Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About TonySmith
TonySmith
Getting noticed
Member since Sep 13, 2017
May 14 2024
Community Record
24
Posts
3
Kudos
0
Solutions
Badges
May 8 2024
7:54 AM
Thanks. I had a brief chance to troubleshoot and actually the route to 172.17.88.0 works, I wouldn't swear I fully tested that before as I might have assumed that if one route worked then so would the other. Doing a network wide packet capture for ping to 172.17.1.1 shows the packets being received but no answer. But that's the same taking a capture for ping to 172.17.88.1 which does work, only the ping request is seen, I guess because the reply comes direct from the Mikrotik on 217.2 to my PC 217.10.
... View more
May 6 2024
8:48 AM
No custom rules, only the default inbound "deny any any" and outbound "permit any any". This begs a few questions .. 1. Do these rules work differently with a Z3 vs a Z1? 2. Do they apply to traffic between hosts on the LAN ports? 3. And if so, which direction is considered "inbound" and which "outbound"? I should add that if I add the route into the PC then it works. So traffic between PC and 217.2 isn't being blocked by the Z3.
... View more
May 5 2024
4:37 AM
Sorry I should have mentioned the Z3 is only powered on when I'm working, not all the time. I was just checking there wasn't a stale ARP entry stuck for 217.2. Just looking at the dashboard I see .2 listed as a "client" with its 217.2 address, and some traffic was registered when the Z3 was online yesterday.
... View more
May 5 2024
4:29 AM
Yes can ping either way. When the Z3 is switched on of course.
... View more
May 5 2024
1:37 AM
Thanks, I don't think I have. It's been a couple of weeks so I wouldn't expect it to hang onto the old ARP entry that long. It's not Meraki or even Cisco device and I don't know the ARP timeout. But checking just now it has no ARP entry for anything on 172.17.217.0
... View more
May 4 2024
7:33 AM
Hi, Attached to my home office network I have three subnets, call them 172.17.217.0/28 which is directly attached to the Z1 inside interface. Z1 is 172.17.217.1 and is the default gateway. Secondary subnets 172.17.1.0/24 and 172.17.88.0/24 are reached via a separate device 172.17.217.2. So that device is on the local "inside" LAN alongside the Z1 and routes to 172.17.1.0/24 and 172.17.88.0/24 are configured on the Z1 under "Teleworker Gateway" / "Addressing and VLANs" / "Routing" / "Static Routes" with (obviously) 172.17.217.2 as "Next hop IP". Both routes are Enabled and active "Always". All this worked correctly when configured. However recently the Z1 failed and was replaced with a Z3, and now they do not work. Trace from a host on the inside LAN times out after 172.17.217.1 the default gateway. Any ideas would be appreciated in case I've fat fingered something, before I raise a Meraki support case. Thanks, Tony S
... View more
Dec 14 2022
12:09 AM
@Ryan_Miles wrote: The recommendation is to setup and use MFA. I don't see why that should be considered any less inconvenient. In fact since it needs a separate device, it would actually be worse than the email. I think if Meraki wanted to mandate 2FA then it would be better to just say so, rather than trying to pressure people by making normal login as unpleasant as possible with all these clicking on photos and other steps.
... View more
Dec 7 2022
3:58 AM
1 Kudo
It gets worse, logging today I had to deal with this as well ...
... View more
Dec 6 2022
8:51 AM
1 Kudo
Thanks. I've submitted feedback through the Dashboard as well as via the support case.
... View more
Dec 6 2022
8:16 AM
1 Kudo
I don't hold out much hope, but if you raise a support case you can express your opinion. The more people who do that the greater (but still microscopic) chance of them fine tuning this function so it works as they say it should.
... View more
Dec 6 2022
7:42 AM
According to information just provided by Meraki support it is not so much "the new 2FA", instead it is something that they enforce for users who do NOT enable 2FA. Meraki have also confirmed that it is enforced for every single login, contradicting their documentation which states it's only for "suspicious" logins. So as it stands at the moment you only have the two options, either enable 2FA and use an SMS passcode, or don't enable 2FA and have to use this email passcode.
... View more
Dec 6 2022
3:02 AM
Thanks, but this email verification is not the same as 2FA which uses SMS passcodes
... View more
Dec 6 2022
1:56 AM
Thanks. That article refers to it only being required for "suspicious" logins, however we're finding it affects every login whether from remote locations or from our own HQ (passing through our MX). How does Meraki define "suspicious"? This new behaviour is a right pain in the neck, particularly as the emails take so long to arrive, and are needed even if you log out for just a few seconds.
