Meraki

from_afar

Thanks. Did you mean Secure Client? It looks like Cisco references "Secure Connect" as an umbrella term for their SASE and SD-Wan solutions: That looks like the same page, and the Meraki devices and the software running on them that provide SASE/SD-Wan do indeed auto-update, but this is different than the VPN client. The VPN client is (was) AnyConnect which they are renaming or replacing with Secure Client. This is what I can't download or get to update. Thanks again for the help. I've sent several follow-up emails to my AT&T salesman informing him everything I've heard from here, Cisco and Meraki support, etc. and it's been radio silence for several days (once again--this is typical).

from_afar

@CptnCrnch @PhilipDAth I'm certain that I remember when going through the sales pitch(es) with ATT that the VPN user count was part of the deal. What does that pay for? Can you even use Secure Client without a support contract? It seems crazy to me that regardless of support contract status Cisco would allow people to use their VPN products with old software that contain critical vulnerabilities. Does the AnyConnect VPN software download section in the Meraki interface ever get its software updated? Or is it just forever stuck on whichever version was available when you first set everything up? FYI this is what is listed on the sales sheet the ATT rep gave me:

from_afar

I'm seeing in Microsoft Defender Endpoint Protection that the Secure Client has several Critical Vulnerabilities in version 5.1.6.103 which is the version available in the Client VPN anyconnect client download links and installed on all of our clients (the MX-95 itself is auto-updated and appears to be up-to-date but for some reason that doesn't appear to update the Secure Client downloads...anyone know how that happens?) I can see in the Cisco downloads that version 5.1.7.80 is available but I cannot download it because I don't have the right contract number apparently. I contacted the sales rep from ATT I bought the system from and he sent me a copy of the PDF sales contract but none of the those numbers work when trying to add to the Cisco site for entitlement enablement. I contacted Cisco support and they can't seem to be able to help. I've provided every number I can find (customer number in Meraki interface profile dropdown, S/N of all of our equipment, all emails used to log in, company name emails and addresses but they can't seem to be able to help (they just keep telling me to contact the reseller). Wondering if anyone else has experience with this or other resellers and was able to enable downloads from Cisco?

from_afar

I noticed that our MSFT Defender vulnerability reports are showing that all of our SecureClient/AnyConnect clients are out of date and contain 2 vulnerabilities one of which is critical (CVE-2024-20337 and CVE-202420474). I deployed these over the summer and obviously they aren't auto-updating which I thought (hoped) they would. The MX-95 and MX-68 do automatically update weekly and report being up-to-date. However, on the SD-Wan > Client VPN > AnyConnect Settings page, the download links are for the same version that is already installed (5.1.6.103). We got the service and equipment from AT&T so don't have a direct contract number unfortunately so I can't download the latest version from the linked Cisco support page, but I was wondering how people are keeping their AnyConnect clients up to date. We do have Intune which is probably what I will try if/when I can get the download, but if there is a better tool or method I'd love to hear about it. Thanks.

from_afar

It has not been resolved for me. I still cannot get any SMB file transfers to happen faster than ~5MB/s at most. Usually hangs around ~1-3MB/s. I've spent 10+ hours on the phone with Meraki and ATT support trying to fix it to no avail. Not sure what other options there are--we're trying an MPLS line but are still having similar issues with that when it is connected to the Meraki equipment for some reason. I may end up just getting cheap netgear or whatever hubs to put at both ends of the MPLS line if I can't get it solved soon. I will report back if/when that happens. And to be clear: this does not include solving for the same slow connectivity when people use AnyConnect Secure VPN client. All VPN users experience the ~5MB/s slow SMB file transfer speeds no matter what. Otherwise, I'm experiencing the issue on the SD-Wan connection to our single second location. Those users all have abysmal file transfer speeds over SD-Wan on 1GB connections (all speed tests show full symmetric speeds are being achieved).

from_afar

Thanks. I have and had that exempted as well (I haven't made any changes there in weeks) but something was still blocking it. I searched for the domain in the Reporting > Core reports > Activity Search and it always showed as "allowed" not blocked nor selectively proxied. This is what confuses me the most; it seems to consistently not report in Activity Search what is actually happening to the clients. Not sure why, but that has been the case multiple times.

from_afar

Possibly. I added it to every bypass/whitelist I could find and only the final step actually worked. Maybe I missed one? I have Health and Fitness (it is an insurance website so should fall in there) selected as Exempt in Intelligent Proxy/SSL selective decryption exemptions. File analysis is not enabled. I also thought that adding the domain to Meraki UI > Security & SD-Wan > Threat protection > Umbrella protection > "Specify one or more domain names below (one per row) to be excluded from being routed to Cisco Umbrella." would completely bypass Umbrella but that didn't seem to work...

