Meraki

MerakiJockey505 · ‎Aug 8 2017

On a compatible device such as a MS320-24 switch you can find the Layer 3 Routing tab under Switch > Monitor > Switches > Your Selected Compatible Switch then on the header tab the 4th tab has an L3 Routing option. This feature will however need to be enabled under Switch > Configure > Routing and DHCP > Then adding an Interface to route to/from. I've included screenshots of these sections.

MerakiJockey505 · ‎Aug 8 2017

@MRCUR I am aware of Meraki's "self healing" abilities, however in practice I have had issues as @BHC_RESORTS mentioned where the device either gets stuck trying to phone home to the cloud whereas the previous configuration stayed connection. Something like a watchdog timer absolutely would work. I think having the option or even a service that could be toggled that would allow the user to shut off the "self healing" ability would be a step towards a fail safe remote configuration solution. Using proper OSPF settings and port controls can do things like keep switches online in the event of a configuration change taking the device offline, however the MX devices don't really have a way, remotely, to revert configuration effectively in the event that a power cycle option is not available.

MerakiJockey505 · ‎Aug 8 2017

On several different occasions my team has had to remotely cutover sites utilizing on-site help and we are usually limited by the availability of physical bodies in the room make configuration changes. It would be great to have the ability to set a timed or delayed factory reset reboot on our security devices in the event that we make an error in configuration and lose access to the device. Has anyone else had this or a smiliar issue?

MerakiJockey505 · ‎Aug 8 2017

Possible causes for this are usually a> L2TP based VPN client (or VPN server) is behind NAT. b> Wrong certificate or pre-shared key is set on the VPN server or client c> Machine certificate or trusted root machine certificate is not present on the VPN server. d> Machine Certificate on VPN Server does not have 'Server Authentication' as the EKU Now please make sure correct certificate is used both on client and server side. In case Pre Shared Key (PSK) is used, make sure the same PSK is configured on the client and the VPN server machine. Have you tried looking at the permissions? Under the Dial-In properties section of a user's account, the control access through remote access policy option must be checked under the Remote Access Permissions (dial-in or VPN) section. Have you checked your port settings and protocols? If so can you provide an example or screenshot.

MerakiJockey505 · ‎Aug 8 2017

Our organization has 150+ sites using a mix of MPLS, MoE, WAN, LAN, and IQ Networking to connect all to a Central Office hub. We utilize a Mesh VPN network as well as WAN Op to keep everything connected across a range of MX models 64 - 100. Are you having a specific issue or are you in need of a specific configuration?

MerakiJockey505 · ‎Aug 8 2017

Depending on usage I would say 10-15 users on a 16/3 would create some issues. It might be more beneficial to go with an MX64 and Base level AP (MR30H?) to get past bandwidth restrictions. I've seen it done with a z1 as both a home router and small telecommuter circles but never at high usage. I think the whitepaper even suggests its recommendation at 50Mbps for 5 users. Hope this helps.

MerakiJockey505 · ‎Aug 8 2017

AnyConnect, as far as I know, can only be manually configured using the System Mananger. You will have the ability to set configuration and deployment of VPN server credentials for any L2TP, PPTP, Cisco IPSec or AnyConnect server in that module. You could also terminate the AnyConnect clients to an ISR router and then cycle that traffic through the Meraki as an alternative. Depending on what your purpose is, Meraki also offers an appliance called the Teleworker VPN which allows you to extend the corporate LAN to remote sites, without requiring all clients and devices to have client VPN software.

MerakiJockey505 · ‎Aug 8 2017

There is a motion search tool. You canDrag a box to select the area you would like to detect and the dashboard will return a list of video clips showing motion within that area. Motion search allows users to view only what’s important, eliminating the need to stream hours or even days of footage just to identify key events. Under the Settings Tab Header in the Camera section you can select Quality & Retention and Enable Motion-Based retention. It was still in Beta availabilty the last time I checked but my be in full production now.

MerakiJockey505 · ‎Aug 8 2017

One of the examples Meraki uses for its Video Surveillance webinar cited Sweet Briar College's case study in which they added 70 MV cameras to watch over the entire campus indoor and outdoor. I don't believe there is a limit. If there is, I have not seen it published yet.

MerakiJockey505 · ‎Aug 8 2017

Because paint has the potential to damage the units, painting does void the Cisco Merak warranty.

MerakiJockey505 · ‎Aug 8 2017

During playback, under the Cameras section. In the center of the page under the "Settings" tab header you can select Optical Zoom. You can drag a box around the area you would like and increase the bar to zoom in the entire few. You may have to adjust focus in order to get the best clarity once zoomed.

MerakiJockey505 · ‎Aug 8 2017

You're welcome, glad to help!

MerakiJockey505 · ‎Aug 8 2017

At the top next to Event Log if you select "for security appliances" on the pulldown and use the specific date info, the client will appear in one of the columns. Are you looking for a specific metric?