... View more
Dec 6 2022
12:43 AM
Hi, This has started happening suddenly, every time we log into the Dashboard we need to wait for an email with verification code, then type that code into the Dashboard login page. Does anyone know why this has started happening, and how to stop it? I have a case open with Meraki support and they haven't yet come up with an answer Everywhere that I have looked, or where they have asked me to look, 2FA is disabled. In any case 2FA seems to refer only to SMS verification, not email verification which is what we're having to deal with. Thanks, Tony S
... View more
Labels:
- Labels:
-
Other
Nov 10 2021
3:33 AM
Hi, Is there a general rule for EOS devices, for how long they are permitted to continue working? I believe from what's been posted here that they do not stop working at their EOL date, and indeed renewal licensing can possibly be purchased after that date. However I don't think I've seen this explicitly stated in a Meraki document. Nor have I seen any indication of the final dates at which EOL devices would no longer register with the dashboard or in some other way become unusable. Any information would be welcome, Thanks, Tony S
... View more
Mar 17 2021
1:42 AM
Meraki have explicitly told me that this latest three year licence is 1095 days. "The new date has been calculated 1095 days from March 11 2021 (start date of new license)"
... View more
Mar 16 2021
8:57 AM
I've steered away from per device as well. It seems OK I think to start with, but once devices are added I think it could become a bag of worms with manual co-terming etc. Not as easy as Smartnet where you can just select all items and set a common end date. It seems to me that unless we can persuade Meraki to play fair, the only way to avoid customers getting short changed is to hold off their renewal order until they're into the grace period. I don't like that as it either means leaving things to the last minute, or getting the customer's go ahead well in advance but then sitting on their order before placing it with Meraki. It would be easy to mess up I think, and looks bad to the customer to have licence alerts on their dashboard.
... View more
Mar 16 2021
4:58 AM
"maybe it looks like you only get a portion of your license because you’re extending all license" I understand that although it's a different issue, we see that when adding devices and it sometimes needs to be explained to a customer. In the renewal cases I'm referring to the new licence was applied as a renewal, to a co-termed organisation, and covering all the devices in their networks. Meanwhile if I read Meraki's initial response correctly, they have confirmed that they view three years as being 1095 days. So it sounds like they don't know about leap years, which is what I suspected. I suspect I'll hit the normal Cisco type brick wall but I think this is unreasonable, and also unreasonable to issue licences well outside working hours, then blame the customer for not acting on them the same day.
... View more
Mar 16 2021
2:05 AM
Hi, I was wondering what is the best tactic when renewing licences, to make sure that you get the full term you paid for. Our customers (naturally) expect that if they pay for three years, their renewal date will be extended for three years. However it seems with Meraki that for various reasons they knock off a few days. For example if the licence is issued by Meraki late one evening, but only applied the next day, then that's one day deducted. As another example not yet confirmed, I think they don't count leap years so a three year licence is actually 1095 days, losing another day in almost all cases. These are all examples where the dashboard was renewed well before the existing renewal date, which is what you would expect Meraki to encourage. In contrast a couple of customers left their renewals late, into the grace period. In both cases they have been give more than the term paid for, for example previous renewal date of 18th July, licence applied on 12th August, new renewal date 12 August. It can't be right that Meraki is in fact rewarding customers who leave their renewals late, and penalising those who renew in good time, but that is the actual effect.
... View more
Sep 28 2020
12:36 AM
That's confirmed from Meraki. Their suggestion is to open up the home network for access from the Internet, and make the connection that way. That's not really practical. The only sensible solution seems to be to a connection from the home router to the LAN side of the Z1, and static routes pointing that way.
... View more
Sep 24 2020
8:24 AM
I think the answer I'm getting back from Meraki is that it's not possible. They're suggesting creating inbound NAT rules on the home firewall to allow access to the home network from the Internet.
... View more
Sep 24 2020
5:50 AM
No firewall rules at the moment. LAN side is a different subnet from the home network on the Internet (WAN) side. Traceroute shows slightly odd results. If I trace to an Internet address I see the LAN side of the Z1 as the first hop, as expected, however the second hop is from the Internet provider on the other side of the home router. It's as if the home LAN that extends between that router and the Z1 is being masked in some way. If from the LAN side I try to open a web browser session to an address on the WAN side subnet, even to an address that is not in use, then I get the Z1 web page.
... View more
Sep 24 2020
4:54 AM
Thanks. So when you say "LAN side" you mean what the Z1 calls LAN, which is where my work PC connects. From there I need to be able access devices on the home network. At the moment that doesn't work. From the work PC if I ping any address on the home subnet I get a response, but in fact this is being spoofed by the Z1 in some way. If I open a web browser to any of those addresses I get the Z1's management page.
... View more
Sep 24 2020
2:49 AM
Hi, This is a typical Z1 installation, the Internet interface connected to the home network, creating its tunnel to an MX at head office. It does not have full tunnelling enabled, only site to site VPN traffic goes to the MX, Internet traffic breaks out locally using the home Internet connection. Is this possible? I'd like to add access both to the connected subnet on the Internet side, and to another downstream subnet. Thanks, Tony S
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 6078 | |
| 1 | 6288 | |
| 1 | 6323 |
© 2024 Cisco Systems, Inc.
