Meraki

Gary_Geihsler1 · ‎Nov 22 2023

The support team and PM team are working to help resolve the issues during the private preview of hub to hub connectivity.

Gary_Geihsler1 · ‎Nov 2 2023

I would contact support to diagnose the issue. There is the chance that when you tried to connect to a specific DC it was down for maintenance, periodically updates are done that might take a DC out for a short period of time. This is the reason the auto select is there to connects users to the best DC at that point in time.

Gary_Geihsler1 · ‎Nov 2 2023

I would contact support as that is not expected behavior. The "Auto Select Nearest" in reality just queries the server addresses and chooses the best one so choosing the DC individually should work sicne that is what is happening anyway. Do you have a need to connect to a specific DC?

Gary_Geihsler1 · ‎Oct 30 2023

If you are trying to access a private application over a VPN solution you need either Secure Client VPN terminating on the MX or Cisco+ Secure Connect which has remote access as a service. Once connected to the VPN you would be able to access the private resource (192.168.x.x as an example).

Gary_Geihsler1 · ‎Oct 30 2023

Is this question specific to Cisco+ Secure Connect? Reason I ask is Secure Connect eliminates most of the need to do port forwarding with a mor secure way to access resources behind a MX.

Gary_Geihsler1 · ‎Oct 23 2023

We have a private preview of Meraki hub to Secure Connect as a supported topology, as we progress we will continue to work with your organization to implement when appropriate. We can not control which sites/services respect XFF headers and which do not. VPN exclusion is available for major applications, DNS based on hostname, and L3 via CIDR.

Gary_Geihsler1 · ‎Oct 3 2023

Any MX license will work with Secure Connect. There are some overlaps between Advanced Security and Secure Connect; the most common reasons you would want to keep both are: geo based firewall rules, youtube content restrictions and Adaptive Policy.

Gary_Geihsler1 · ‎Sep 13 2023

Sorry if I was not clear. What pieces are your trying to connect together is what I am trying to understand. Your original post mentions AnyConnect (client VPN), Azure, CSR (Cloud Services Router), and MX100. Where are you trying to terminate a VPN session and how do you want to authenticate?

Gary_Geihsler1 · ‎Sep 12 2023

Cisco+ Secure Connect is a specific solution; it should not be read as Cisco and... My question is what components are you trying to use? I see MX100 and Azure but no mention of Secure Connect the product.If you are asking creating a tunnel between Azure and a MX100 you will find better results in the MX community. AnyConnect to MX100 also better in the MX community.

Gary_Geihsler1 · ‎Sep 12 2023

Is this question specific to Cisco+ Secure Connect or are you asking about other products/deployments? This community is focused only on Cisco+ Secure Connect, we do not have the knowledge to help with other products/deployments.

Gary_Geihsler1 · ‎Aug 24 2023

I will try to find some public documentation on the support for XFF header. Hard to prove out with the way Umbrella works. Best I can provide is screenshot of my device on SIG with the XFF header of my actual public IP which will be respected by websites that honor the XFF, as google does. This is using Secure Client as the connectivity method, Secure Connect and Meraki Cloud On-ramp are not currently supported with XFF. the XFF became the standard way SWG operates about a year ago.

Gary_Geihsler1 · ‎Aug 23 2023

Umbrella does support XFF headers so the location would be preserved. AnyConnect, proxy chaining, PAC file, and IPsec are supported connectivity methods. the Meraki Cloud On-Ramp and Secure Connect are not currently supported.

Gary_Geihsler1 · ‎Aug 23 2023

1. We have found that not every deployment has caused issues with communicating to Meraki dashboard over Secure Connect tunnels, hence there is not default exemption of Meraki dashboard destinations in VPN exclusions. We are working on root cause analysis. 2. Hubs will be supported soon, no public timeline to share beyond that. Please engage your Meraki team for more detail if desired. 3. The MTU size requirement is documented, we are looking to provide the option to increase MTU and support fragmentation, work ongoing in these areas. 4. VPN exclusions are only by CIDR for TCP/UDP/ICMP and for DNS hostnames are supported. The UI is a bit confusing on this front, feedback submitted.

