Meraki

Paul_H · ‎Oct 13 2021

@anky_sa ... wait you DON'T want to purchase EXTRA things you won't use nor need!??! 😉 😉 The previous posts are spot on! You do NOT need Enterprise if purchasing Advanced Security. In the mean time, we're looking into the webpage/tool in the background!!! Thanks for bring this to our attention!

Paul_H · ‎Oct 13 2021

@Rexter ! A Lot of options here! Personally, I would check with your system's admin to see what computers they've logged into in the last few months and grab the computer name/hostname. That might be easiest to search on the dashboard as that name will be the default name for the laptop. (Search clients with Network-Wide --> Clients --> Search) You, could always search Event Logs for RADIUS all the events... but what might be more targeted is jump into Wireless --> Health. There you'll be able to click on authentication to sort all the clients of those who are FAILING to auth: (In yellow) Once there, you'll notice it jumped you to the Connection Log tab on the top and filtering by Failure Step --> Authentication. From here, you could filter out specific SSIDs that would give you a more focused view on what devices are failing to auth and hopefully can correlate the hostnames you've gotten from your system's admin! See below what that page looks like within Health: Let me know how it goes!

Paul_H · ‎Sep 26 2021

Yo, @Brash ! Good catch and solid homework for standing up a new site! Meraki was truly limited on the information USB modems were sending to us (via USB) and a lot of times if there was a change made by the carrier to the USB modem, we wouldn't know and would have to play catch up! So, the list of modems we previously had we made good partnerships so that there would be open communication. **HOWEVER** The previous list of approved modems are all End of Sale and for the most part the manufacturer no longer supports them, so naturally, it's a bit hard for us to support them as they're basically a bit of a black box to us! --> MG on the other hand .... 😉 --> MX USB modem enforcement is not a thing - but caution: No Guaranteed support Good luck with the new site! Hopefully it has stacks and stacks of MS... and MRs all over the place... MT to monitor some temp/water/leak... oh and don't forget MV for physical security! ...maybe some SM on all them ios devices? O:)

Paul_H · ‎Jul 16 2021

Within Wireless - Access Policy "Assign group policies by device type"... then select ALL the types and assign your PSK-ONLY-BLOCK-Group Policy 😉 Then within Network-Wide clients page - Add client section to override and assign a group policy to actually allow things 😉

Paul_H · ‎Jul 16 2021

Hey @WarrenG ! I've definitely encountered this before and as mentioned above you could leverage a firewall to do it like @PhilipDAth and or leverage @Inderdeep 's ideas as well! A 3rd option... (because Meraki is SO flexible 😉 ) You can: --> Create an SSID with PSK and enforce a group policy to be applied that has deny ANY ANY. --> Under Network-Wide, Clients - Add a client by MAC address --> Specify a unique Group Policy that grants access to that client MAC either globally or PER-SSID --> Sit back like a Dashboard DJ! Hope that helps as well!

Paul_H · ‎Jun 10 2021

Hey @suneq Thanks for the inquiry! Keep in mind the basics!!! Routing/internet/IEEE rules still apply to Meraki 😉 Having said that, there will need to be a device between your internet and Meraki that will do some sort of NAT translation. So, while yes, you can use private addresses on the MX for what you mentioned (and a LOT of people do!) you will need something UPSTREAM between you and the internet that would NAT to a publicly routable address! Also, keep in mind, both MX appliances require individual WAN uplink IP addresses for independent cloud access and uplink monitoring. (See Connection Monitor Doc) Using a /29 or larger WAN IP mask allows for three addresses on the shared segment to each provider. ALSO, this is a bit dated, but the info is STILL great! Check out this HA guide by one of our own employee's blog: https://www.willette.works/mx-warm-spare/ Good luck!

Paul_H · ‎Mar 23 2021

Hey @Paul03 !!! Thanks for taking the time! And to answer your question: Absolutely! ...at least on your Meraki wireless. Find the client on your dashboard under Network-Wide -> Clients then select the particular wireless client. You'll notice near the bottom of the page there will be a Policy section. Select the the device policy dropdown and modify per SSID as needed. (As shown below) Hope this helps! -Cheers!

Paul_H · ‎Mar 17 2021

Nice! Thanks for that @Naresh_Bhardwaj ! I would echo what @BlakeRichardson mentioned. If you're using the MX for DHCP, double check your Security & SD-WAN -> Addressing and VLANs page and make sure your subnet VLAN "MX IP" is configured correctly. Because based on that configuration, the client would be getting the IP address directly from the LAN the AP is plugged in to. Another Question: Does the Meraki Dashboard report the correct/expected IP address of the client device at Network-Wide -> Clients? If the dashboard is correct, then I would guess there could be a VPN or proxy setup on the local machine. So while you're getting a local IP, there could be an agent on the machine that is forcing the traffic elsewhere. As always, with ALL Meraki products that you own and are licensed for... Ping Meraki Support too! They can jump into your dashboard and validate your findings and give you real-time feedback to help you work your way through it! You can go to Help -> Get Help on your dashboard or view some contact info here: https://meraki.cisco.com/support/! Hope that helps!

