Meraki

Nash · ‎Sep 20 2019

I have to ask: is there any possible way to put a DHCP server on a vlan there for these APs? Better practice is to use DHCP with reservations. Is the AP accessible if you take it back to a location with DHCP?

Nash · ‎Sep 19 2019

If we're not supposed to have it, then we're not supposed to have it. 🙂

Nash · ‎Sep 19 2019

Oh nice re: the editing. I am that person who hits post and realizes promptly that they've left off an entire chunk of sentence or step of troubleshoot.

Nash · ‎Sep 19 2019

Definitely don't use RDP proper. My (MSP) company absolutely uses remote connection products for managing clients' PCs. Automate and, back up, LogMeIn right now. We have clients who use them to access specific internal computers. However, we only remotely access devices from company owned and managed equipment. I would not let your users use a remote desktop product from a personal computer, since that way lies data exfiltration and cross-contamination.

Nash · ‎Sep 18 2019

I'm sorry, @Looker44 but no, I'm not joking here. It's not my favorite thing in the world. You do reorder by dragging the arrows up and down. Make sure you save after you do so.

Nash · ‎Sep 18 2019

@Looker44 wrote: I also have this issue with a non Meraki peer. I don't see the answer of how to reset ONE VPN in all these posts. Because you can't. You can bounce tunnels two ways, basically. Both of these disrupt every tunnel you have up: 1. Disable site to site VPN. Save. Wait for config to take effect. Re-enable site to site VPNs. Save. Wait for config to take effect. 2. If you have multiple tunnels, rearrange their order on the list, save. It should tear em down and bring em back up.

Nash · ‎Sep 18 2019

Oh I see, okay. Is your management network participating in the VPN? Does it need to be accessible by any remote sites?

Nash · ‎Sep 18 2019

Do you have a site-to-site VPN setup with the remote site? If so, you need to put the block rule on the site-to-site VPN firewall. Is that where you have this rule? Please do remember that this will only block outbound traffic. The remote end would still be able to try to initiate a connection, but the site-to-site VPN will kill the response. Please see: https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior

Nash · ‎Sep 13 2019

Geese are terrifying cobra chickens but I am a big ol' fan of that goat.

Nash · ‎Sep 12 2019

MINI COWS? Add goats and alpacas and you've got the perfect spot.

Nash · ‎Sep 11 2019

Okay, so you're having the authentication method change? Or is something else changing too? Regarding changing authentication methods, tell your users to never save their user name/password. That will muck up the settings. If Win10, create them a rasphone shortcut and have them use that to log in. That can also help. Win10 appears to have an overlay between its Win10-pretty VPN interface and rasphone, and sometimes that overlay will mess up. If you want a better script, try this thing I wrote. Read the comments first and modify to suit your needs. Default version installs an AllUserConnection with a split tunnel. You have to populate variables for the split tunnel if you're using AddMerakiVPN.ps1

Nash · ‎Sep 11 2019

Aw, thanks, @Phill1. Despite not being an end user person, the one thing I am very good at is making the Meraki client VPN work in Windows. Especially on Windows 10, with its weird overlay on top of rasphone.

Nash · ‎Sep 10 2019

Every workstation that is having problems, yes. If you can deploy a PS script through a tool, it'll suck less. Otherwise it will need to be individually applied to each workstation. Every time a VPN is created on that workstation, you'll need to modify the variable as well. That's why I got lazy and baked it into our deployment process.

Nash · ‎Sep 10 2019

Windows will use your VPN credentials by default to authenticate to network resources, unless you disable it. That's probably why you are seeing that. You can change it by editing a value in the phonebook. My scripty thing will do it automatically on setup, because I hate fixing stuff after the fact. Basic PowerShell command is: # For all-user connections $PbkPath = Join-Path $env:PROGRAMDATA 'Microsoft\Network\Connections\Pbk\rasphone.Pbk' (Get-Content -path $PbkPath -Raw) -Replace 'UseRasCredentials=1','UseRasCredentials=0' | Set-Content -pat $PbkPath # For single user connection PbkPath = Join-Path $env:APPDATA 'Microsoft\Network\Connections\Pbk\rasphone.Pbk' (Get-Content -path $PbkPath -Raw) -Replace 'UseRasCredentials=1','UseRasCredentials=0' | Set-Content -pat $PbkPath This edits your phonebook to change that variable to 0, thus forcing Windows to use the Windows credential to log into server resources.

