Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About lpopejoy
lpopejoy
A model citizen
Member since Sep 1, 2017
Thursday
Community Record
190
Posts
86
Kudos
2
Solutions
Badges
Jun 30 2018
9:00 AM
@jdsilva Point taken. From the case we opened with Meraki, they can disable the less secure cipher suites: “We have an option where I can push the extra configuration to the MX for DH 5 and AES 128. But I want you to understand that it may have a negative impact on the ability for different devices to connect to the client VPN. If any devices try to connect to the client VPN (when this extra config is is present) that do not support DH group 5, will be unable to connect and the only recourse on our side would be to remove the config.”
... View more
Jun 29 2018
2:00 PM
1 Kudo
Correct, they don't know if it is client vpn or "third party" vpn - thanks for pointing that out. However, they do know what cipher suites are available, because they fail if they detect weak ones... Here's the failure notice based on their scan: Diffie-Hellman Groups 1 to 4 are no longer considered safe for strong encryption. It is estimated that these groups have a security level of 80-90 bits which is no longer adequate to protect the encryption keys used during IKE phase 2. Furthermore, Group 5 (Modp-1536) has a security level of 120 bits which is slightly under to protect AES-128 encryption keys. Stronger groups have been designed for the Diffie-Hellman key exchange in RFC 3526. Weak encryption ciphers, such as DES or 3DES, were identified as supported on this VPN device. These weak ciphers could make it easier for a context dependent attack to compromise the integrity of IKE sessions established with this device.
... View more
Jun 29 2018
1:50 PM
1 Kudo
Companies like trustwave probe your public IP and evaluate what responds. If you enable client VPN on an MX, you fail their scan. It doesn't matter how long your passphrase is or if you use 2fa. In the past, we have been able to say that we use a strong passphrase and rotate regularly, and they give us a pass. However, that seems to be changing and now they want older cipher suites disabled as well which we have no control over.
... View more
Jun 29 2018
1:43 PM
1 Kudo
Most of these clients don't actually have credit card data, but they are required to pass a scan. Separating into a different subnet wouldn't fix not being able to pass the scan.
... View more
Jun 29 2018
1:42 PM
@jdsilvaHey, I get it - and maybe disabling the VPN is the solution. It seems like you are implying that the MX is a "non-pci compliant" device. As far as I know, that isn't the case - are you saying otherwise? Ikev2 would solve this, I think, as well as being able to disable weak cipher suites - which at this time is not exposed to the client VPN GUI.
... View more
Jun 29 2018
9:40 AM
We are having recurring issues with PCI Compliance where Client VPN is in use. I get that we can mitigate with strong keys and rotation, but shouldn't there be a way to configure a firewall so that we can be compliant?
... View more
Jun 27 2018
12:16 PM
@DCooper It actually isn't hitting a database. Just pulling in the JSON and massaging a bit then dumping it into an HTML table.
... View more
Jun 27 2018
10:56 AM
1 Kudo
The documentation here (https://documentation.meraki.com/MX-Z/Monitoring_and_Reporting/Load_Monitoring) says that the value retrieved from the API will be averaged across the past 60 seconds. That's close enough to give pretty good information.
... View more
Jun 27 2018
10:35 AM
...and apparently there is some consideration here of traffic. According to the API doc you referenced it says: "Currently, the load value is calculated based upon the CPU utilization of the MX and it's traffic load. "
... View more
Jun 27 2018
10:34 AM
Interesting, I didn't know that was available via API. I guess that must be the same value that is inside the dashboard as "device utilization" that you referred to.
... View more
Jun 27 2018
10:14 AM
That's pretty frustrating. I'm hopeful that this feature in 14.29 will give more visibility at some point: New features Added firmware support for more detailed device utilization reporting. This is not yet available via the Dashboard UI
... View more
Jun 27 2018
9:47 AM
@Adam, thanks. So support wasn't even able to provide input on your MX84 "overtaxed" issue?
