com/pt-br/azure/active-directory/saas-apps/meraki-dashboard-tutorial

alemabrahao · ‎Apr 22 2023

Note: Some versions of Windows Server require that the CallingStationID is omitted. If you are unable to establish connectivity, remove the CallingStationID and leave the field blank.

alemabrahao · ‎Apr 22 2023

Have you checked the NPS logs?

alemabrahao · ‎Apr 22 2023

Have you created a server certificate for the NPS?

alemabrahao · ‎Apr 22 2023

Unfortunately not, but you can Google it and analyze by your self. https://www.oreilly.com/library/view/cisco-lan-switching/1587050897/1587050897_ch04lev1sec8.html#:~:text=VLAN%201%20contains%20control%20plane,(NMP)%20of%20the%20supervisor.

alemabrahao · ‎Apr 22 2023

This is a false sense of security, there are other tools that are much more effective at doing this. Zscaler is an example. But that's okay, it's your choice.

alemabrahao · ‎Apr 22 2023

Not using VLAN1 is just a good practice recommendation as it is the default VLAN of any switch, but it does not mean that it cannot be used or that network security is at risk. Security goes much further than a simple VLAN. If possible, avoid using it, but if you do, that's fine, it's not the end of the world.

alemabrahao · ‎Apr 22 2023

As far as I know, Cloudflare IP is 1.1.1.1

alemabrahao · ‎Apr 22 2023

By API it's not possible. But I'm not sure way do you want this information? Technically if auto channel is enable the AP will change for another channel.

alemabrahao · ‎Apr 22 2023

If you are talking about the channel width 20 MHz, 40 MHZ or 80 MHz, no it's not possible.

alemabrahao · ‎Apr 22 2023

Group policies don't work for L2TP VPN just for Anyconnect. The certificate is a requirement if you want to authenticate the users from LAN. Check it out: The MX will run through the following steps to identify AD group members and apply associated group policies: MX securely contacts the specified Domain Controllers for the AD domain, using TLS MX reads WMI logon events from the DC's security events, to determine which users are logged into which devices. MX binds to DCs using LDAP/TLS to gather each user's AD group membership. Group membership is added to a database on the MX. If a domain user's group membership matches an AD group policy mapping in Dashboard, the MX can apply the associated group policy to the user's computer. Because the MX is continuously gathering this information from the domain controllers, it is able to accurately apply the policy in real-time whenever a new user logs in. Note: At this time, the MX does not support mapping group policies via Active Directory for users connecting through the Client VPN.

alemabrahao · ‎Apr 21 2023

Your L2TP connect probably is misconfigured. Can you share the configuration on your machine?

alemabrahao · ‎Apr 21 2023

You need a certificate, either self-signed or a valid certificate. I always use a self-signed certificate so I prefer to install AD CS, but each case is different.

alemabrahao · ‎Apr 21 2023

Maybe it will help you: https://windowstechpro.com/how-to-install-certificate-services-ad-cs-in-server-2019/

alemabrahao · ‎Apr 21 2023

@Patrik73, there are some steps that you have to configure before. Take a look ate the documentation: https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances#Configuration_Overview

alemabrahao · ‎Apr 21 2023

Well, this is pure L2 communication, if your router has an active DHCP server and is configured on the same LAN as your Mac Mini, I don't see why it won't work. I still don't understand what the question here is.

alemabrahao · ‎Apr 21 2023

Can you explain it better, please?

alemabrahao · ‎Apr 21 2023

It's probably a device issue, not a Meraki issue. Can you show an example?

alemabrahao · ‎Apr 21 2023

Is the connection of the links directly on the WANs or do you connect to a switch and then to the MX? Have you tried changing the network cables?

alemabrahao · ‎Apr 21 2023

I think that it will help you. https://documentation.meraki.com/General_Administration/Other_Topics/Blocking_or_Rate_Limiting_iOS_Updates

alemabrahao · ‎Apr 21 2023

lo siento, pero creo que aquí no es la comunidad adecuada para verificar esto. Aquí está destinado a la línea Cisco Meraki. De todos modos, ¿sus puntos de acceso funcionan en modo independiente o tiene un controlador Wireless? Sigue el enlace a la comunidad correcta. https://community.cisco.com/

alemabrahao · ‎Apr 21 2023

O simplemente intente bloquear el dispositivo MAC.

About alemabrahao

alemabrahao

Alessandro Abrahao

Community Record

Badges