Meraki

Brash · ‎May 4 2025

I'm loving these metaphors 😆 But they're all correct, it's about having layers. Nothing is impenetrable but if an attacker keeps coming up against more and more roadblocks, they're more likely to: - Be discovered and stopped before significant impact - Decide that it's not worthwhile persisting with an attack Additionally different security products deliver different outcomes and source from different feeds.

Brash · ‎Apr 30 2025

Sounds like the client is being actively rebalanced by client balancing. You can trial turning it off in the RF profile. I've had some success disabling it in some networks, particularly dense environments with a lot of AP overlap. Otherwise, if it's only some specific clients impacted, ensure WiFi drivers/firmware is up to date on those clients.

Brash · ‎Apr 29 2025

From my understanding you're correct - UDLD is used to prevent loops due to unidirectional links to other switches. It won't really be of benefit having it enabled on client facing ports. The benefits of it are primarily for optical fiber connections - definitely SFP, maybe AOC but can't hurt. While it's likely not really needed for DAC, there's no harm in having it set for alert.

Brash · ‎Apr 29 2025

I've experienced this too with Akamai reporting a poor reputation for some Umbrella SWG IP addresses. To bypass SWG and use your public IP address, you can add the website to your external IP's list in Umbrella. Deployments -> Domain Management -> External Domains & IPs

Brash · ‎Apr 29 2025

Unless the laptop was completely shut down, it's likely this is just background network connectivity on the laptop. At a worst case it could be malware connecting to a C2 server. If you're particularly concerned, take a look at what it was trying to access at the time.

Brash · ‎Apr 29 2025

As said above: Ensure the AP's are on the latest stable firmware release Ensure that you haven't blown the PoE power budget for the switches (unlikely but worth checking) If all AP's encountered the reboot, check to see if a firmware upgrade was automatically scheduled and applied to the network Open a support case

Brash · ‎Apr 29 2025

As said above, you're correct - you cannot source specific IP's or subnets. It is per-VLAN "Source-Based Default Routing is a per-VLAN default route feature." Source Based Default Routing - Cisco Meraki Documentation

Brash · ‎Apr 29 2025

I made the assessment that the overhead of managing specific firewall rules for Teams Room setups was really not worth the effort, so I just stuck them on an internet only network with very lax rules. May not be the best idea but was enough for my scenarios.

Brash · ‎Apr 17 2025

The easiest way by far to do this is using the API. Iterate through each template and apply the group policy configuration. Even if you're not comfortable with a bit of coding, the time investment learning that is better than sitting at the GUI clicking into each template and creating each policy manually. You're also more likely to make mistakes doing it manually.

Brash · ‎Apr 15 2025

Applying a block policy doesn't prevent the device from WiFi association. It just means that they won't be able to browse to anything. So you'll still see them as connected in the Meraki portal but they should be blocked from accessing anything. Reference: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Blocking_and_Allowing_Clients#Block

Brash · ‎Apr 14 2025

I believe the essentials licensing will provide you with that functionality. https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/ise-licensing-guide-og.html#813Whyprovidesecurewirelessaccess

Brash · ‎Apr 11 2025

To clarify, does the AP now have the correct IP address or the old one? The dashboard can sometimes be delayed in showing the correct AP status. How/where are you setting the VLAN that the AP should use?

Brash · ‎Apr 11 2025

How are you powering the AP? If PoE, do you see any logs indicating switch port transitions? Do you have many other devices drawing power off the same switch? If by external power adapter or PoE injector, have you tried swapping them out?

Brash · ‎Apr 7 2025

That's an interesting point. I wouldn't expect the MS120 to have particularly deep buffers, but I didn't realize they may be customizable in the backend. Keep us updated with the results 👍

Brash · ‎Apr 7 2025

Congratulations everyone! As usual, a huge effort across the board.

Brash · ‎Apr 6 2025

I don't have much experience with multicast on Meraki devices, but just thought I'd share the following in case you hadn't seen them. They're very good write ups of both best practices and troubleshooting. https://documentation.meraki.com/MS/Other_Topics/Layer_2_Multicast_and_Troubleshooting https://documentation.meraki.com/MS/Other_Topics/Multicast_Overview%2C_Configurations%2C_and_Best_Practices

Brash · ‎Mar 21 2025

For specific requirements in a specific format like this, I would look into using custom scripts to poll the API to get the data. It can then be correlated and formatted as required.

Brash · ‎Mar 20 2025

The above comments are spot on. A Meraki SE is a must have for something this large. There are probably professional services offerings available too if you need a more detailed design or design, test and implementation assistance.

Brash · ‎Mar 19 2025

As @Mloraditch said, it's likely a GUI bug. Configuration or policies applied in the switch settings won't be pushed to the Z4

Brash · ‎Mar 18 2025

Assumedly it's related to the processing engine of the device. MX's are great for SMB and do a very good job at being simple to setup and run. When you get into use-cases that are more typical of a medium to large enterprise, you may find that the simplicity can sometimes be a hindrance.

Brash · ‎Mar 18 2025

That's correct, Layer 7 Geo blocking rules do not apply to inbound sourced traffic flows. There is no way to achieve this. Re: MX67W - does 1:1 NAT forwarding superceed layer 7 country blocking? - The Meraki Community

Brash · ‎Mar 18 2025

New switch day! Hope the install goes smoothly!

Brash · ‎Mar 18 2025

Congratulations @Mloraditch!

Brash · ‎Mar 12 2025

Congratulations! Thanks for your contributions to the community.

Brash · ‎Mar 12 2025

I'll first state that I don't manage 40+ organizations so my experience may vary. I've personally never found the automatic updates to be all that helpful. I've seen firmware pushed immediately to some orgs while others haven't had it pushed for ages. My preference is to manually manage upgrades. That way I can pilot new versions before pushing it to all organizations.

About Brash

Brash

Community Record

Badges