Meraki

Brash · ‎Jun 27 2024

Meraki Client VPN utilizes L2TP which only supports 1 connection initiated from a given public IP address. If you require multiple VPN connections from the same public IP address, you'll need to use a different type of VPN (SSL, IKEv2 etc.) such as Anyconnect

Brash · ‎Jun 27 2024

I don't have any Netgear switches but logically from what you're seeing, it sounds likely that the Netgear switches are sending broadcast frames for loop detection. The idea would be that if the same frame is then received on the port that originally sent it, there is a loop detected in the network. Similar to (or the same as) spanning-tree BPDU's. Depending on how many broadcasts you have flying around, it's possible that could impact your network.

Brash · ‎Jun 25 2024

The 18.211.0 and .1 releases had some major issues which led to the quick release of 18.211.2. I haven't seen many issues for 18.211.2 in the community forums and haven't seen any issues myself so far.

Brash · ‎Jun 24 2024

Virtual stacking is for ease of switch management rather than data-plane switching. It is not the same as typical switch stacking. You'd need to look at other models (MS2xx, MS3xx, MS4xx, C9xxM) series for switch stacking capabilities. meraki.cisco.com/product-collateral/ms-family-datasheet/?file

Brash · ‎Jun 24 2024

Agreed, with the exception that virtual stacking won't allow the creation of cross-switch LACP port-channels (assuming that's what Po1 and Po2 are).

Brash · ‎Jun 23 2024

So an update on this. Meraki support and some pre-sales engineers confirmed that it is indeed a supported topology. It was found that there was some backend 'route summarization configuration' applied to the org that was not visible on the frontend. Having support remove this backend configuration appeared to correct the routing when looking at the uplink decisions. We'll be implementing the SIG tunnel again early next month with some users on-site to validate. I'll update here to confirm whether it is indeed fixed or not.

Brash · ‎Jun 23 2024

Easy enough to follow and a seemingly more accessible (I'm no expert) way to show unread topics. Good work team 👍

Brash · ‎Jun 19 2024

Meraki MX's don't perform email filtering. You need another appliance/solution to do this.

Brash · ‎Jun 19 2024

I could be wrong but I think this might be what you're referencing How to modernize your captive network - Discover - Apple Developer

Brash · ‎Jun 18 2024

To clarify, Bonjour forwarding can be used to have mDNS cross L3 boundaries Bonjour Forwarding - Cisco Meraki Documentation However from my experience, it can be a bit unreliable/slow.

Brash · ‎Jun 18 2024

There's no way to ensure that they keep the subnets. When you bind to the new template, they should pull new randomly assigned subnets. You can either manually (or using the API) re-configured the subnets immediately after attaching to the new template. Or you can create a new network with the new template, setup everything the way you want it and then migrate the devices from the old network to the new network. Both of these will likely incur some downtime.

Brash · ‎Jun 17 2024

This isn't available with native Meraki dashboards. You would need to use a 3rd party network monitoring software that pulls the data from the Meraki backend using the API and then create customizable dashboards off that.

Brash · ‎Jun 13 2024

Unfortunately renting a place with a very humid garage and little to no structured ethernet cabling means all the gear sits in the living room ☹️

Brash · ‎Jun 13 2024

@KarstenI is bang on. To meet your requirements of domain joined computers and user auth, a RADIUS server is the way to go. Microsoft NPS is free and works well enough but it's a bit like diving back into the early 2000's with regard to usability. You may have to spend a little bit to invest in a log viewer/interpreter to actually troubleshoot auth failures (Eg. IAS Log Viewer). That said, it's so widely used that there's heaps of online resources.

Brash · ‎Jun 12 2024

Funnily enough I have an MX75 at home in my lounge room. There is something from that general area that spins up its fans for about 2 seconds and dies down again once or twice every afternoon/evening. I haven't isolated that it is definitely the MX75 (it could be the MS220-8 or the Xbox) but I thought it was worth mentioning as it seems match what you're seeing

Brash · ‎Jun 10 2024

Very nice work!

Brash · ‎Jun 4 2024

See I had seen this but had discounted it as I would expect the packet flow for non internet bound traffic (RFC 1918 IP's advertised by the hubs) to flow from spoke to HQ hub as it would have a more specific route than the 0.0.0.0/0 that gets installed for Umbrella. And assuming that's the case I'm not too concerned about communication from the hubs to umbrella as they're deployed as VPN concentrators and at this point don't require tunnels to umbrella

Brash · ‎Jun 3 2024

I agree, I quite like the look. That said, it's very 'off brand' for Meraki.

Brash · ‎Jun 3 2024

I'm not sure of the expected behaviour on the Meraki side but I know having implemented IP-SEC tunnels between Azure and Sophos, the tunnel will drop when there's no traffic going across it for a period of time. The tunnel is rebuilt as soon as packets need to cross it. Sophos XG to Azure VPN drops randomly - Discussions - Sophos Firewall - Sophos Community

Brash · ‎Jun 2 2024

I'm working on implementing Meraki to Umbrella SIG Tunnels (using Cloud On-ramp) but am seeing some strange behaviour. The existing topology is relatively simple - single MX hub at the HQ and around 30 branch locations as spokes. The hub at the HQ is a VPN concentrator and advertises around 6 subnets. At a branch location, soon as I add the two Umbrella hubs all network traffic (including that which should go to the HQ) is sent to the Umbrella tunnel, and therefore black-holed. I've got a ticket open with Meraki support already who suggested there may be something messed with the routing table implementation? Has anyone with a similar setup seen issues like this?

Brash · ‎May 30 2024

Apart from the above, another thing to note is that when upgrading stacked Meraki switches, all switches in the stack upgrade and reboot at the same time.

Brash · ‎May 30 2024

As stated above, stacking is simple and will make your life easier. The downside of which is that during a firmware upgrade, the stack reboots as a whole resulting in a network outage for connected devices. If that's feasible for your business to manage then IMO, stacking would be the way to go.

Brash · ‎May 29 2024

Do check out the above provided link for more information on the warning. That said, I've had instances where this warning has shown when adding a newly installed or replacement AP and goes away after a few days.

Brash · ‎May 29 2024

There is no public bug or PSIRT for this vulnerability yet, given it's still pretty fresh. Raise a support ticket for more information as they may already be investigating internally.

Brash · ‎May 29 2024

An option that might work... - Create a VLAN and assign a group policy to it that denies all traffic. Set this VLAN on the SSID. - Once the device has connected, manually change the group policy of that device to one which allows network traffic.

About Brash

Brash

Community Record

Badges