Meraki

Mr_IT_Guy · ‎Nov 27 2017

Good morning all! I wanted to throw out the idea of a community gift exchange. I've done this with a few other communities I'm a part of and wanted to see if this is something you all wanted to do. This is COMPLETELY VOLUNTARY! FAQs: How do you join? The gift exchange is hosted by Elfster. Click on this link in order to join the gift exchange: https://www.elfster.com/exchange/view/27502151/565774/. Note: You will need to create an Elfster account. What is the spending limit? I set the limit to $30 USD. This does not mean you have to spend that much on a gift, but hopefully no one goes over! How do I know who I received? Sign-ups for the gift exchange are being taken through December 1. December 8 (extended!). On December 2 9, names will be drawn. How will we exchange gifts? On your Elfster profile, you can setup your account with the address you want your gift to go to. How will people know what to get me? Elfster has a the ability to create a "wish list". Simply add items to your list so people will know what to get you. My person lives in another country. How do I order my gift for them? In cases like this, I recommend using their local Amazon page. For example: If my person were to live in Canada, I would go to www.amazon.ca If you have any questions, please do not hesitate to ask!

Mr_IT_Guy · ‎Nov 21 2017

Great job!

Mr_IT_Guy · ‎Nov 19 2017

I've also had the issue where in some of my L3 switches, routing is affected. Yes things are supposed to be resolved in these upgrades, but sometimes we still are affected. It took almost a year for us to have a working version of AMP (in my metwork) and that's with moving to latest versions that supposedly fixed it.

Mr_IT_Guy · ‎Nov 19 2017

It was me

Mr_IT_Guy · ‎Nov 17 2017

@MerakiDave, thanks for your response! I'm happy to see that you feel this is uncharacteristic of typical Meraki presentations; however, every Meraki presentation my colleagues and I have attended has followed the same format as I noted in my first post. I watched the SD-WAN webinar you posted and this is a completely different presentation than the webinar we attended earlier in the same month. Same topic, different delivery. In your SD-WAN webinar, the presenter even says "Hey, I know some of you already know about Meraki. We'll do a quick MX recap and then jump into it." My webinar spent the majority of the time talking about the Meraki product line and all the features in dashboard before finally jumping into SD-WAN with just a few minutes left on the clock. I know that the good presentations are out there, it's just that I haven't attended one. I want to know more about Meraki and its product capabilities and I want to hear it straight from Meraki. As @Uberseehandel stated, maybe a series of webinars aimed at those who already have Meraki gear or CMNO/CMNA should be something Meraki looks into. This way not much time is spent on recapping everything. If you think about, in a hour presentation 20 minutes is quite a long time to spend on a device overview if you are also leaving time for your main topic, demo, and questions.

Mr_IT_Guy · ‎Nov 16 2017

I like that idea!

Mr_IT_Guy · ‎Nov 16 2017

So I'm sitting at Cisco Connect in Virginia Beach and was excited that Meraki had SD-WAN presentation. Unfortunately this presentation is similar to many Meraki presentation I've experienced in the past: a 45-minute sales pitch with a 5-minute discussion on the topic I was actually interested in with a short demo. I understand that Meraki wants to get the word out on its product line, but Meraki needs to also think about cutting down the sales pitch so that those people with the gear currently can get value from these discussions.

Mr_IT_Guy · ‎Nov 15 2017

@CarolineS, as promised here is my swag photo complete with Maui the Meraki Dog! The pocket is big enough for him to fit so when we're lounging around, he has a spot to warm up in.

Mr_IT_Guy · ‎Nov 15 2017

Meraki and the MX line handles the bulk of the workload in mitigating this threat. Ensuring our MX devices are on the latest firmware is a crucial first step as it ensures that these threats cannot exploit old vulnerabilities in the gear. Meraki's Advanced Security Licensing. This gives access to tools such as AMP and IPS/IDS. By properly configuring these services, you add another layer of security to the equation. Utilization of Layer 3 and Layer 7 Firewall rules. Using Layer 3 rules you can block traffic to certain locations and Layer 7 rules can deny traffic from countries. Content filtering rules. Understanding that Meraki uses BrightCloud as the basis for Content Filtering categories, we need to make sure that we blocking/allowing access to sites that BrightCloud sees as safe/unsafe appropriately. We must also check in periodically to ensure this information is updated in a timely fashion. URL FIows. Meraki has the ability to see where your traffic is flowing to/from (i.e. you can see when you are hitting the Microsoft site in CA or the UK). Know where your traffic is flowing from and what is "normal traffic" to develop your baseline is essential to fighting these threats. Packet captures/Syslogs. Make sure that traffic is somewhere for long term collection. Utilizing products such as PRTG to monitor Netflow and Syslog can add in this. Meraki also has built in packet capture capability. Using these tools has help in making sure our data is going in and out as intended and allows us to see when things are looking suspicious. Creation of routes. Make sure that we are only allowing routes that need to be shared in VPN connections and keeping all others out of site to site participation. Additionally, when creating routes use the smallest subnet when possible (I.e. using 10.0.0.0/22 instead of 10.0.0.0/8). Client VPN. Use a LONG password (minimum of 16 characters). Meraki VPN uses Aggressive Mode VPN. The longer the password, the better. There's sooo much more, but that's what I can think of a before running into my meeting. GOOD LUCK EVERYONE!

