Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About AaronJames
Community Record
13
Posts
2
Kudos
0
Solutions
Badges
Jun 25 2020
6:23 AM
Hey NolanHerring, Many thanks for your detailed reply. That all makes sense, I'll go through list and implement your recommendations. 🙂 If I have any issues I'll post back. Kind regards Aaron
... View more
Jun 24 2020
8:27 PM
Hello, I'm looking after a couple of MR42's in a network that are connected to the POE ports on an MX65 appliance. We were having a few client wifi dropouts, so I changed each AP to have separate SSID assigned to them, instead of applying the SSID's to all AP. I figured the users were probably roaming to the closest AP and disconnecting/reconnecting at random times depending upon signal strength. I also got the users to forget the other SSID and only have the one SSID saved. Am also getting them to update their device OS and wifi drivers and check their power/sleep settings. SSID's are set to use WPA2 with Pre-shared key (PSK), NAT mode: Use Meraki DHCP, no vlan tagging or filtering and Dual band operation with Band Steering is set and wifi channel is set to auto. There are typically between 3-10x clients connecting to the AP's. Clients typically connect between 27-52db. All clients appear to be connecting via 5Ghz. Clients are a combination of Windows10, macOS, iPhone and Android. I'm noticing some clients are still getting disconnected randomly and noticed sometimes we get this error in the logs: 802.11 disassociation - unknown reason. Which doesn't give much info. Does anyone have any recommended further troubleshooting steps or wifi configuration change recommendations that might help alleviate the dropouts or improve roaming between AP (if that is still the issue)? Kind regards Aaron
... View more
Nov 24 2018
4:30 PM
Hey DSchn, ahh so cloud DNS won't work then. So, to achieve split tunnels for local and public domain routing with Meraki equipment, you either have to have your own on-prem DNS server or make the DNS settings manually on the clients?
... View more
Nov 24 2018
4:27 PM
hey jdsilva, In the end I created a case with Meraki support as I couldn't get it to work. They've told me running 2x VPN tunnels from AWS to 2x MX in One Organisation is not possible. The reason is, AWS creates a separate public IP for each tunnel and you can't link 1x non-meraki-vpn-peer to 2x public IP. You also can't create 2x non-meraki-vpn-peer that both contain the same private subnets. So, the solution is to either split into 2x Organisations, or deploy a vMX in AWS. I think for now we'll go with 2x Organisations.
... View more
Nov 23 2018
12:50 AM
That's what I thought too, but reading further into the Google Cloud DNS and it says this: When to use Cloud DNS DNS is a hierarchical distributed database that lets you store IP addresses and other data, and look them up by name. Google Cloud DNS lets you publish your zones and records in the DNS without the burden of managing your own DNS servers and software. It also mentions Split horizon DNS and lists the ability to manage domain resolution to public IP and domain resolution to internal (private) IP. Link: https://cloud.google.com/dns/docs/overview
... View more
Nov 22 2018
10:07 PM
Oki so trying to get my head around what you mean. Apologies for my slow learning curve. So, at the moment on the AWS side: - The AWS Customer Gateway has the public IP address of Site1 MX65. - The AWS VPN connection has the tunnel settings and static routes for which subnets can communicate over the vpn (Site1 MX65 subnets and AWS subnets) (ACL's and security groups are also set but probably don't need to go into that). So what you're saying is, on Meraki dashboard, Site-to-site-VPN>Organization-wide settings> Add one non-meraki-vpn peer with the AWS vpn connection tunnel settings, then add all the "private subnets" we want to connect to on the AWS side, then for "availability" add "all networks" so both site1 and site2 MX's can communicate with AWS. If that's right, what I don't understand is, how would AWS communicate with the public IP of the MX at Site2 for data flow to work to that MX? Or is that just assumed because it's global and both MX's are considered part of the same network?
... View more
Nov 22 2018
5:18 PM
Hey jdsilva, Ok I've tested the settings you suggested and I'm getting a subnet error. Here's what I've set: Added a 2nd VPN connection to AWS for the 2nd site. Set AWS vpn1 to only include Site1 subnets. Set AWS vpn2 to only include Site2 subnets. Set both MX65 to hub auto vpn mode (no exit hub). Set Site1 non-meraki-vpn to AWS to only include Site1 subnets. Next I tried to add the second non-meraki-vpn to AWS for Site2 with only Site2 subnets. However, I get this error: There were errors in saving this configuration: The subnets on non-Meraki peers site1-non-meraki-vpn-to-aws (10.1.0.0/16) and site2-non-meraki-vpn-to-aws-test vpn (10.1.0.0/16) conflict. It looks like I can't include the same AWS subnets in more than one VPN configuration? Could I use a default route of 0.0.0.0/0 for both non-meraki vpn's instead? What are my options do you think?
... View more
Nov 22 2018
4:45 PM
Would using a 3rd party DNS service like Google Cloud DNS solve this? https://cloud.google.com/dns/
... View more
Nov 22 2018
3:15 PM
Also, both MX65's are under the same Organisational dashboard, I'm assuming that's ok too and they don't need to be split into two Orgs?
... View more
Nov 22 2018
3:08 PM
Ahh thank you yes, that makes sense. I'll discuss with my AWS guy and see if we can implement. Thanks for your help 🙂
... View more
Nov 22 2018
3:00 PM
Hey jdsilva, many thanks for your reply. 🙂 If I turn Site2 into hub as well, won't that mean the default route setting get's automatically enabled in the auto vpn so all traffic at Site2 will go through Site1's internet? Also, if I add a 2x non-Meraki VPN into AWS, won't I get some routing mess/crossover between the two networks and AWS?
... View more
Nov 22 2018
2:44 PM
Hey Guys, Nice to meet you all. This is my first post! I've got an MX65 configured at Site1 to use a non-meraki-site-to-site VPN to an AWS host. I've configured allow rules and routing on the AWS side so traffic over the VPN can flow. That's working well and I can connect to devices in AWS over the VPN. I've now added a 2nd MX65 to the Organisation at Site2. I've set Site1 VPN to Hub (mesh) and Site2 VPN to Spoke and ticked allow local subnets to use the VPN. I can communicate between Site1 and Site2 over the VPN. I've updated the allow rules and routing on the AWS side to include the Site2 subnets. However, I can't seem to get any traffic going from Site2 to AWS. I've disabled all firewall deny rules in case they were interfering. I thought MX65 auto populate VPN routes to other MX65 peers. Is there some other route or rules I need to set in the MX's to allow traffic from Site2 to reach the AWS side over the non-meraki-vpn-to-AWS? What do you guys think?
... View more
Labels:
- Labels:
-
3rd Party VPN
-
Auto VPN
Nov 22 2018
2:42 PM
2 Kudos
Hey everyone, I'm an MSP, more used to Sonicwall and Sophos, but diving into Meraki. I hope to help people in the community, learn a lot and make new friends!
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 55621 |
© 2024 Cisco Systems, Inc.
