Meraki

Brash · ‎May 13 2024

As stated above, the key to this one is to create separate VLANs on the MX, and then use Traffic Shaping rules to set the priority (which applies to traffic exiting the WAN interface).

Brash · ‎May 9 2024

As @cmr said above, it should work without issue. One thing to be aware of is that your C6509 is most likely running PVSTP+ version of spanning tree while the Meraki switch runs MSTP. Both are interoperable but there are some things to be aware of. The following doc covers it off pretty well. https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_Spanning_Tree_on_Meraki_Switches_(MS)#Protocol_interoperability

Brash · ‎May 9 2024

You can add firewall rules on the SSID to block all private RFC 1918 subnets (10.0.0.0/8, 192.68.0.0/16 etc) and allow everything else

Brash · ‎May 8 2024

That is the dream right there. Sucks that it's an additional license though.

Brash · ‎May 7 2024

I was wondering whether this was a bug or a feature 😆 Good idea to fix up IMO 👍

Brash · ‎May 5 2024

The MR76 also does not support Wifi 6E 6Ghz. For a full list of Meraki AP's that support it, you can use the following tool and filter for Wifi 6E Wireless LAN Models | Cloud Managed WiFi Access Point | Cisco Meraki

Brash · ‎May 5 2024

802.11ax is enabled by default on the RF profile (Wireless -> Radio Settings). It can be manually disabled at the bottom of the RF profile. The country you're in (and thereby regulatory domain) does impact the Wifi bands but as far as I'm aware, 2.4Ghz and 5Ghz Wifi 6 should be available in all domains. Note that the MR44 does not support Wifi 6E (6Ghz).

Brash · ‎May 3 2024

One thing to note straight up is that an MX is definitely not a 1 to 1 replacement for a firewpower. They have significant differences in features. That's said, it sounds like you've been looking into the differences and limitations of the MX which is good 👍 As for your questions, yes, a transit vlan between the core and the MX is certainly doable and makes sense. Just create the VLAN interface on the MX and the core and trunk the VLAN between. As for the cabling, yes, you'll need to rely on STP to keep the links down. Just ensure your STP root is configured on the correct switch and you should be right.

Brash · ‎May 2 2024

Congratulations everyone and thank you for all of your contributions this month!

Brash · ‎May 2 2024

As said above, the easiest way to do this is to use the API. You will need a script that iterates through each network in your organisation and get the SSID information.

Brash · ‎May 2 2024

The custom rules within the group policy will overwrite rules configured under "Security & SD-WAN -> Firewall" for clients which have the group policy applied.

Brash · ‎May 2 2024

Congratulations team! A well-deserved reward and recognition of all of the hard work you put in.

Brash · ‎May 2 2024

Verify your MX firewall rules aren't blocking access to the Sophos web console IP and port. Other than that, did you change any other configuration on the Sophos such as the IP or zone?

Brash · ‎May 2 2024

Meraki equipment cannot be managed by SSH or Telnet. They are designed to be cloud managed via the dashboard. You can connect to it via HTTP but that only provides a few simple options required to get it online and connected to the Internet.

Brash · ‎Apr 30 2024

Either way will work. A few things to consider: As you mentioned, when upgrading a switch stack, all switches in the stack will reboot at the same time. With two separate switch stacks, you're relying on STP to prevent loops. With two separate switch stacks you technically have a greater spread of traffic and bandwidth up to the MX

Brash · ‎Apr 30 2024

Love it. Thanks to everyone involved for all of the hard work.

Brash · ‎Apr 30 2024

This doc does a very good job of discussing the considerations around multiple SSID's. Multi-SSID Deployment Considerations - Cisco Meraki Documentation Below are some other threads where people have discussed this. Solved: How many SSID's are recommended to be enabled? - The Meraki Community Solved: Multi SSID Environments (5+ SSIDs) - The Meraki Community

Brash · ‎Apr 30 2024

It's more of a best practice. Each SSID has some management overhead and therefore more you enable, the more utilisation there is on the channel. Others in the community have previously expressed they have up to 5 SSID's running with no performance impact.

Brash · ‎Apr 29 2024

There's no reason that topology won't work. Provided the Sophos XG has a route configured to know what to send down to the MX. That said, is there a purpose of placing the MX behind the XG? If it's just for terminating Site-to-site VPN connections, you might be better off configuring it in VPN Concentrator mode.

Brash · ‎Apr 29 2024

If you don't already have one, you need a static route on the MX for 192.168.65.0/24 with next hop of 192.168.255.1. You'll also need a static route on the Fortinet for 10.10.10.0/24 with next hop of 192.168.255.2. Assuming you have that, you'll then need to look at the firewall rules on the Fortinet and MX to ensure they're configured correctly. Given you've got 2 security appliances there, I'd use the packet capture functionality on them to see where the packets are getting stuck.

Brash · ‎Apr 28 2024

Switches typically don't include any type of conditioning as part of their PoE output. The PoE output is however typically isolated from the main input voltage. If there was a surge/spike that impacted the PoE output, I would expect it to also damage components inside the switch. It's not unheard of that switches can cook PoE devices but it's not particularly common in enterprise grade switches and enterprise grade PoE devices. More commonly it's poorly built PoE devices or failing capacitors in them that end up breaking.

Brash · ‎Apr 25 2024

Judging by the output of my summary report, it includes both internal and external traffic (in my case it includes SMB which is blocked outbound).

Brash · ‎Apr 25 2024

There's no way to onboard without the application (unless Meraki engineering have another method which is not available to the public). That said, I'm not sure I understand the issue as the requirements for internet connectivity and TLS decryption bypass also apply to the switches and are not only required for onboarding but are required for the solution as a whole.

Brash · ‎Apr 25 2024

It depends on what you have configured in the dashboard (Under SD-WAN -> Addressing & VLANS). By default, clients are tracked by MAC Address, but they can also be tracked by IP Address or Unique Client Identifier. The following doc actually does a good job of calling out the different situations you might want to use unique identifier or IP, along with the limitations of each. Client-Tracking Options - Cisco Meraki Documentation

Brash · ‎Apr 24 2024

Flow preferences can only use IP addresses or subnets for the destination. There are more routing features available such as application based routing with the SD-WAN plus MX license. However I believe it still does not support FQDN.

About Brash

Brash

Community Record

Badges