Nash · ‎Sep 9 2019

@NolanHerring wrote: @RaymondDoucette wrote: If there is budget, an Umbrella license can be added to a Meraki environment to handle DNS security. https://meraki.cisco.com/lib/pdf/meraki_whitepaper_mr_umbrella.pdf and https://umbrella.cisco.com/meraki -R From what I know that just 'gives' you the ability to use Cisco Umbrella directly tied into Meraki wireless. This wouldn't stop someone on the wireless from manually changing their DNS to something else and then Umbrella blocking that from working (or would it?). I'd be surprised if impacted manually configured DNS. For example, I've got the Umbrella roaming client on my PC. I can manually change my DNS and poof, no more Umbrella policies in effect.

Nash · ‎Sep 9 2019

Like Phillip said, that's not a thing Meraki does. The MX content filter can provide non-DNS-based content filtering, but you're not going to be able to hijack people's DNS wholesale.

Nash · ‎Sep 8 2019

You can’t prevent people from changing their DNS settings, but you can deny access from the guest subnet to the common public DNS options over 53 and 443. Would this break the internet for users w private DNS? Sure would. But to be honest, I’m not seeing another option for you here. Not if you’re depending on a DNS filter for this. Do you have an MX with adv security license in your mix? I’m really not a fan of multiple sources of content filtering, but the MX’s content filter isn’t DNS based if I recall correctly.

Nash · ‎Aug 27 2019

There I go, leaving out VLANs entirely. 🙂

Nash · ‎Aug 27 2019

When you're trying to connect to these printers, are you at the new addition or are you trying from the old site? Is the subnet at the new addition the same as at the old site, or different? If different, do you have routing setup? If the same, did it come that way or did you manually convert it? If you go to the addition and join that network, can you ping the printers? Can you connect to their internal webserver?

Nash · ‎Aug 23 2019

Your interesting subnets on the ASA need to exactly match the interesting subnets on the MX. If you need to restrict access across the tunnel, use the VPN firewall rules. Please note that you can only set VPN firewall rules for outbound traffic. You might find https://documentation.meraki.com/MX/Site-to-site_VPN/MX_to_Cisco_ASA_Site-to-site_VPN_Setup interesting. That "no tunnel, ping 100% loss, then tunnel comes up" could be the tunnel dying due to lack of traffic. You send traffic, tunnel comes up. What's the status on the ASA when the tunnel shows as down on the MX side?

Nash · ‎Aug 22 2019

@jdsilva wrote: @BeachBum Haha! My comment was intended to imply laptops are portable, so they can take them home and completely remove the need for RDP. But, your point is a good one and I agree with that too:) For most of my users, it's laptops plus VPN so they can access server resources! Because cloud resources have cooties, I guess. One client left RDP open to the world on a Quickbooks server. They had tens of thousands of USD stolen partly because of that, partly because of brute forceable shared credentials. Small business, so it was pretty staggering. Don't do open RDP.

Nash · ‎Aug 22 2019

From a network POV, if you can't avoid RDP: 1. Only from a device owned and managed by your business. Make sure it is fully updated. Run some kind of AV. Follow some kind of end point management best practices with regards to security. 2. Only over a VPN tunnel. 3. Use long complex passwords for access to RDP. Ideally over 15 char. Passphrases are ideal so users can remember them. Have your sys admins review the Microsoft RDP best practices and implement them as much as possible on the server end.

Nash · ‎Aug 22 2019

If you know which WAN you want active, you can use "Return the uplink information for a device." to pull the... current WAN in use. 🙂 As a proxy.

Nash · ‎Aug 21 2019

Are you sure this wasn't referring to DNA? That'll provide a GUI dashboard for Catalyst 9ks.

Nash · ‎Aug 21 2019

To check events in the cloud console, you go to Network -> Event Log. Meraki firewalls are beginning to offer HTTPS packet inspection in a beta version of the firmware, but the performance hit is significant. AMP offers malware detection over HTTP by default, and you can use the baked in content filtering. I will note that I am generally really NOT a fan of HTTPS packet inspection. We encrypt stuff for a reason.

About Nash

Nash

Nash King

Community Record

Badges