from_afar

Thanks. No countries being blocked. Finally got it working via Umbrella External Domain and IP list. 😤

from_afar

Adding the URL to the Bypass Umbrella, Domain Allow lists, URL filtering allow list and AMP bypass did not work. However, adding it to Domain Management > External Domains & IP's in Umbrella finally allowed it to load. I don't understand why it didn't show in any of the reporting as being blocked nor proxied, passed all Policy Testing tests and especially why the Bypass Umbrella "Specify one or more domain names below (one per row) to be excluded from being routed to Cisco Umbrella." entry did not work.

from_afar

Anyone else seeing employer.carefirst.com being blocked? Strange because member.carefirst.com works OK, but employer just sits there until it times out. I don't see anything being blocked in the Reports, but I don't have anything else that could be blocking it. I tried adding to the "allow list" destination list as well as the allow list in URL blocking in Meraki interface. I'm just wondering if they are blocking the proxy addresses or something because I don't see what else is blocking it (I can get to the site fine on WiFi which is on a different network that doesn't run on Meraki or have Umbrella).

from_afar

It's mind boggling that I keep hearing this and from support I keep hitting dead ends. Are the users opening large files across the SD-Wan connection? i.e. are they running programs on their machines that open files on the servers/hub and do work and have it be performant? That is where my main issue lies--the users can browse/see the files fine, but when they go to open a file and do work, it is unbearably slow....this is how I discovered the issue. Trying to diagnose, I went to copy a file from the server to one of their machines and saw it was only getting ~5MB/s despite the 1GB connections, etc. As a workaround, Iv'e set up remote desktop session hosts so they can run the software on the servers remotely and that works fine so RDP is OK, but it is finicky and still isn't ideal. We also have a couple of intranet sites that work fine as well, so it really just seems to be SMB.

from_afar

Thanks. I think this is what the Meraki tech I was speaking to was kind of talking about but the problem is that the MPLS doesn't have it's own IP addresses. It is just a Layer 2.5 connection so there is no IP addressing--it's acting as if it is just a very long cat6 cable as far as I understand. Should I buy more equipment to put on either end? Or should I program the ports in the MS-125 and MS-120 that the MPLS line is connected to? I suppose I could set the Ports to a different VLAN? But the hub a spoke SD-Wan is set to automatic so on the MX-95 addressing and VLAN's is set to Single LAN as per ATT configuration to get SD-Wan working...I can set/create static routes, though, but again, no IP addresses on the MPLS line and I don't actually see a way to set an IP on the MS switch ports, just can set VLAN.

from_afar

Well, I did in a way that is how I ended up with the MPLS line. That was the "solution" to the problem. It may still be in a way, I was just hoping that I wouldn't have to replace all of the equipment. I can drive the 5 hours one-way back down to the spoke, plug everything into a dumb Netgear hub, then do the same up here at the hub. I didn't imagine that just continuing to use the Meraki switches would continue to cause the problem with the MPLS line in place.

from_afar

Thanks again for trying to help. I appreciate everyones input. I spent another 2 hours on the phone with ATT support Wed. and their answer was "we don't manage the MS switches so pound sand". So I created a ticket with Meraki. The engineer did his level best, but kinda came to the same result. He suggested hooking the server directly into the MX to bypass the switches. I couldn't do this and interrupt work, but I did plug in a laptop and set a share up on it. You guessed it: exact same result. The network is dead simple. 2 Locations: Hub and spoke. 3 ISP at each end (spoke: Comcast cable, VZN fiber, Comcast MPLS); Hub: Charter cable, Crown Castle Fiber, Crown Castle MPLS (Comcast doesn't work in this area so had to use Crown Castle to terminate this end of the MPLS connection). I've tried using both ISP's at the spoke for the SD-Wan; they are both 1G connections; speed test verify. Also tried Charter and CC Fiber at the hub for SD-Wan. ISP doesn't seem to change anything. Here is a simplified diagram: Here is more detail (the above showing the troubleshooting with laptop hooked into MPLS line at the spoke). Thanks again for everyone's help.

from_afar · ‎Nov 20 2024

Going back through some old posts (seems that every time I try to google for more answers, it just keeps bringing up posts I’ve made in the past) I think I mistakenly stated that I was getting poor performance in iperf testing as well. This is NOT the case. iperf showed much better throughput which is where I think was leading people to just blame smb and tell me it’s expected behavior. I’ve now tried the MPLS line and if it is plugged into the Meraki stack at all, I get the same abysmal performance. If I plug a laptop into both ends of the MPLS line, I get file copy speeds at ~100MB/s. Are there any tools anyone would recommend to try to diagnose performance issues on Meraki equipment? Specifically MX-95/68, MS120/125/425 devices?