MerakiJockey505 · ‎Aug 8 2017

Aweomse, in that case especially it is very simple. Usually the basic setup is with a Backbone, Stub Area, and an NSSA Not-So-Stubby Area. Assign each an ID and name. Your normal area will be for all of your routers. This way all of the routes will have a "homebase" to direct from using the Autonmous System. Your Stub area is going to be for "Branch" style location where not every route needs to be advertised so a default route to the core would suffice allone. You can use your Layer 3 switch to save resources and bandwidth this way. In your NSSA you can allow external routes to be introduced using an Area Border Router. The Switch can inject outside routes which the NSSa can then pass off back to the ABR. This will save bandwidth by bypassing the normal area. Things to remember when configuring the interfaces. Area - The OSPF area to which this interface should belong. Cost - The path cost for this interface. You can increase the default from 1 to give lower priority. Passive - Enabling this will keep OSPF from running on the interface while leaving the subnet advertised. Let me know if you have any other specific questions.

MerakiJockey505 · ‎Aug 8 2017

Hello Boomer, Are you trying to enroll using Apple Conifgurator? This seems to be an easier method than DEP. Only caveat is that it requires OS X.

MerakiJockey505 · ‎Aug 8 2017

The short answer is yes. Static routes on the MX device require a "next hop." So through VLAN and subnetting you can essentialy "weight" or "prioritize" traffic routing to another layer 3 device. As far as policy routing goes you have the ability to control Flow Preferences under Security appliance > Configure >Traffic Shaping > Flow Preferences and define traffic using a designated uplick tagged by Protocol, Source, Src port, Destination, Dst port, and preferred uplink.

MerakiJockey505 · ‎Aug 8 2017

Meraki MX devices can pass IPv6 traffic in pass-through mode, but no traffic analysis or manipulation is possible when using IPv6. It also cannot be router of passed along VPN tunnel unfortunately.

MerakiJockey505 · ‎Aug 8 2017

Hello palmtree, I had this same issue previously with a few different solutions. At one site we added a few new AP's to an existing network stocked with MR34's. The new AP's were MR42's. We experienced much lower connection success as well as load balancing issues. One of the easiest steps we tried was to make sure they all had up-to-date firmware. That fixed the issue temporarily. Secondly, we rebooted all of the AP's to enable the load balancing to reconfigure. That also fixed the issues for a while. We ended up having to change our default Radio Settings to allow either just 2.4 GHz connection with 20 MHz C-Width of just 5 GHz with 80 MHz C-width. That seems to give us the highest success rate. We did have a few issues after but nothing as widespread. Also another thing we tried was removing the Ap's from the network and adding them back.. It seems to be strange solution but it has worked on more than one occasion.

MerakiJockey505 · ‎Aug 8 2017

I have had the unfortunate duty of having to reprogram and accidentally cloned switch as well as one that the configuration was unknowingly removed. It would be nice to have a way to back up these settings both to the cloud as well as locally in case of emergency.

MerakiJockey505 · ‎Aug 8 2017

You can indeed zoom in both playback and historical footage as well as exported footage.

MerakiJockey505 · ‎Aug 8 2017

You may still need to add the license information into the dashboard under Organization > License info and Add another license link.

MerakiJockey505 · ‎Aug 8 2017

Good Morning Boomer, You can definitely combine the use of other switched with Meraki, however, you won't be able to add them to the Meraki dashboard. Our organization has several sites using a combination of Meraki and Cisco switches but are only able to get analytics from the Meraki ones. You can however link the two switches to get basic traffic and usage analytics. For example, we monitor VoIP traffic from a Cisco SG300 through our Meraki switches and MX devices.

MerakiJockey505 · ‎Aug 8 2017

Hello AjayG, It seems that sites with only a security appliance or sites running with the MX device in passthrough (MPLS sites) will not have the topology metrics. Once you either configure other appliances or bring the MX out of passthrough you will begin to see the topology.

MerakiJockey505 · ‎Aug 8 2017

There are two spots I have found to find the more detailed info. Under Network-Wide > Traffic Analytics you can take a look at the traffic. Then by clicking on the specific type of traffic you can take a look at the user utilizing it. If you click on the user to the right of the page you will see a pie chart looking thing. Slightly above the pie graphic there are arrows to navigate between Applications, Ports, and HTTP content. If you select HTTP content you can then click show details below and a list will populate showing specific sites for that user. Alternatively if you have a specific user you are looking for/at you can locate them under Network-Wide > Clients and follow the same process. Let me know if this works for ya. 🙂

MerakiJockey505 · ‎Aug 8 2017

Good morning orange-is-black, I believe you can check out older clinets using the event log. Under Network-wide > Monitor > Event Log and then used the Before fields and specify a date and time. Let me know if this works for ya. 🙂

About MerakiJockey505

MerakiJockey505

Community Record

Badges