... View more
Jun 27 2018
7:48 AM
Auth should be "no auth" - at least that's what I use. Just because you have full admin privilege, doesn't mean you have API access. You have to enable that separately under Organization->Settings, I believe.
... View more
Jun 27 2018
7:46 AM
3 Kudos
If anyone else is wanting to use the API to get more granular detail, here is the endpoint you need to use: https://dashboard.meraki.com/api_docs#clients I'm honestly not sure how accurate it is when you start looking at smaller time slices (600 sec or less), but it seems to be working pretty well. Here's a snapshot of a quick dashboard I wrote that will display the stats for the serial # that I enter:
... View more
Jun 27 2018
7:41 AM
Wow, really? Meraki on Azure incompatibility list? Do you have a link for that?
... View more
Jun 27 2018
7:39 AM
We had an issue today where an Airprint server (Presto) spawned like 400 processes on a server. Each process, apparently, reaches out to Collobos for telemetry purposes / licensing / who knows what. Over the past 24 hours, only around 4GB has been sent to collobos, but Meraki reports about 1,200,000 flows to collobos. I've never seen anything even close to that. The impact on network throughput was negligible, but what alerted us to the issue was that we started seeing random packet loss and high latency. I'm assuming this is because we were hitting the "simultaneous connection" limit on the MX84. I'm trying to answer three questions: How can I see how many connections the firewall is servicing? (the actual device utilization on the summary report was less than 25%) Is there a way that I can be alerted when the performance of the MX is suffering? How does a "flow" equate to a "connection" (in other words, is there a relationship)? Thanks!
... View more
Jun 27 2018
7:25 AM
1 Kudo
I believe you need to verify that you have the API enabled in the organization and that you are using the correct API key. I've seen both of these give 404 errors with the API.
... View more
Jun 26 2018
6:16 AM
@DCooper, Radius Accounting isn't available on the MX is it? And can you pull the data with the dashboard API with an MX? If so, can you link what API endpoint you would use here? For some reason, I haven't seen anything that I thought would work for this purpose, but could have missed it!
... View more
Jun 26 2018
5:51 AM
1 Kudo
I totally agree that we need better real time visibility in the MX. When there is a bandwidth issue, the "last 2 hour" view isn't granular enough to diagnose an issue.
... View more
May 11 2018
5:29 AM
Oh, I hear from them all the time. They are happy to let me know when they want something from me. ...but not so much if I want something from them.
... View more
May 11 2018
5:25 AM
Regional sales managers are routinely unresponsive in my experience - they are spread too thin. Fortunately, if you have a good partner, you don't need them much.
... View more
Nov 9 2017
5:47 AM
1 Kudo
You should see this as different chart colors on the Appliance Status-> Uplink page. UNLESS you have two WAN ports, then you lose the real time view of upload/download broken out separately, sadly. You can also click on an individual client and see the upload / download separately on the client detail page. Overall, I think better real time visibility (something like iftop on linux) is one of the huge missing pieces on Meraki MX. I've been asking for it for years. Yes, you have good visibility when looking over a larger time span, but what if you want to see RIGHT NOW.
... View more
Oct 8 2017
6:04 AM
Couldn’t agree more. This nearly bit me once when I waited for 45 min and switched said up to date. I assumed I must have missed the reboot, and was about to cancel the maintenance window. If you aren’t going to install the firmware as scheduled, then AT LEAST let us know it hasn’t happened yet. The dashboard shouldn’t lie to me.
... View more
Oct 5 2017
7:21 AM
@Dashboard_DJthis means that SMTP traffic would NOT be inspected, correct? In other words, AMP file scanning is limited to traffic on port 80?
... View more
- « Previous
- Next »
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 3175 | Jun 7 2021 7:11 AM | |
| 20704 | Jun 30 2018 9:00 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 9 | 19862 | |
| 8 | 4425 | |
| 4 | 5654 | |
| 3 | 1936 | |
| 3 | 2471 |
© 2024 Cisco Systems, Inc.
