Meraki

RJones · ‎Sep 28 2022

It looks like someone (possibly a former employee) of one of our vendors was accessing Meraki via SAML SSO for the vendor and used the link for that in order to clone our Org. I disabled the SAML access until they can get new keys generated so this doesn't happen again. Thanks everyone!

YannVox · ‎Sep 28 2022

Very good, thank you for your advice.

NickKova · ‎Sep 26 2022

Hey guys just to let you know, issue has been resolved. You helped me tremendously. While I was slowly analyzing packets from .pcap file, I have noticed that TCP conversation was always incomplete, and (so stupid of me did not check this before, but I guess you sometimes miss the trees while looking into the woods 🙂 ) did not look at the Layer7 firewall rules on Meraki. It looked like app requested P2P to be allowed, so once I enabled P2P traffic, app started working. Thank you all for joining in this topic and for your help. Best whishes for all of you guys!!!

GIdenJoe · ‎Sep 25 2022

Hmm, The tunnel-group thing is a specific configuration construct in ASA appliances. You use that construct in an ASA to differentiate between authentication methods/aaa servers. I don't think you can use this distinction on Meraki since you can only select 1 authentication method so you will have to change up your matching criteria. The more difficult thing is to have a distinction between internal employees and external contractors. You'll need to have them inside your AD domain under a specific group.

StevenWilson · ‎Sep 22 2022

Thanks for that clarification. Some commands on Cisco are just not available on Meraki. Hopefully if I mirror a trunk port, my customer can monitor the traffic.

MX · ‎Sep 21 2022

Good to know @AlexanderN . Then a try to reach support again, to activate that on our templates.(last time the didnt know that)

JozefH · ‎Sep 21 2022

Ok, found the right Meraki article.... Global Bandwidth Limit Considerations - Cisco Meraki "The custom expression that was created is based upon the destination address in the traffic" Thanks to all of you who relied...

Vipul · ‎Sep 20 2022

I will keep in mind @BlakeRichardson. Thank you!!

NorthstarCC · ‎Sep 19 2022

Looking like this is the case, WIFI network is also assigning numbers. Thanks for your help!, if I have any other other updates I'll let you know.

PhilipDAth · ‎Sep 15 2022

That suggests the IGMP config isn't right in the network. Check out this post which explains it in detail. https://community.meraki.com/t5/Switching/Multicast-Basic-s/m-p/25867/highlight/true#M2125

RGrayTpT · ‎Sep 14 2022

Thanks! I found a few old forum topics with good suggestions as well.

alemabrahao · ‎Sep 14 2022

It's hot-swappable, you can add without power down it.

PhilipDAth · ‎Sep 13 2022

The DMZ sounds like an easy fix. Another option is to get a dedicated cheap Internet circuit for the lab, making it more like a real site.

alemabrahao · ‎Sep 13 2022

In time, does your client use any CMX functionality in particular?

KBLatColonial · ‎Sep 1 2022

I really appreiciate you taking time to share your experience and advice! I've already skimmed your first link, and I'm checking out the one from Meraki now. According to the Meraki docs, there's a way to scope AD to only allow authentication from a particular OU, but that's not a very practical method when you'd have to set a "deny" for the admin account on all the OUs except the one you're using. We have way too many OUs for that to work... thanks again for your time and effort!

akfrnd · ‎Aug 23 2022

CONGRATS!

ZaidAmla · ‎Jul 20 2022

Were you able to find a solution to this?

steakandeggs · ‎May 3 2022

One caveat: LAN interfaces will not do DHCP relay to subnets not on the LAN. Which is fine because your DHCP server/s should usually never be anywhere else.

FSantiago · ‎Apr 29 2022

Hi, I´m getting a similar alert of certificate expiring, but in my case it´s an IMAP certificate. nXXX.meraki.com SSL Certificates-IMAP - SSL DaysRemaining IMAP - SSL Certificate on nXXX.meraki.com is expiring in 6.9634 days, placing the certificate into error state. Like @Craig10, I didn't find this certificate on the Meraki portal either. Is the Meraki team also responsible for replacing this certificate? Thanks.

FabioS · ‎Apr 26 2022

Thank you for your reply and info!

Brash · ‎Apr 22 2022

The same document also says the following "Expected behavior. If the MX losses connectivity to the VPN registry, peer information gets purged over time but not immediately. Connectivity to the registry matters when a node changes its contact information after losing connectivity to the VPN registry. Both the hub and spoke will still be able to form the tunnel if the contact information remains the same, and they lost registry connectivity. Peer information will purge after a few hours causing the tunnel to be marked down." It sounds like there is a timeout where the peer info gets purged and connectivity to the VPN registry is required for the tunnel to remain established. That said, I've never seen this occur. For the exact length of time the tunnels remain up for, you'd probably need to ask Meraki support.

PhilipDAth · ‎Apr 13 2022

Personally, I don't like putting more than 4 or 5 switches into a stack. In a perfect world, you should be able to stack to the max, but the reality is this is all running on software, and software can have bugs, and the larger a single stack the greater the likelihood of running into stacking bugs that take everything out. In this case, I would stack two switches together to form a network core. Then create two stacks of 3 switches that hang off the network core. This is a nice network design. You could also create two stacks of 4 switches.

hevelone · ‎Apr 13 2022

That answers my question. Thank you for the info.

MerryAki · ‎Apr 12 2022

Or try preselecting Google or Cisco Umbrella DNS But yes, cloudflare is performing better ✌️

MCITDept · ‎Apr 12 2022

Alemabrahao is correct, you can use any router with Meraki Switches, we did for a few years before moving over to the MX devices. I hope you can get them talked into using the MX, as you probably know already, they are nice to use if you already have the switches in the dashboard.

About alemabrahao

alemabrahao

Alessandro Abrahao

Community Record

Badges