About Brash

Brash

Congratulations everyone 🙂

Brash

VMX's aren't sized by number of users, but by the bandwidth and number of VPN tunnels they support. https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Comparison_Datasheet

Brash

From the Meraki side it's relatively simple, you just tell it where to send the logs https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration#Configuring_a_Syslog_Server In terms of setting up a syslog server, there's multiple options out there - paid products and open source. The basic premise is the same for all, they simply ingest logs. The main differentiator is the interface, ease of deployment/use, filtering and alerts etc. Some popular ones include graylog, ELK, nagios, splunk, kiwi.

Brash

The Meraki Dashboard maintains logs for up to 3 months. https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Viewing_Old_Event_Logs I highly recommend having an on-prem syslog server that all devices send logs to as it will include more detail than the standard event logs. In regards to contacting technical support, you can open a case via the dashboard or call the support number.

Brash

There's nothing that is required to be done prior to the power loss. The only thing I would suggest is to ensure that the device configuration is "safe" - meaning there's been at least 30 minutes of stable connectivity to the cloud since last configuration change. Behavior during Connection Loss to Cisco Meraki Cloud - Cisco Meraki

Brash

" Unfortunately, I do not have an option for Clients under Network-Wide so I cannot create an allow list" Are you sure the account you're logged in as is an Administrator for the network you're looking at in the dashboard?

Brash

+1 I believe it's supported/implemented but not documented. That being said, there's at least one instance in the community where a crossover cable was required between and MX WAN port and the ISP device - Solved: MX64 Internet port link drops at 100/full (okay on auto / auto) - The Meraki Community. However, it seems likely that it was the ISP device that didn't support auto MDI.

Brash

You can setup any Meraki device in a LAN as long as the device can pull an IP address and reach the Internet. It doesn't need to be directly plugged into the ISP, it can be behind a NAT gateway/firewall. Once it communicates with the Meraki cloud and is registered in the Dashboard you're good to go.

Brash

By default, client VPN should be able to access any local networks. When you say you can ping the LAN port, what is the traffic flow? Where and what are the endpoints that you can't reach? How are you testing? Are they on networks directly connected to the MX? If not, do you have a route in the internal network to send traffic destined for the client VPN subnet back to the MX?

Brash

There's no way you can really confirm whether the devices are flooding maliciously or not without tracking them down. It could be anything from poorly designed IOT devices to bad drivers, or someone attempting a malicious attack. Do you have any AP's on the same network or broadcasting the same SSID that are not part of this Meraki dashboard? Is it always the same AP that's detecting it? If so, could be worth giving it a reboot. A few threads that provide some more information and other people's experience: Packet floods detected by AirMarshal - The Meraki Community Solved: Mr34 packet flood issues - The Meraki Community Air Marshal - Cisco Meraki

Brash

I personally don't use Solarwinds, but from my understanding Solarwinds NPM has the capability to poll the Meraki Portal API to capture information about Meraki AP's. I'm assuming this is what you found on THWACK. It looks like Meraki MX and MS devices are monitorable from Solarwinds via SNMP: SNMP Polling Meraki Devices (NPM +12.0/11.0.1) - How To - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

Brash

Meraki MX does support IKEv2 tunnels. Have you tried the steps in the following doc? https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site_to_Site_VPN_tunnels_to_Azure_VPN_Gateway#Prerequisites

Brash

If I'm reading the pcap correctly, all of the packets are sourced from a known port and designed for an ephemeral port. That would typically indicate that something in your LAN side initiated the connection. As @BrandonS suggested, a LAN side capture might yield done better information.

Brash

In regards to pinging the WAN interface, what do you have configured under ICMP Ping in Security & SD WAN -> Firewall? https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Denying_Inbound_ICMP_on_the_MX When you encounter the issue, what do you see on the local status page of the MX?

Brash · ‎12-27-2022

The failure reason "reserved" is essentially for unknown/uncategorised errors. See this post for further information: https://community.meraki.com/t5/Wireless-LAN/Failed-connection-to-SSID-during-authentication-Reason-reserved/m-p/109517/highlight/true#M16003 Aside from checking basic configuration, I'd suggest engaging Meraki support for assistance troubleshooting.

Brash · ‎12-24-2022

1. The 3 license keys you received should be separate and shouldn't overwrite each other or anything else. Should you claim it and not want it, you can revert the license claim within 7 days. 2. The MX100 is the old product replaced by VMX-M. According to the migration doc, MX100 licensed can be transferred to VMX-M licensed by support. https://documentation.meraki.com/MX/Deployment_Guides/vMX100_to_vMX_S%2F%2FM%2F%2FL_Transition_FAQ#Will_the_legacy_vMX_licenses_be_transferable.2Fconvertible_to_the_new_medium_vMX_licenses.3F 3. Once you go into a non-compliance license state you have a 30 days grace period to resolve the issue and sort out the licensing. After that 30 day period, your Meraki devices will stop communicating with Meraki cloud and will more or less become unusable. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Co-Termination_Licensing_Overview#The_30-Day_Grace_Period

Brash · ‎12-23-2022

I don't believe there's any plans for this. As per the cloud architecture doc, the recommendation is to use different orgs for globally dispersed networks. "For customers with globally dispersed networks, separate organizations should be created for each data storage region (N. and S. America, Europe, Asia, and China). The hosting region for each account can be found at the bottom of Meraki dashboard pages when a user is signed in." https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Meraki_Cloud_Architecture#Meraki_Cloud_Architecture

Brash · ‎12-21-2022

This question is very vague... The switch can segment vlans, implement ACL's and perform 802.1x auth like most other switches Can you explain a bit further what kind of security concerns you're thinking of?

Brash · ‎12-20-2022

SSL inspection is not an available feature in the Meraki MX platform. It was in beta testing at one stage but the performance impact was too great. Nowadays for SSL inspection, the MX is positioned as a service edge to Umbrella where this can be performed.

Brash · ‎12-19-2022

You need to get the previous owner to remove it from their dashboard. Without them doing that, there is no way you can use the device. https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Cisco_Meraki_Devices_purchased_Second_Hand

Brash · ‎12-18-2022

Can you test disabling the laptops firewall? Can the laptop ping its gateway? If so, can it ping outside of its subnet?

Brash · ‎12-17-2022

The switches can't operate without cloud connectivity. Without connectivity to the Meraki dashboard with a valid license, they are useless.

Brash · ‎12-17-2022

You can't claim devices into your dashboard if they exist in another. If they were purchased second hand, there's not much you can do about it other than getting an employee to login and release the devices. If your company acquired the other company and have just lost access to the dashboard, you may have grounds to get it back. Best to contact support to see what they can do for you, but likely the devices won't be usable.

Brash · ‎12-15-2022

I was very eager and ready to start sleuthing. 😀

Brash · ‎12-15-2022

Never noticed but I agree, a read only user shouldn't be able to perform any actions like that. Ideally there would a role in between read-only and admin that allows for performing troubleshooting steps like that.

Brash

Community Record

Badges