Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About kordm
About kordm
kordm
Getting noticed
Member since Dec 17, 2018
May 11 2020
Community Record
32
Posts
4
Kudos
2
Solutions
Badges
Nov 8 2019
7:14 AM
We're transitioning our main office to a new VoIP solution (feel free to welcome us to the 21st century) and we have a bit of an issue with our failover link. We have a backup DSL link but it's really only capable of about 5 Mb/s (we're somewhat rural) and can't handle the WAN traffic of ~300 clients. Is it possible to configure traffic shaping in a way that allows only the Voice VLAN to access the WAN 2 and cellular uplinks when the primary link goes down? EDIT: Our gateway is a Meraki MX84. I understand we'd need a more esoteric SD-WAN solution to allow seamless failover without dropped calls, I haven't really explored that option yet.
... View more
Nov 8 2019
6:58 AM
Where does your internal DNS server forward requests? It doesn't matter if clients are querying an internal DNS server if it is not authoritative for that zone, it will still forward the DNS lookup once the TTL of the A record expires.
... View more
Nov 7 2019
5:44 AM
2 Kudos
The MX DNS is a forwarder. If you point clients to use the MX as the internal DNS, it'll forward those requests to the DNS you have set on your WAN interface, unless you specify something else in the DHCP configuration. Do you have a separate DNS server? Where is that server configured to forward DNS requests? If they all go to the telco DNS and if they're having an issue, connections will drop once the TTL of the domain name expires. For example, office365.com has a TTL of 5 minutes.
... View more
Nov 6 2019
1:40 PM
Are you trying to test the connection from outside the network or inside the LAN?
... View more
Nov 6 2019
1:38 PM
Yeah, it takes some configuration to get the clients to connect. I have my MX84 tied to a RADIUS server for client auth. It works great once the clients are configured correctly. I haven't tried connecting iOS or Android devices, but for Win 10 devices you need to go into the settings for the VPN adapter and set a few options in the Security tab. - L2TP/IPSec w/ pre-shared key - Require encryption, disconnect if declined - Allow these protocols: --Unencryped password -- CHAP v2
... View more
Nov 6 2019
1:34 PM
Is the MX400 routing traffic between the subnets or is there a hop to another router? If so, is that other router (or APs, for example) using NAT for those clients? Sounds like the traffic for those networks isn't actually passing through the MX400.
... View more
Nov 6 2019
1:30 PM
I had an issue before where my MX84 was passing CDP/LLDP packets from the switches across VLANs and causing "VLAN mismatch" errors. It caused my switches to shut down those ports because they thought they were connecting to themselves. The only way I could solve it was setting those uplink ports as VLAN trunks.
... View more
Nov 6 2019
1:17 PM
Do you have L3 switching enabled? Do a packet capture on your trunk port on the MX84 which is connected to the core switch. When you try to ping across the VLANs, is any traffic reaching the MX84? As a last resort, can you assign two ports on the MX84 as access ports to different VLANs and try pinging between them? I'm guessing there's a routing or ACL issue somewhere in your switch stack.
... View more
Aug 16 2019
7:37 AM
@Slate wrote: I tried a 1Gb RJ45 Cisco compatible from FS.com. It would link, then go off... then link, and go off, and keep this cycle. I talked to Meraki and they said a genuine Cisco module would work... But I have doubt. I am hoping to find one, and test before I go buy a 250 ish dollar module. Its my plan.. we'll see. That sounds fishy. An unsupported SFP just wouldn't work at all IME, though I've actually never had an issue with that in any routers or switches. I only run into that issue with NICs and stacking ports that only support direct-attach cables.
... View more
May 10 2019
1:00 PM
I find it a lot easier to keep track of VLANs when you think of them as "tagged" or "untagged". "Access" and "trunk" don't really mean anything for the VLANs themselves, only how the switch port allows traffic. It took a bit to wrap my head around VLAN assignments to Brocade switches after working with strictly Cisco iOS but now I can't think of it any other way.
... View more
May 10 2019
12:51 PM
Is one of the VPN endpoints behind a NAT? You might need to configure your gateway/router in bridge mode to bypass NAT before it gets to your MX. Are there any known issues for the internet connection at either end? I have a lot of VPN drops at one of my sites, but that internet connection is wireless and not reliable.
... View more
May 10 2019
12:44 PM
That's a recommendation based on hardware capabilities of the router to support client traffic, however they're attached. I have an MX64W that sometimes has up to 80 devices connected (wired + wireless) without any issues but that's only when there's events or meetings happening at that location. If you require more capacity you'll probably need to step up to an MX84. If you're wondering about WiFi client capacity, that's based on a different set of factors. As a general rule I try not to have more than 20 clients on a single access point (and no more than 10m away), but you can get away with more clients depending on the wireless technology, the frequency, and the number of radios.
... View more
Mar 26 2019
7:12 AM
That's perfect. The phones are physical, I can just restrict the voice VLAN to 4G.
... View more
Mar 26 2019
6:51 AM
I'd use a media converter like a TP-Link MC220L, or a spare L2 switch if you have one lying around. Most ISPs hand off internet traffic on a tagged VLAN. If that's the case, correct me if I'm wrong here, to do the "patch cable hack" on your MX84, you would need to make the SFP port a tagged access port to that VLAN, then assign one of the BaseT ports as an untagged access port to pass traffic to the WAN port without a VLAN ID conflict. It's messy, and IME may possibly result in some strange errors with CDP/LLDP.
