Meraki

Brash · ‎Jul 17 2023

This is great (and about time). Nice find! It's funny that they still include HTTPS Inspection in the table despite it no longer being offered as a public feature.

Brash · ‎Jul 16 2023

Great contest and awesome to see so many people hitting up the top tiers! Congratulations to everyone involved and particularly to all the winners. Thanks as always for running it @AmyReyes

Brash · ‎Jul 16 2023

Unless I'm reading this wrong, it sounds logical to me. The switchport is up and so is forwarding broadcast and multicast as expected. However the switch has not received any packets from the other side of the link - hence it doesn't know of any clients being connected (no source mac's have been learned on that port).

Brash · ‎Jul 13 2023

Clients roam to what they believe is the 'best AP available', typically based off signal strength and such. For issues like this, the majority of the time you'll find either disabling client load balancing on the SSID, or updating the client wifi chip drivers make the most significant benefit.

Brash · ‎Jul 12 2023

Your Layer 7 firewall rules have detected and blocked a DNS request based on NBAR ID 3086 (OpenX Advertising). The blocking of the DNS request is part of the Meraki MX functionality. NOTE: DNS traffic (TCP/UDP Port 53) may also get blocked by Layer 7 rules if it contains a query for a domain the rule in question covers. For example, you may see a block on UDP port 53 classified as "abc.com" if the "All News" rule is configured on Dashboard, and a user device sends a DNS query for said domain. Mapping Layer 7 Firewall Rules to NBAR IDs - Cisco Meraki

Brash · ‎Jul 12 2023

Yes, you can move licenses between orgs as long as your an administrator of both. https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Moving_Devices_between_Organizations

Brash · ‎Jul 11 2023

Short answer: yes and yes. MS425 supports flexible stacking via front SFP ports. Once stacked, they work just like any other, including cross stack link aggregation.

Brash · ‎Jul 10 2023

It should work. Breakout cables are typicaly designed that the broken out side just see's a 4x10G PortChannel and doesn't even 'know' that the opposite side of the cable is a single QSFP.

Brash · ‎Jul 10 2023

I'm running MX17.x across the board (far less sites than your though) and haven't hit the issue. Back in the day I raised a Meraki support case but they couldn't give me any further details and told me not to upgrade off 16.x. Given I was being auto-scheduled upgrades and the pilot sites on 17.x hadn't hit the issue I decided to upgrade across the board. We have a mix of MX68, MX75, MX85, MX105

Brash · ‎Jul 10 2023

To clarify, are you talking about MX250 security gateways, or MS250 switches? The MX security gateway line does not support link aggregation. The MS switch line does support link aggregation.

Brash · ‎Jul 10 2023

The event log image simply indicates that switch port 23 went down and came back online. It may have occurred so quickly that the customer didn't notice any impact, or there was simply low usage at the time.

Brash · ‎Jul 8 2023

That QSFP type (IR4) is not supported in Meraki switches. See the below compatibility matrix. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/SFP_and_Stacking_Accessories#Fiber_Transceivers

Brash · ‎Jul 8 2023

I believe if you turn of MFA via mobile in your profile, it will default to 2FA using email instead

Brash · ‎Jul 8 2023

I'll start by suggesting that stacking switches over a large physical distance isn't ideal, but according to the doco it should work. What model of transceiver and type of cabling are you using?

Brash · ‎Jul 8 2023

There is not in the Meraki world, but realistically it is a very poor network design to extend layer 2. It's typically only seen with datacenter interconnects using a technology like OTV or VXLAN. Is there a specific reason you're looking to extend your layer 2 between sites?

Brash · ‎Jul 7 2023

No, the Meraki SD-WAN is an L3 VPN connection. It doesn't bridge layer 2.

Brash · ‎Jul 7 2023

Using the group policy schedule, you can select disable for the state and then put in the times of 7am-5pm. That easy the policy will be disabled during those hours and enabled outside of those hours

Brash · ‎Jul 6 2023

The certificate error seems like an odd one. Double check your pre-requisites (firmware version etc). I'd also check if the upstream firewall is performing SSL inspection/proxy services. If it is, disable it for that rule: HTTPS proxy servers that modify the certificate in transit are not currently supported

Brash · ‎Jul 6 2023

Great effort all and congratulations to the top 4

Brash · ‎Jul 6 2023

Second @ww 's comments. Check the event log for hits and disable some security features. Also double check firewall rules if any recent changes have been made.

Brash · ‎Jul 4 2023

Yeah, that doesn't sound right. If it negotiates to 1Gbps and comes up when set to auto, it sounds like the ISP is giving you incorrect information.

Brash · ‎Jul 4 2023

The best way in my opinion: Have a few sites which run as pilots and are not bound to the template. Use these sites to perform large config changes and run newer firmware to validate before applying to the template. Best practices doc for reference: https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practices_for_Meraki_Firmware#Best_Practice_for_Multi-Branch_Deployments

Brash · ‎Jul 4 2023

Are all of the switches in the chain configured for jumbo frames? I don't know anything about Axis or Extreme switches but if it's a cut-through switch it could be flagging the frames as bad and passing them through the network.

Brash · ‎Jul 2 2023

The following document describes configuring non-meraki VPN peers: Site-to-Site VPN Settings - Cisco Meraki

Brash · ‎Jul 2 2023

Yes, you simply select the ports you wish to aggregate and apply. The Cisco Catalyst side requires matching VLAN config and LACP Active or Passive mode. Removing ports from aggregation involves selecting the ports and clicking "split" in the Meraki dashboard, and removing the port-channel config from the Cisco switch side. Note: I would shut down all links in the bundle except for 1 to avoid introducing any potentials of loops. More information can be found in the following doc - Link Aggregation and Load Balancing - Cisco Meraki

About Brash

Brash

Community Record

Badges