Gary_Geihsler1 · ‎Aug 18 2023

New video on how easy it is to bring in new employees with Cisco+ Secure Connect. https://app.vidcast.io/share/068ff2f6-62ab-4674-96c5-653d2ebb4d93

Gary_Geihsler1 · ‎Jul 17 2023

There are two different questions here. 1. Secure Connect DC IP addresses- We utilize the Umbrella DCs so we use the same public IP addresses as Umbrella when connecting via IPsec tunnels. You can see the Umbrella DCs and their IP addresses here. Note no all Umbrella DCs support Secure Connect, check the Secure Connect DC list here. 2. The public IP that will be listed as the source when landing at a destination such as a SaaS application will be one of the IPs in the Umbrella ranges. 146.112.0.0/16, 155.190.0.0/16, 151.186.0.0/16. We are just launching Reserved IP as a function in Secure Connect which will allow a customer to purchase dedicated IP addresses, more details to come on the Reserved IP capabilities.

Gary_Geihsler1 · ‎Jun 27 2023

Correction to myself, we do not need the vMX in routed mode. There are some routing considerations on the upstream gateway in order to use the vMX in passthrough mode.

Gary_Geihsler1 · ‎Jun 26 2023

Will we have to change anything on the vMX-M appliances? Currently all Meraki sites connected to Secure Connect will be configured as spokes with Secure Connect seen as a hub. Hub to hub connectivity to Secure Connect will come in the future. Do the vMX have to change to Routed mode? Yes Will the vMX appliances now be seen as a spoke? Yes What sort of latency will be introduced on top of the current latency seen in the AutoVPN config? If you are asking about site to site connectivity there will be some latency added. We are introducing another hop and a policy evaluation. The latency added will depend on multiple factors, there is no stated number. Does the Essentials licensing allow for traffic steering at the remote sites? For example, to exclude certain traffic from being routed via Secure Connect? (Meraki licensing is Advanced Security) Secure Connect is not dependent on a specific MX license. VPN exclusion rules can be done for IP/CIDR for any MX license and application based VPN exclusion rules require the SD-WAN Plus license.

Gary_Geihsler1 · ‎Jun 16 2023

Currently neither MX nor Secure Connect headends have an auto-update capability. You can get some monitoring capabilities with a MDM/EMM platform or SecureX Device Insights. Some MDM/EMM platforms have enforcement capabilities.

Gary_Geihsler1 · ‎Jun 16 2023

Note: Secure Connect customers will not have the entitlement to download from the normal Cisco download page. We publish one version of the client software directly in the dashboard for download. We are working to expand to a couple versions available for direct download in the dashboard. If a Secure Connect customer needs a client software version that is not available in dashboard the recommendation is to contact support and we will issue the desired client software version to the customer.

Gary_Geihsler1 · ‎Jun 14 2023

Depending on the public cloud platform you could use an IPsec tunnel. We can use the native IPsec capabilities of Azure and GCP, probably others I have not tested OCI for instance. AWS is the outlier, we can not do IPsec to the AWS native site to site infrastructure. In AWS you would need either a virtual router/firewall of your choice and use IPsec or use a vMX(preferred) to make the connection to Cisco+ Secure Connect.

Gary_Geihsler1 · ‎Jun 6 2023

The management of Secure Client in the context of Cisco+ Secure Connect can be done any of the ways you might manage the client. SecureX deployment works, MDM will work, manual distribution will work. One aspect that is unique is that every time a user does their authorization to Cisco+ Secure Connect the xml profile is updated and placed in the proper file structure. This allows the admin to make changes to the client configuration without having to do any sort of push to the end users.

Gary_Geihsler1 · ‎May 30 2023

Videos going up there as well!

Gary_Geihsler1 · ‎May 26 2023

Quick and easy site deployment with 6 clicks to SASE. https://app.vidcast.io/share/c588c24d-204e-4094-8ee5-0218f75a2bb3

Gary_Geihsler1 · ‎May 26 2023

We will start to regularly link to videos for Cisco+ Secure Connect. We will cover specific features, integrations, and much more. Check back regularly for new content.

Gary_Geihsler1 · ‎May 15 2023

A feature-request several customers have been demanding is solution status page. The team is happy to say that the Cisco+ Secure Connect section on the Umbrella status page (https://status.umbrella.com/#/) is now live. The goal was to get it up as soon as possible. As a result, the C+SC section does not currently have a link to the incident history. That will be added in the near future. Great team effort to develop this status page.

About Gary_Geihsler1

Gary_Geihsler1

Community Record

Badges