... View more
Mar 26 2019
6:31 AM
Hi all, I have a remote office with poor wireless WAN connectivity. I want to move that office to a VoIP system via Cisco Spark but I'm wary about reliability. I'm hoping to use a USB 4G modem as a backup so that office can still use their phones, but because the main connection is so shady, I don't want regular internet traffic consuming our allotted data unnecessarily. Is there a way to restrict the MX64W to Spark traffic only when it has failed over to the 4G modem? I haven't done any research on Spark's firewall requirements but I don't see any per-connection restriction rules aside from global traffic shaping. Any advice would be very much appreciated.
... View more
Jan 23 2019
5:55 AM
For situations like this, where a vendor needs remote access to their equipment, we would typically require that they have their own internet connection and firewall. If that isn't possible or feasible, we would isolate all of their equipment in a separate zone from ours and create firewall rules to allow communication between zones as needed. Other times we would piggy-back onto a client network but we always had an isolated L2 VLAN. YMMV but I think as it stands, you're kind of stuck without rearranging the network.
... View more
Jan 22 2019
7:04 AM
Ah, okay. I use Teamviewer in my org, but I control access via Teamviewer itself. All of my clients have Teamviewer Host which is assigned to a management group with easy access. I just make sure all of the management accounts have 2FA. For sensitive devices, I restrict access specific hosts in Teamviewer settings. Otherwise, I think a more elegant solution would be to set Teamviewer to allow only LAN connections, and use a site-to-site VPN. I'd imagine you have a LOT of remote sites however.
... View more
Jan 22 2019
5:49 AM
You're trying to restrict Teamviewer to access only a single device on the LAN? Or from LAN to WAN? Teamviewer connects on port 5938, but also tunnels via ports 80 & 443. IIRC it is tricky to block Teamviewer without blocking internet access to those clients, I'm curious how others do it. What is the problem you're trying to solve?
... View more
Jan 11 2019
8:20 AM
I have found AMP to be flagging some antivirus (ESET, BitDefender) updates and Android service updates as "Win.Trojan.Batlopma". I've found that I sometimes need to temporarily disable AMP to get these updates to work. I hear MX 14.x solves some issues with AMP, but I'll have to wait until that comes into the stable stream.
... View more
Jan 9 2019
12:23 PM
1 Kudo
I don't think so. I'd be wary of downloading from random "cleanup" links. Install an ad blocker for affected users. The events go away.
... View more
Jan 9 2019
11:15 AM
1 Kudo
I've been tracking this for the past few months. My research hasn't come up with anything specific. Scans with ESET and MalwareBytes on reported devices hasn't come up with anything. I've seen it come up on fresh installs of Win 10 1809 as well. My best guess is that it's a regular ad tracker, possibly used by Amazon or just hosted on AWS.
... View more
Jan 9 2019
10:14 AM
We use ESET in our org, and updates are being blocked by AMP, however it is not generating events in the Security Center nor is it showing as filtered content in the Network Wide Event Log. Disabling AMP temporarily allows ESET to update successfully. Is there a way to see exactly what AMP is blocking, so I can whitelist the false positives? I saw one event in the Security Center where communication with one of the ESET subdomains had flagged the download as "User-Agent known malicious user-agent string - Win.Trojan.Batlopma". I've added "eset.com" to the whitelisted URLs under AMP in the Threat Protection window, but that didn't do anything. ESET uses a hundred or so subdomains to deliver updates ... do I need to add ALL of those subdomains to the whitelist? I'm having the same issue with AMP blocking updates to Google services on wireless devices ... whitelisting "1e100.net" had no effect. Neither did "*.1e100.net" How can I identify and allow false-positives without disabling AMP?
... View more
Dec 18 2018
9:04 AM
@Jeff-US wrote: Any chance the APs couldn't connect up to the cloud to be updated so they never received your firewall rules? I'm not completely ruling that out, but the MRs were getting updates otherwise. Updates to SSIDs and VLAN assignments were working correctly, though I did need to reboot 2 of them to get the NAT DHCP working after I reverted the changes. @MacuserJim wrote: Have you tried adding the deny rules to the layer 3 firewall rules on the MX appliance to see if that makes any difference?fdfd Tried that, they had no effect. I tried to do a quick packet capture to check the source addresses, but it didn't record any ICMP packets. I didn't have time to investigate further and had to revert back to NAT.
... View more
Dec 18 2018
8:36 AM
Thanks Jeff. I was thinking the same thing at first, but as per the documentation: Meraki MR Documentation The 'Deny Local LAN' function located under Configure > Firewall & traffic shaping blocks access from Wireless clients on specific SSIDs to the Local LAN. For the purposes of this firewall rule, Local LAN is described as any destinations in the following private address spaces: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 It also goes on to say that DNS and DHCP traffic are exempt automatically. What you're describing I believe is the Layer 2 LAN Isolation feature. Regardless, I tried setting explicit deny rules to those subnets and they had no effect. I still believe this was a switching issue, so I'll have to try again with a test network after hours.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 14299 | Mar 26 2019 6:51 AM | |
| 13944 | Jan 23 2019 5:55 AM |
My Top Kudoed Posts
© 2024 Cisco Systems, Inc.
