Meraki

Crocker · ‎Aug 11 2022

14.33 - That's a good call, hadn't even thought to check the 14.33.1 release notes. I (now) see a mention in there about NAC enhancements, is there anywhere I can look to see what that actually means?

Crocker · ‎Aug 11 2022

I've deployed 802.1X, backed by two Microsoft NPS servers, across our environment over the course of about a month. Mostly works exactly as expected; However, I've run into a couple odd issues regarding Critical Authentication. In at least two instances, I've had switches go into Critical Auth even when the NPS servers are available. Additionally, while in Critical Auth, the Data VLAN fails open just like I want it to; However, the Voice VLAN doesn't appear to do so. The tell is that a workstation connected through a phone (Mitel series 5330e's, generally speaking) works just fine in this state, but the phone itself never pulls a DHCP address like it ought to. Removing the 802.1X access policy from the switchport gets the phone working again. Any obvious noob traps come to mind?

Crocker · ‎Jul 14 2022

1. You pass the Object or Object group via it's object ID, with the following format: GRP(################) or OBJ(############). You can find the object ID's by querying these endpoints: /organizations/$orgID/policyObjects - This will get you the individual objects /organizations/$orgID/policyobjects/groups - This will get you the groups /organizations/$orgID/policyobjects/groups/$policyobjectgroupID - This will get you more detailed information about the groups if you need 2. Not currently, or at least not that I've found. I query the existing ruleset, store it, append my new rule(s), then PUT it like you describe

Crocker · ‎Jul 13 2022

Yeah

Crocker · ‎Jul 13 2022

Just for grins, I'd bounce the MX and then re-test. Then post the syslogs if it continues to block.

Crocker · ‎Jun 17 2022

Is the opt-in Organization-wide? Or per-user?

Crocker · ‎Jun 14 2022

I have the same question. Got prompted to test out the new UI this morning and took a look at the Early Access tab in the Organization Menu. Saw that I've got the new summary page enabled, and I know I saw it show up sometime last week but didn't have time to explore it. Now I dunno how to get back to it 😞

Crocker · ‎May 18 2022

This is basically what we ended up doing. We have a handful of SSID's, and each one is tied to a tag. The tags are assigned/unassigned depending on the site needs. It's extra steps for sure, but after the initial setup it's proven to be beyond useful.

Crocker · ‎May 12 2022

I'm not sure if it applies in your scenario, but Microsoft broke device certificate authentication between NPS and Domain controllers with the patches released Tuesday. Specifically, patched domain controllers are failing to map the certificates to the machine accounts.

Crocker · ‎Apr 27 2022

Excellent, I'll ping support and do some capturing, see what I can see. Wanted to make sure I wasn't missing something obvious!

Crocker · ‎Apr 27 2022

Yup, there's a SIM plugged into the SIM slot on the MX67C. Not sure what I need to ask support? You mentioned having them enable something in your post but not what. I enabled the Cellular Active Uplink option in the Security & SD-WAN > Configure > SD-WAN & Traffic Shaping options. Is there something else needed? Active-Active AutoVPN is enabled under Security & SD-WAN > Configure > SD-WAN & Traffic Shaping

Crocker · ‎Apr 27 2022

Need a bit of clarification. Does this feature support active-active AutoVPN? The following blurb from the best practices document above is a bit unclear - unsure if it's talking about an add-on USB 3G/4G modem or the built-in cellular modem: Is dual active AutoVPN available over a 3G or 4G modem? No, 3G or 4G modem cannot be used for this purpose. While the MX supports a range of 3G and 4G modem options, cellular uplinks are currently used only to ensure availability in the event of WAN failure and cannot be used for load balancing in conjunction with an active wired WAN connection or VPN failover scenarios. Asking because I'm having some trouble testing this feature at a remote location, which is using a full-tunnel AutoVPN back to our concentrator(s). Seems like AutoVPN isn't detecting the cellular uplink, or isn't establishing across it.

Crocker · ‎Apr 26 2022

Excellent, this is the detail I was looking for. Went digging around on the uplink configuration/SD-WAN configuration docs but they don't have much mention of this feature. Was apparently looking at the wrong docs.

