Meraki

Mr_IT_Guy · ‎May 11 2018

So I spent some time playing with the client VPN today and I have a couple concerns that I wanted to bring up: Authentication using Meraki Authentication: Understanding that I can use RADIUS or Active Directory, when using Meraki Authentication for VPN, it is not possible (that I have found) to force strong passwords to the registered users. If you can set strong passwords for Dashboard access in your organization, why can't you do the same for Client VPN? Seems odd. Blocking VPN clients: If a user VPNs in, the client shows up either via MAC/IP address. If I block that MAC/IP address, only that particular MAC/IP address is blocked. A user can simply VPN in on a different machine and get in. Sure you can disable them via AD/Radius/Meraki Authentication, but that defeats the whole purpose of blocking the client in dashboard. Additionally in the case of AD, I simply want to stop their VPN ability without taking away their rights in AD. Any thoughts?

Mr_IT_Guy · ‎May 11 2018

So your client VPN is going to use what your Primary WAN connection is. What you can do is have WAN 2 be listed as your Primary WAN under traffic shaping but then have all other subnets use WAN 1 as their preferred link.

Mr_IT_Guy · ‎May 11 2018

I've made a topic just like this: https://community.meraki.com/t5/Dashboard-Administration/Wish-Template-improvements/m-p/1036 I feel your pain!

Mr_IT_Guy · ‎May 10 2018

The system won't break the upload process. If I recall correctly, when you schedule an upgrade, the firmware is downloaded about 5-10 minutes prior to the scheduled time. This is why when you choose to "Upgrade Now" the upgrade happens 5 minutes from when you hit the button, not NOW. After the scheduled time, the reboots can happen during any time in the next 30-60. So if you schedule 4 switches to upgrade firmware at 1am, the first switch may not reboot until 1:10.

Mr_IT_Guy · ‎May 9 2018

So according to my conversations with Meraki, if you have multiple switches in an environment, there will be rolling reboots for the next 30-60 minutes as the firmware is installed. This is so all your switches don't reboot at the same time in one environment. This is how I currently do updates in my environment today, although I do make sure I have redundancy to my core systems. Additionally, there is a beta out right now for staged upgrades for switches: https://documentation.meraki.com/MS/Other_Topics/Staged_Upgrades_for_Meraki_Switches. I personally haven't used that in my environment yet, but I intend to do so.

Mr_IT_Guy · ‎May 3 2018

I had completely forgot that I was a part of the program. I got mine in the mail earlier this week. @Maui_Meraki_Dog was not happy with our new friend so now it's sitting on my desk at work.

Mr_IT_Guy · ‎Apr 30 2018

I may be completely wrong on this, but in the past when I've hit cancel on a firmware update, I was never prompted on the firmware update until I scheduled it. That being said, is there any particular reason why you wouldn't want to be on the latest stable? Only reason I've ever halted my firmware upgrade was because of schedule conflicts for our maintenance windows.

Mr_IT_Guy · ‎Apr 18 2018

If it were possible to do this, I'd be SOOOOO HAPPY. Alas, every day I'm putting in wishes to make this a possibility...

Mr_IT_Guy · ‎Mar 29 2018

Just a few of my thoughts: The max throughput on the Firewall is 100 Mbps. If you're paying for service faster than that, you're limiting yourself from the start Content filtering on the device only exists in layer 7 firewall rules. Most home routers today allow filtering by category. You can't do this on a Z3 Range - I personally have a Z3 at home for work purposes. I have a 2000sq ft home. My office is on one side of the house with my bedroom on the other. I still get signal though it is very weak. If it was in a centralized spot, it would cover my home fine. Your modem - Spectrum does allow you to use your own modem. We done this at some of our branch offices. Skip the rental charge each month and just buy one. I personally use the Arris 6183. Licensing - Keep in mind that you will have to keep buying the license for this every so often so you can keep your access to dashboard and running your network. So can you do it? YES!!! Would I do it? Unfortunately, no. In fact, I run my home network using Ubiquiti products. For the same cost as a Z3 and licensing, I bought a router, switch, and AP. Although if I didn't have to worry about licensing costs, I would've run my house on the MX64, MS220, and AP that I got from attending Meraki webinars. Sadly, I gave those to my company as my licensing ran out.

Mr_IT_Guy · ‎Mar 22 2018

Group policy on the VPN does work. We have authenticate via AD and have one of our groups that cannot access Facebook. When that user VPNs in, they follow that group policy and are continued from being blocked from Facebook.

