About Brash

Brash

HA with routed MX's is definitely achievable with just the one IP shared between the two MX's. https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Routed_Warm_Spare It sounds like you're not configuring HA correctly. It's hard to tell from your diagram but do you have a LAN connection from both of the MX's to share VRRP heartbeats?

Brash

Can you post a screenshot? You should be able to create and edit ipv4 outbound rules without a problem. If you want to create ipv4 inbound rules, you'll need Meraki support to enable it.

Brash

If you create a network and don't assign any devices, you will see all of the menu items. That way you can preconfigure the network. Once you assign devices to the network, only relevant menu items will remain and the others will disappear.

Brash

The reason I mentioned that Umbrella supports it is because Cisco positions Umbrella as an addition to Meraki gear as a suite of products. Having previously worked closely with development teams at a vendor, small changes like that are often the hardest to get across the line because they cost too much to implement for the value they provide. When you factor in taking devs off other critical bugs to do the implementation, testing, validation, documentation/training and support, it comes to multiple thousands of dollars. That's why it's often up to the sales team to justify why this is important for customers in terms of deal sizes and $$

Brash

That's interesting. I'd honestly never heard of WoL over WiFi. First of all, it's something that Meraki AP's do not support. A bit of looking around seems to indicate that Intel wifi chips are the only clients that support it and it has very limited vendor support in terms of networks themselves.

Brash

There's no way to switch off client balancing for specific clients. If you don't want to disable it for all clients, you could spin up a different SSID specifically for the AirTame devices and disable client balancing on that one while leaving it enabled on the student's SSID.

Brash

You're correct that you would want to use a VPN instead of exposing RDP to the internet. Your high-level process would be: 1. Authenticate and connect to the on-premise environment over VPN 2. RDP to your Windows 11 computer You can use either the Meraki L2TP Client VPN, or use Cisco Anyconnect (additional licensing is technically required). Client VPN Overview - Cisco Meraki AnyConnect on the MX Appliance - Cisco Meraki If you only want to be able to access the windows 11 jumphost, you can restrict VPN users to only access this host - Restricting Client VPN access using Layer 3 firewall rules - Cisco Meraki

Brash

I'm not aware of it being a roadmapped feature. You're best running this by your Meraki sales rep/account manager. These kind of things typically get added if either there's a large enough user base pushing for the feature, or you have a big enough deal on the table to justify the internal development costs of implementing it. Finally, I'm not 100% sure but possibly this is something that Cisco umbrella can deliver.

Brash

As a side note, some people have reported getting higher than the maximum on newer firmware with all security features turned off. Definitely not a validated and expected behaviour though. https://community.meraki.com/t5/Security-SD-WAN/MX68CW-Maximum-WAN-troughput/m-p/187457#M43900

Brash

As per the datasheet, 600mbps is the maximum throughput of the mx67. There's no way to increase it. https://meraki.cisco.com/product-collateral/mx-family-datasheet/

Brash

Congratulations too the winners. Loved seeing all of the before and after shots.

Brash

API would definitely be the way to go. There is also the switching overview page that can be enabled in early access. It shows the number of active ports with errors across all switches in a given network.

Brash

It's not possible with Meraki networking. You would need a client side software that can prevent users from opening/installing web browsers other than edge. Eg. Meraki systems manager, windows app locker, other EDR/MDM solutions...

Brash

Are the Aruba switches running the standard MSTP or is it a vendor specific implementation? If it's as per the standard I wouldn't expect constant elections unless the links between the switches keeps changing state. You could try increasing or lowering your switch priorities.

Brash

Definitely sounds like your port channel either isn't configured properly, or isn't applying properly.

Brash

It looks like you have 2 potential loops there. One would be between the switches and MX's (The MX's will pass bpdu's through. They don't participate in STP themselves). The other would be between the three ms225's (unless two of them are stacked). Spanning tree should bring one of the ports down but still not an ideal design.

Brash

It sounds like you have 2 accounts. One is linked to your companies SSO which is not an organization administrator. The other is a regular account which is an organization administrator.

Brash

A delivery arrived yesterday from the Christmas gnome hunt last year! At first I thought the umbrella had been damaged in shippping, but it's actually a really cool design. Thanks @AmyReyes!!

Brash

Had some fun gutting and cable tracing this comms cab that hadn't been touched in years. Made some 'interesting' discoveries with old phone lines and pairs being split off. Not the best job in the world (cables were a bit too long and we're waiting on the Meraki kit to arrive) but at least the door closes now!

Brash

Seconding this. Mixed spanning tree modes can get real messy very quickly. Converting to MST would be the way to go - just do your research and plan it out.

Brash

Just to add to this, you can also transfer licenses between orgs without requiring Meraki support. https://documentation.meraki.com/General_Administration/Licensing/How_to_do_a_License_Transfer_in_Cotermination

Brash

Are you an organisation admin? I believe only organisation admins have the privilege to assign tags to networks.

Brash

It shouldn't be an MTU issue if you're simply doing a telnet session. It sounds more likely that a firewall rule in the site-to-site firewall settings would be blocking it. Either that, or you have a routing problem. Can you perform a capture on the server to see if it receives any packets from the source when you initiate the telnet?

Brash

Meraki Cloud Authentication doesn't seem like it's the best option for your use case. You could leave the guest wifi open , or If you need to secure it, you could simply use WPA2-PSK.

Brash

There's nothing exactly like that natively in the Meraki dashboard. The closest is something like the organisation summary page or the alerts page (early access). But they are much more high level than you would get with a typical network monitoring solution. Some 3rd party solutions (I think PRTG, Solarwinds etc.) do support pulling from the Meraki API to populate data and so you could probably populate a NOC page with that. Otherwise you could custom make one using the API to pull data.

Brash

Community Record

Badges