Meraki

Brash · ‎Dec 9 2023

How are you assigning the group policy? Can you confirm it is assigned to the user/device you're testing with?

Brash · ‎Dec 8 2023

I'd raise a support case for this, especially if it's known reproducible steps. It sounds like you're either missing something or there's some buggy behavior going on.

Brash · ‎Dec 7 2023

Interesting. I vaguely remember reading something about "Client made an 802.1X authentication request to the RADIUS server, but it did not respond" that indicated they can be false positive event/errors but I may be wrong.

Brash · ‎Dec 7 2023

According to the following doc, the mesh AP will select a gateway on bootup. https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Wireless_Mesh_Networking#Meraki_Mesh_Algorithm I suspect in your circumstance, the gateway AP isn't reaching the dashboard but is still online. Therefore it is being chosen as the gateway. Do you know why the gateway is showing offline in the dashboard? Can you turn it off (Eg. Disable the switch port if it's PoE) to force the repeater to find a new gateway?

Brash · ‎Dec 6 2023

I'm not sure but I believe a reboot of the repeater will have it pick a new gateway.

Brash · ‎Dec 6 2023

For a release like this where the only fix is "General stability and performance improvements", it would be nice to get some additional clarity as to what has been fixed.

Brash · ‎Dec 6 2023

You'd have to try it to confirm but relatively sure that it won't work in a 1G port

Brash · ‎Dec 5 2023

I read this initially (and logically that part makes sense) but the wording of "unless the license(s) is/are listed in the “End-of-Life Products” list provided below." really had me confused. The MX100 definitely exists in the list, along with every other product that has an EOS/EOL announcement. I really think it needs re-wording to state that the licenses are still available for order up until the EOL date.

Brash · ‎Dec 5 2023

Have there been any recent changes? Things such as: - Firmware updates - Enabling additional security features such as IPS - Changes in network traffic Do you have another device to test with to validate whether it's the Z3 or the ISP?

Brash · ‎Dec 5 2023

The easiest way I've found is just to do a 'copy and paste' from the Catalyst to Meraki. There is some transformation required as Meraki switches treat ACL's a little differently and can be relatively limiting. Mainly: 1. Meraki ACL's apply across all ports on all switches in the network rather than on individual L3 interfaces 2. Meraki ACL's do not support port ranges, port lists or subnet lists 3. Meraki ACL's end with a default allow rather than an implicit deny Depending on how fancy your ACL's are, you may find it's not feasible to convert them and you may need to redesign your network with a firewall (Meraki MX or otherwise) instead.

Brash · ‎Dec 5 2023

It appears that once the device has hit the EOL list, you can no longer purchase licenses. However I suggest you reach out to your Meraki SE or partner to confirm, especially if you need a license to bridge the gap between now and replacement. On the EOS Date, discontinued hardware products are removed from the price list and are no longer available for purchase. The device-specific licenses corresponding to discontinued hardware products will be available for purchase after the EOS Date, unless the license(s) is/are listed in the “End-of-Life Products” list provided below. Support Policies | Cisco Meraki

Brash · ‎Dec 5 2023

That's a bit of a silly but really annoying issue. Depending on how it's architected, I imagine it can't be that hard to force a retry once the switch connects to the dashboard.

Brash · ‎Dec 5 2023

Aside from what @DarrenOC correctly mentioned about best practices, I don't see what the value would be in having an L3 interface on the switch for a VLAN that it is not the default gateway for.

Brash · ‎Dec 4 2023

The L7 firewall rule blocking of DNS traffic is expected. Part of the NBAR functionality is that it will block DNS queries for domains which match the rule. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Mapping_Layer_7_Firewall_Rules_to_NBAR_IDs As for your RDP issues, are you sure that they correlate with the events in the event log? DNS queries for RDP should just be the hostname of what you're connecting to. As for your question about group policies, you can create one under clients-> group policies. In the policy you can configure overrides and additional settings. There are many different places it can be applied, but for testing purposes you can simply find the client on the clients page and manually apply it there

Brash · ‎Dec 1 2023

As stated by @RaphaelL L3 rules based on FQDN will break as they rely on snooping client DNS traffic. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings#FQDN_Support L7 firewall rules and content filtering will work based on the destination IP of the client's traffic.l However you will lose L7 firewall rule enforcement based on client DNS lookup (where the MX blocks the actual DNS request due to an L7 firewall rule match)

Brash · ‎Dec 1 2023

Congratulations @kYutobi , @CapitaoR and @kevinchow!

Brash · ‎Dec 1 2023

Lol @PhilipDAth that would certainly make the job of picking all stars easier 😆 Good luck everyone!

Brash · ‎Nov 30 2023

The MX won't be able to read the DNS request, but it can still block IP flows to networks based on destination IP address/hostname. If you want the MX to be able to read DNS requests and perform L7 firewall and content filtering based on DNS requests, block port 843 outbound and the devices should fail back to UDP 53.

Brash · ‎Nov 30 2023

According to the datasheet, MX's take the power cable MA-PWR-CORD-US which is a C13 cable. If I remember correctly it's only some Meraki switches that take C15 cables.

Brash · ‎Nov 29 2023

I believe the MS250-48FP comes with a 1025W PSU. You can then optionally purchase another 1025W PSU for combined power/redundancy. The 740W number is actually regarding the amount PoE output

Brash · ‎Nov 29 2023

Meraki switches don't support routed ports (Ie. "No Switchport") Instead, you can pick a new VLAN number used purely for transit between the MS and the internet circuit and create an L3 interface for this VLAN on the MS350. Then configure the port connecting to the internet circuit as an access port in that VLAN.

Brash · ‎Nov 29 2023

I've not had too much experience with free syslog servers but I've heard people liking Graylog https://graylog.org/downloads/

Brash · ‎Nov 29 2023

A couple of things: - Ensure that the AP's MGMT vlan is set as native on the port - look at the connected clients on the port to see if the AP has an IP address. - try connecting to the AP's local status page to verify it's current state https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#MR_Series Finally, I have encountered occasional s where despite the network being setup and the AP pulling config and being solid green or blue LED, it continues to show as never connected in the dashboard. In those scenarios a combo of factory reset and deleting and re-adding to network usually resolved the issue.

Brash · ‎Nov 29 2023

I could be wrong but my understanding was that DNA advantage includes TAC support: Q. What is the difference between Cisco DNA and Cisco Catalyst software subscriptions? A. The Cisco DNA software subscription for Switching (and Wireless) includes base support for software only, delivering a one-hour TAC response objective for severity 1 and 2 service requests. In addition, the Cisco DNA software subscription does not include ISE licenses. https://www.cisco.com/c/en/us/products/collateral/software/one-wireless-subscription/nb-06-dna-acces-wl-sw-faq-ctp-en.html As for the snippet, my interpretation is that once it goes GA, you have a 30 day grace period to get your licensing in order.

Brash · ‎Nov 28 2023

It's not possible to use more than 2 WAN uplinks on a Meraki MX, both in terms of physical ports and uplink configuration.

About Brash

Brash

Community Record

Badges