Paul_H · ‎Mar 17 2021

Greetings @Naresh_Bhardwaj ! Quick question... Within your Wireless -> Access Control Settings under that particular SSID and under "Addressing and Traffic" do you happen to be using "NAT Mode"? If so, Meraki's cloud handles the DHCP of the client. This is done in order to isolate/segment guest traffic from all of your other infrastructure. For more information check out our handly dandy doc: https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP -Cheers!

Paul_H · ‎Mar 15 2021

Hey @sandyy ! Welcome! Great question! A great place to start would be to study/learn about our connection monitor here. This goes into some depth of how we monitor, maintain, and ultimately mark a WAN connection as healthy or unhealthy. The health of that port will be reported on the dashboard or via email alerts (Network-wide -> Alerts -> Uplink Status changes) or via API with a GET on /organizations/{organizationId}/devices/uplinksLossAndLatency. (API Documentation) Hope that helps! -Cheers!

Paul_H · ‎Mar 8 2021

Greetings @hmc250000! What @DarrenOC is true! HA configuration is quite straightforward and the doc you originally posted should do! To your questions: "Where do we configure the VIP?" The VIP can only be configured on the WAN interfaces "Can we use private ip addresses?" Private address space can be used for your WAN interfaces including your VIP - likewise, these must be in the same subnet. So just make sure there is at least a /29 to accommodate the 3 address. A-WAN1/B-WAN1/VIP How would this work for the LAN?" Typically, we see, depending on the placement of the MXs and the gateways, the LAN ports configured as transit or management networks. There also needs to be communication between the LAN ports of each MX via a switch downstream in order to exchange VRRP heartbeats. The MX doesn't participate in STP, so it is best like Willette.Works' doc mentions to prune out your Mgmt/Heartbeat VLAN on a specific LAN port to prevent unintended BPDU flooding. Hope that helps!

Paul_H · ‎Mar 5 2021

@arapheon VRRP will absolutely be implemented as this is the mechanism we leverage to elect which is the active MX. Do keep in mind VRRP advertisements are sent out the LAN ports only (once every second) as there is no guarantee the WAN ports will be able to communicate so they won't be sent out those interfaces. As far as your initial post about DHCP/VPN drops, I would definitely open a ticket with support so they can validate the issues you're seeing and offer their expertise! Hope this helps!

Paul_H · ‎Feb 17 2021

@PhilipDAth Quick clarification! 😉 Cisco ISE is not required to leverage Adaptive policy. You can assign devices/groups/SSIDs/Interfaces SGT values via the dashboard. Likewise, you can natively: Define Policies, Source/Dest/SGT value/Descriptions Create groups and bind them to network objects Create custom ACLs to apply within policies Apply specific Adaptive policy to targeted networks In order to dynamically authenticate and assign unique user SGTs, then Cisco ISE is an EXCELLENT choice to do so! (@BobbyMcLeod Likewise, Cisco ISE is only NAC that can hand out SGTs)

Meraki

Community

About Paul_H

Paul_H

Community Record

Badges

Re: Advanced Security license for MXs query.

Re: Tracking down devices that are failing Radius authentication

Re: Meraki MX USB Modem Compatibility

Re: Restrict access by PSK and MAC?

Re: Restrict access by PSK and MAC?

Re: Public vs private IP

Re: Block a client from specific ssid

Re: Users getting gateways IP as 10.128.128.128

Re: Users getting gateways IP as 10.128.128.128

Re: how does meraki (MX84)raise alerts when either of wan port internet con...

Re: Configuring virtual ip addresses on MX HA warm spare

Re: Offline Warm Spare Resets Network?

Re: MS Switches Enterprise vs Advanced license

Re: Advanced Security license for MXs query.

Re: Tracking down devices that are failing Radius authentication

Re: Meraki MX USB Modem Compatibility

Re: Public vs private IP

Re: Block a client from specific ssid

Re: how does meraki (MX84)raise alerts when either of wan port internet con...

Re: Tracking down devices that are failing Radius authentication

Re: Block a client from specific ssid

Re: Users getting gateways IP as 10.128.128.128

Re: Restrict access by PSK and MAC?

Re: how does meraki (MX84)raise alerts when either of wan port internet con...