Meraki

Brash · ‎Jan 3 2023

There's no way you can really confirm whether the devices are flooding maliciously or not without tracking them down. It could be anything from poorly designed IOT devices to bad drivers, or someone attempting a malicious attack. Do you have any AP's on the same network or broadcasting the same SSID that are not part of this Meraki dashboard? Is it always the same AP that's detecting it? If so, could be worth giving it a reboot. A few threads that provide some more information and other people's experience: Packet floods detected by AirMarshal - The Meraki Community Solved: Mr34 packet flood issues - The Meraki Community Air Marshal - Cisco Meraki

Brash · ‎Jan 2 2023

I personally don't use Solarwinds, but from my understanding Solarwinds NPM has the capability to poll the Meraki Portal API to capture information about Meraki AP's. I'm assuming this is what you found on THWACK. It looks like Meraki MX and MS devices are monitorable from Solarwinds via SNMP: SNMP Polling Meraki Devices (NPM +12.0/11.0.1) - How To - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

Brash · ‎Jan 1 2023

Meraki MX does support IKEv2 tunnels. Have you tried the steps in the following doc? https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site_to_Site_VPN_tunnels_to_Azure_VPN_Gateway#Prerequisites

Brash · ‎Jan 1 2023

If I'm reading the pcap correctly, all of the packets are sourced from a known port and designed for an ephemeral port. That would typically indicate that something in your LAN side initiated the connection. As @BrandonS suggested, a LAN side capture might yield done better information.

Brash · ‎Dec 31 2022

In regards to pinging the WAN interface, what do you have configured under ICMP Ping in Security & SD WAN -> Firewall? https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Denying_Inbound_ICMP_on_the_MX When you encounter the issue, what do you see on the local status page of the MX?

Brash · ‎Dec 27 2022

The failure reason "reserved" is essentially for unknown/uncategorised errors. See this post for further information: https://community.meraki.com/t5/Wireless-LAN/Failed-connection-to-SSID-during-authentication-Reason-reserved/m-p/109517/highlight/true#M16003 Aside from checking basic configuration, I'd suggest engaging Meraki support for assistance troubleshooting.

Brash · ‎Dec 24 2022

1. The 3 license keys you received should be separate and shouldn't overwrite each other or anything else. Should you claim it and not want it, you can revert the license claim within 7 days. 2. The MX100 is the old product replaced by VMX-M. According to the migration doc, MX100 licensed can be transferred to VMX-M licensed by support. https://documentation.meraki.com/MX/Deployment_Guides/vMX100_to_vMX_S%2F%2FM%2F%2FL_Transition_FAQ#Will_the_legacy_vMX_licenses_be_transferable.2Fconvertible_to_the_new_medium_vMX_licenses.3F 3. Once you go into a non-compliance license state you have a 30 days grace period to resolve the issue and sort out the licensing. After that 30 day period, your Meraki devices will stop communicating with Meraki cloud and will more or less become unusable. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Co-Termination_Licensing_Overview#The_30-Day_Grace_Period

Brash · ‎Dec 23 2022

I don't believe there's any plans for this. As per the cloud architecture doc, the recommendation is to use different orgs for globally dispersed networks. "For customers with globally dispersed networks, separate organizations should be created for each data storage region (N. and S. America, Europe, Asia, and China). The hosting region for each account can be found at the bottom of Meraki dashboard pages when a user is signed in." https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Meraki_Cloud_Architecture#Meraki_Cloud_Architecture

Brash · ‎Dec 21 2022

This question is very vague... The switch can segment vlans, implement ACL's and perform 802.1x auth like most other switches Can you explain a bit further what kind of security concerns you're thinking of?

Brash · ‎Dec 20 2022

SSL inspection is not an available feature in the Meraki MX platform. It was in beta testing at one stage but the performance impact was too great. Nowadays for SSL inspection, the MX is positioned as a service edge to Umbrella where this can be performed.

Brash · ‎Dec 19 2022

You need to get the previous owner to remove it from their dashboard. Without them doing that, there is no way you can use the device. https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Cisco_Meraki_Devices_purchased_Second_Hand

Brash · ‎Dec 18 2022

Can you test disabling the laptops firewall? Can the laptop ping its gateway? If so, can it ping outside of its subnet?

Brash · ‎Dec 17 2022

The switches can't operate without cloud connectivity. Without connectivity to the Meraki dashboard with a valid license, they are useless.

Brash · ‎Dec 17 2022

You can't claim devices into your dashboard if they exist in another. If they were purchased second hand, there's not much you can do about it other than getting an employee to login and release the devices. If your company acquired the other company and have just lost access to the dashboard, you may have grounds to get it back. Best to contact support to see what they can do for you, but likely the devices won't be usable.

Brash · ‎Dec 15 2022

I was very eager and ready to start sleuthing. 😀

Brash · ‎Dec 15 2022

Never noticed but I agree, a read only user shouldn't be able to perform any actions like that. Ideally there would a role in between read-only and admin that allows for performing troubleshooting steps like that.

Brash · ‎Dec 15 2022

I FOUND THE GNOMES! A new beta appliance firmware is now available on Thu, 08 Dec 2022 - The Meraki Community

Brash · ‎Dec 15 2022

Yes the MX would relay DHCP to the DC's

Brash · ‎Dec 14 2022

Version 16 firmware saw some significant performance improvements. Some people have noted issues on v17 (although none bandwidth related that I've seen). Other than checking the usual - disabling security settings, ensuring no traffic shaping etc - it might be worth testing downgrading back to the latest 16.x or opening a case with support.

Brash · ‎Dec 14 2022

Utilizing the existing equipment, you would create the new VLAN's with L3 gateway's on the MX100 (under addressing & vlans in the dashboard), then trunk the VLANs down to the switches and AP's.

Brash · ‎Dec 13 2022

The following link describes what happens for each different product line. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Behavior_during_Connection_Loss_to_Cisco_Meraki_Cloud#MS If the config is safe (see link for further detail), then it will continue to run until next reboot.

Brash · ‎Dec 12 2022

Love it! Although 11am ET is a bit too early for me. 😞

Brash · ‎Dec 12 2022

At this point I would start taking some packet captures along the path to track where the DHCP discover gets to.

Brash · ‎Dec 12 2022

What is the native vlan set on the trunk port connecting to the AP? Do you have any firewall rules set on the SSID? Do you have DHCP guard set on the SSID?

Brash · ‎Dec 9 2022

Well done everyone! Great and meaningful work! 🙂

About Brash

Brash

Community Record

Badges