Mr_IT_Guy · ‎Mar 20 2018

@MerakiDave. thanks for the shoutout! It really is a pleasure to be a part of this fantastic community. I really have to say that participation in the community has been a great benefit into really getting a more inside look into the Meraki mindset. It's been great to have a place to go to get information direct from the source. I think that I would be remiss if we did not give a shout out to Ms. @CarolineS. Thank you for all your hard work in the community!

Mr_IT_Guy · ‎Mar 16 2018

@CarolineS, hopefully better than the gnome! He still doesn't trust him.

Mr_IT_Guy · ‎Mar 16 2018

Loving all the new changes. The favicon is actually probably my favorite! I don't know how many times I've closed out the community page thinking I was closing out a Meraki tab I'm not using anymore

Mr_IT_Guy · ‎Mar 16 2018

WOOOOT made it to the next round!

Mr_IT_Guy · ‎Mar 14 2018

Are all the users who are getting the 169 address connecting to the same AP?

Mr_IT_Guy · ‎Mar 13 2018

@wbenton, did you receive an error when trying to claim the products so you kept trying? I've had that happen to me before when attempting to claim products and my order number/serial number wouldn't work. Typically, I just work with my Meraki rep and this gets resolved.

Mr_IT_Guy · ‎Mar 1 2018

Can the Client VPN subnet participate in Site-to-site VPN connections? You can find this out by going to Security appliance > Configure > Site-to-site VPN

Mr_IT_Guy · ‎Feb 28 2018

What kind of issue are you experiencing? I have had issues with some Dell computers where they are unable to see the SSID of a connection they previously were able to see. Once I recreate the SSID, everything works fine.

Mr_IT_Guy · ‎Feb 28 2018

We had a spare 1U shelf laying around so we just used that.

Mr_IT_Guy · ‎Feb 27 2018

We have a dedicated Mac guy. I'll ask him when he gets in today.

Mr_IT_Guy · ‎Feb 22 2018

Thanks @RodrigoC! I'll be messaging you shortly.

Mr_IT_Guy · ‎Feb 22 2018

@CarolineS, @MerakiDave, @anyone at Meraki, Can you give some insight as to how Meraki support escalation works? I currently have a ticket that I was trying to get support help on this morning and was unsatisfied with how the tech (not the one originally assigned to the case) handled the issue. Essentially, the message was, "I don't see what's causing the issue so there's no issue" even though I was clearly able to reproduce the issue. When I asked the tech to escalate me up, he asked for my rationale. I responded with something along the lines of "While I make no offense to your skillset, I'm having an issue you are not seeing that maybe someone above you might". He then informed me that there is no real escalation process, which I know is not true. Ultimately it was an intense phone call that resulted in me being very unhappy and telling the tech I would call back to get a different technician before I hung up on him. I have had difficulty being escalated up before. It required calls from my Meraki rep and some e-mails being sent from our IT Director before I got to a Senior Technician. Other times, I was able to be escalated with no issue. Why is this a difficult request? I know I'm not the only person to have this happen to.

Mr_IT_Guy · ‎Feb 21 2018

We have had issues in the past where our offices complain about dropped connections and some packet loss. Using the uplink statistics in Security Appliance > Configure > Traffic shaping, I was able to put monitors on the various hops to 8.8.8.8. While the list is sometimes long in some places, doing this allows us to see the hops along the way. From here, we work with ISPs to remedy trouble spots in their network! Our employees are happy and our ISPs are happy.

Mr_IT_Guy · ‎Feb 21 2018

Noticed there is a small typo in a database article: In the table of contents, step 2 has both 2 and 3 listed making the remainder of the list be off by one number. Didn't know who to contact at Meraki about it, so I thought I'd post here since @CarolineS and @MerakiDave are so active.

Mr_IT_Guy · ‎Feb 16 2018

I'm currently on a call with support at the moment and learned something very interesting about captures from the engineer. When doing a packet capture, you see a note that says "This capture will stop after x seconds, or when x packets have been captured". It is important to know that the "when x packets have been captured" is misleading. If you apply a filter to the capture, even if a packet doesn't meet the criteria of the filter, it still counts towards your "x packets" number. I had been wondering why some of my packet captures had been turning up little to know information at times and this explains why! Hope this helps someone else.

About Mr_IT_Guy

Mr_IT_Guy

Community Record

Badges