Mr_IT_Guy · ‎Nov 15 2017

I've just done a quick check on our devices. On the Z1, there is no secondary port you can setup as a secondary WAN port. However, on the Z3, you can configure Port 2 as a secondary WAN.

Mr_IT_Guy · ‎Nov 15 2017

We've used AD authentication and it works fine. Keep in mind, however, that this will be hitting your AD server hard with WMI traffic so if you have any sensors, it may set them off.

Mr_IT_Guy · ‎Nov 6 2017

OOOOoooOOOOoooo Those mini fridges look nice! I've been rocking my blanket in the office. It's SUPER comfy

Mr_IT_Guy · ‎Nov 4 2017

@MRCUR, interesting. Would it be possible for us to maybe get into a call with you and my team? If so, please DM a time that works best for you and we can get the ball rolling. This is new territory for us and we keep getting the run around from our FiServ contact.

Mr_IT_Guy · ‎Nov 2 2017

Not a problem! Happy to help

Mr_IT_Guy · ‎Nov 2 2017

Hey @MikeMandalorian, Here's a documentation link on how to do exactly what you're asking for! Updating Managed iOS Apps Hope this helps!

Mr_IT_Guy · ‎Nov 2 2017

Congrats to all this month's winners! You guys really make this community a great place to be! @PhilipDAth, my wife is the creative one. I don't know how she thought to make the sock a sweater and have it fit so comfortably on Maui, but she did it! @AnnaT and @CarolineS, I think my wife's next plan is a Meraki hoodie. Will let you all know how that works out. @WadeAlsup Thanks for the compliment! I'm not usually a fan of small dogs, but those ears won me over.

Mr_IT_Guy · ‎Nov 2 2017

@MRCUR, how do you connect to FiServ if you don't mind me asking? Do you have a direct connection from your MX device or do you use a FiServ provided router?

Mr_IT_Guy · ‎Oct 27 2017

I realize there is already a PCI compliance topic, but our situation is a bit different than the compliance issue in the previous posting. We are potentially looking to test Meraki at a bank location. We need to be able to setup a Meraki tunnel to FiServ servers, but are being told we will not be PCI compliant because Meraki is a cloud managed system. Has anyone used Meraki with FiServ? If so, do you use an on-premise or AWS connection instead of connecting straight to FiServ? Are you using Meraki with FiServ and maintaining PCI Compliance? Any help would be appreciated.

Mr_IT_Guy · ‎Oct 25 2017

We actually had an issue similar to this. When I swapped out the troublesome AP with another AP of the same model, it resolved the issue.

Mr_IT_Guy · ‎Oct 25 2017

Here is the link for the Meraki stencils that I use: https://meraki.cisco.com/lib/cisco_meraki_visio_stencils.vss Stencils included that have been requested are: @s4mmy MR74 (Uses same stencil as MR72. You can see this when you hover over it) MR30H I do not see anything for a vMX. Since the vMX is currently the same as the MX100, wouldn't that stencil work in your drawing for the time being? For the MR33, I'm assuming you can just use the same stencil as the MR32, although it says its for the MR32,MR34, and MR42. @GavinMcMenemy MR18 MR32 MS250 (Uses same stencil as MS320. You can see this when you hover over it) This is an updated stencil pack from the last time I was on here as they do have stencils for the MS410 & MS425. Hope this helps!!

Mr_IT_Guy · ‎Oct 24 2017

A MX device in the middle would definitely help you out!

Mr_IT_Guy · ‎Oct 23 2017

Did you make sure to set up a route to the public? Should be something along the lines of: Name: Default route Subnet: 0.0.0.0/0 Next hop IP: Public IP address

Mr_IT_Guy · ‎Oct 21 2017

I've gotten a couple questions. He is a Pom-Chi and his name is Maui.

Mr_IT_Guy · ‎Oct 19 2017

We actually created a script to push out the VPN and settings to our Windows 10 users. Was very simple to do using PowerShell. No CMAK required 🙂 Add-VpnConnection -AllUserConnection -Name "[insert VPN name]" -ServerAddress [insert IP/hostname for VPN] -TunnelType L2tp -DNSSuffix "[insert domain name]" -EncryptionLevel Optional -AuthenticationMethod PAP -L2tpPsk "[insert VPN password]" -Force -PassThru

Mr_IT_Guy · ‎Oct 19 2017

I didn't know Meraki was in the Pet Clothes market!

About Mr_IT_Guy

Mr_IT_Guy

Community Record

Badges