from_afar · ‎Nov 19 2024

I added a new bypass user to Umbrella and when they log in (we are using SSO), they get a page saying that they do not have access to the Umbrella dashboard. I assumed dashboard.umbrella.com would make sense as a login for bypass users, but they seem to be getting confused when they see this message. Is there a better URL for bypass users to use to log in so Umbrella recognizes them and allows them to bypass restrictions?

from_afar · ‎Nov 19 2024

Are you downloading from Windows or from somewhere on your LAN? If from the web, you can try adding windows download (and other) URL's to your global or specific Whitelist/Allow list. You can also try to bypass Decryption if you have that enabled. Finally, you can avoid Umbrella altogether with those domains/URL's by adding them to the Security & SD-Wan > Threat Protection > Umbrella protection > "Specify one or more domain names below (one per row) to be excluded from being routed to Cisco Umbrella." text area.

from_afar · ‎Nov 19 2024

I'm trying to solve an issue with some Mac users that are having problems with our tunnel all config on AnyConnect (we must use tunnel all for our AnyConnect VPN users for various reasons). The Mac users aren't necessarily under this constraint so could have tunnel all turned off. However, there doesn't seem to be a way to do this with AnyConnect (I tried checking if I could create separate profiles for them but didn't see a way to accomplish this). This leaves setting up IPSec VPN for them to use. However, after setting IPSec up, I could not get it to connect with AnyConnect still installed on the Macbooks (there is the Socket Filter and other utilities that can't be turned off--or just turn themselves right back on if disabled--not sure if this is why) but once AnyConnect was fully uninstalled, the IPSec tunnel works. I thought this might be the answer since in the Options settings for the VPN, there is the option to "send all traffic over VPN" which can be turned on and off. But when I try this, it doesn't seem to allow any traffic to the LAN to connect when "send all traffic over VPN" is turned off. What traffic should be sent over the VPN if "send all traffic over VPN" is unchecked? It seems like when I uncheck the "Send all traffic" checkbox, I cannot reach anything on the LAN when the VPN is connected. I can't ping, nslookup, or reach any intranet sites or anything. When "send all traffic" is checked, I can reach everything on the LAN fine. Is there some way to either turn of send all traffic with AnyConnect for just "some" users, or is there some way to determine what traffic is sent over the VPN when IPSEC VPN is connected and "send all traffic over VPN" is un-checked? Thanks.

from_afar · ‎Nov 18 2024

Now that I'm thinking about it again, I had to create a ticket with ATT to get them to add the device to the config which they did, but I never did follow up and actually connect/test it. I tried over the weekend, but for some reason, I cannot get the device to connect to the Meraki cloud. It says it is connected to the internet, but it will not connect to Meraki cloud. I've tried 3 different internet connections including a backup Verizon Wireless connection that connects fine when plugged in to the laptop, another Cable connection where I specifically added outbound open ports for meraki cloud, and plugging direclty into Cable modem. For some reason, it will not see the Meraki cloud so I can't get it to fully connect and test.

from_afar · ‎Nov 15 2024

Thanks. Funny you mention it, I actually bought another MX-64 out of desperation to test and try to figure all of this out. I didn't set it up down at the spoke location but created a test spoke on another CABLE ISP connection we have here and was getting the same results.

from_afar · ‎Nov 14 2024

Yes as well as using different ports, verifying CAT6 vs CAT5e, directly connecting to the MX-68 with client (bypassing the MS120 altogether); basically tried every possible permutation of physical connections.

from_afar · ‎Nov 14 2024

As for the MX-68 connection at the spoke location, it is plugged into a 1Gb port on the MS120 there and it is reporting 1Gbps (no SPF on MX-68): It's only people at the spoke (and AnyConnect users but I'm just trying to tackle one problem at a time) location who are seeing the terrible file copy speeds from/to Servers at the HUB. At the HUB, everything is working fine on the LAN 400-500MB/s file copy speeds: ^ File copy from server to client on the LAN at the HUB. I use this same server for all testing.

from_afar · ‎Nov 14 2024

Would be happy to but unfortunately I'm not exactly sure how. I know how to run Wireshark etc, but to grab the handshake...not sure when that happens. Should I start the capture then just do the usual copy and paste from Hub Server to Spoke client and let it run for a minute? Or does the handshake happen when the client comes online to the network?

from_afar · ‎Nov 14 2024

No, I know....sorry, just exasperated...I do truly appreciate you all helping me out here... No, I disabled IPv6 long ago as same as you, it seemed to be causing much more trouble than it was worth (especially since we are a small shop).

from_afar · ‎Nov 14 2024

Agree, wireshark is a great tool and one of the many we used on our Hours-long debugging session with ATT&Meraki. We used both the built-in packet capture and I already had Wireshark on the machine I was debugging with and I sent many a pcaps their way.

About from_afar

from_afar

Community Record

Badges