Crocker · ‎Apr 26 2022

Cool! Under the hood, is the built-in cellular interface basically becoming/being treated as WAN2 when the option is toggled on? Curious if this is going to interact with the cellular failover firewall rules at all. I notice I can enable both WAN 2 and Cellular Active Uplink, but Cellular replaces WAN2 as an option in a couple of the SD-WAN drop-downs I looked at (like primary uplink).

Crocker · ‎Apr 26 2022

Looking to do some testing with this new feature, wondering if anyone else has already done so and if there are any blatant gotchas?

Crocker · ‎Apr 5 2022

Ditto on shard 426. Also had some issues with the Tools tab not loading for Access Points, but that was back on 4/1. Didn't think much of it at the time.

Crocker · ‎Mar 2 2022

On the 2nd switch, I was able to at least get link lights on the front LAN ports after a factory reset. Setting the static IP on my client allowed me to get to the local device management page, so that's good. Ended up carting both switches back to our build room and connecting them straight in to just a run-of-the-mill cable ISP connection, off of our corporate network. Got link lights, DHCP'd addresses, connected right up to the dashboard. Both switches pulled a firmware update and installed it before booting fully, but have behaved as expected afterwords. All good now, thanks for the suggestions!

Crocker · ‎Mar 2 2022

Finally received 2 MS120-48P switches that we've been waiting on for a couple months. Attempting to do the pre-configuration (set static IP address on uplink port, etc). Normally we do this using a non-domain laptop connected direct to the management port of the MS. Connect it up, wait for the management page to pop up, and away we go. Simple. Today, on both of these newly-unboxed MS's, I'm seeing odd behavior: When something is connected to the management port, the port may or may not light up briefly, then goes dark When something is connected to any of the front panel ports (1-48), the port may or may not light up briefly, then go dark Multiple laptops exhibit this behavior with both switches Multiple ethernet cables have been tried If we try to skip the 'connect a laptop and configure' step and just connect a front-panel port to an uplink on on our closet switch, one that allows for internet access and DHCP, the port on the MS may or may not light up briefly, then goes dark Tapping the reset button on the front of the switch has 0 impact on the behavior, no change after the switch reboots Holding the reset button on the front of the switch for 10 seconds and forcing a reload also produces no differences in behavior after the switch reboots Just for grins, if I connect two of the MS's switchports together, the link lights come up. Not sure what this tells me, other than that the link lights work Am I missing something super obvious or did I win the lottery and get 2 DOA MS120's? That doesn't seem likely, right?

Crocker · ‎Feb 25 2022

For the MS - It's looking for an interface in the subnet/VLAN you want to listen for DHCP requests in, and will then relay those requests (using the interface's IP), to the DHCP servers it's configured to relay to.

Crocker · ‎Feb 23 2022

You can try the /devices/$serialNum/clients endpoint: https://developer.cisco.com/meraki/api-v1/#!get-device-clients Alternatively, if you want to gather all clients for a given network, you can query the /networks/$id/clients endpoint: https://developer.cisco.com/meraki/api-v1/#!get-network-client

Crocker · ‎Feb 11 2022

Thanks for double-checking me. Now to figure out why my per-client limit doesn't appear to be working! Update: I'm an idiot. SpeedBurst was skewing my my tests.

Crocker · ‎Feb 11 2022

Doing some testing and it appears that they do not, in fact, work for clients connected to mesh AP's...

Crocker · ‎Feb 7 2022

I don't believe there's a great way to do this through the dashboard itself. You may want to look at a Netflow configuration. In a nutshell, you'll tell your MX to send Netflow to a specified server/workstation with some Netflow parsing software on it (we use Solarwinds Netflow Traffic Analyzer). The software can then give you a rough breakdown of what traffic is passing through the MX, along with analytics like top talkers, top sources, top destinations, and specific information like throughput to/from a specific website or host.

Crocker · ‎Feb 4 2022

Yeah, the Policy Objects/Policy Object Groups are a lifesaver for that exact reason. Even though they're marked as a beta feature, I believe several folks are using them successfully. We haven't seen any problems with them either - they behave exactly like you would expect. That said, we do back up the policy objects, policy object groups, and site to site VPN firewall rules daily using API calls...just incase.

Crocker · ‎Feb 4 2022

Support got back to me, Development confirmed this is a bug they're aware of and actively working on. No timeframe was provided but we can expect it to be fixed at some point.

About Crocker

Crocker

Community Record

Badges