Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About martin-netx
martin-netx
Getting noticed
Member since Sep 14, 2017
12-15-2022
Community Record
34
Posts
22
Kudos
0
Solutions
Badges
12-15-2022
09:39 AM
The latest I've heard from Meraki Tac is that 17.10.2 does contain a fix for the Snort performance issue. However, there is a significant caveat, they say IDS needs to be set to the "Connectivity" ruleset. We've only done some initial tests so far and it's a bit inconclusive as yet. Strictly speaking, this should bring the MX100 back in to line with the performance figures quoted on the sizing guide. I'll update once we have more testing done...
... View more
11-29-2022
01:11 AM
As far as I'm aware 17.10.2 does contain a fix for the IPS/IDS performance issue but I'd be more than happy to be proven wrong. I'm awaiting an update from Meraki TAC as and when the fixed is brought out.
... View more
09-27-2022
02:06 AM
Hi dgander, We've not tried 17.10 on an MX100/SNORT yet but Meraki TAC tell me that 17.10 does not contain the fix for this particular performance issue. I'm told they are still working on producing the fix.
... View more
09-07-2022
04:47 AM
1 Kudo
Thanks eyre-jr, Yes the hash looks the same. Security centre reports the threat as: W32.D73298C7C8-69.SBX.VIOC
... View more
09-07-2022
04:34 AM
9 Kudos
Is anyone else seeing quite a lot of alerts relating to a file that's been identified as malicious in retrospect at the moment? The file looks to have come down from cdn.office.net Thanks
... View more
08-24-2022
01:22 AM
Sorry, everyone, I accidentally hit "accept solution" when I was just meaning to hit reply! Just to be clear, I don't have a solution for MX100 as yet. Unfortunately I can't seem to spot a way to un-accept a solution that I've accidently marked as accepted...
... View more
08-24-2022
01:17 AM
Hi Rob2041, Meraki TAC tell me that the MX running v17 and Snort v2 still has the Snort vulnerability. They also tell me that the performance issue is now sorted for MX250/450 in v17 and they are continuing to work on a fix for other MX models running newer firmware than v15.
... View more
08-19-2022
12:59 AM
Hi Rob2041, that's very interesting to hear. I was unaware that a version 17 variant could be run with Snort on V2. Do you know if the snort vulnerability in V2 has been addressed in this particular scenario?
... View more
08-15-2022
01:28 AM
I see that if we follow the link to the rule details in Snort this rule now shows as "deleted". I guess this means we can switch off the whitelisting of this rule if it has actually been deleted?
... View more
08-10-2022
07:56 AM
We've now got multiple MXs with IDS set to prevention and the whitelisting of Rule ID1-60381. All looks to be working OK now.
... View more
08-10-2022
06:14 AM
1 Kudo
Hi JessIT1, I'm just waiting to hear if the IDS allow has worked for actual users...
... View more
08-10-2022
05:59 AM
2 Kudos
Just off the phone with Meraki TAC, engineer was very helpful. They have just now added an IPS rule called OS-Microsoft Windows IIS denial-of-service attempt 1:60381. We should be able to allow this rule if we wish as a form of workaround for the moment. Seems that it is a Microsoft update related issue but I'm not too clear on it yet.
... View more
08-10-2022
05:47 AM
We are also seeing lots of "Microsoft Windows IIS denial-of-service attempt" occurances on multiple MXs. Appears to impact on google drive too if using the app as opposed to browser.
... View more
08-03-2022
12:54 AM
2 Kudos
That's intereasting dgander. For us it looks like it's related to Snort v3. When running versions 16 or 17, performance seems OK as long as IDS is switched off. As soon as IDS is enabled again the throughput drops by about half. We tried 16.16.4 most recently but still had the same issue.
... View more
07-29-2022
01:14 AM
Thanks ww, yeah, we thought about twinax as a possibility. Copper/RJ45 is going to be easier given the physical ports on the server and distance.
... View more
07-29-2022
01:11 AM
Thanks very much for the kind offer of trying an fs.com transceiver. I'll be very intereasted to hear how you get on.
... View more
07-28-2022
08:41 AM
We are looking at the possibility of connecting some servers to an MS250 usping the 10GB SFP+ ports on the MS250. It does not look like Meraki offers a 10GB Copper SFP+ module. Has anyone done this sucsessfully with a third party module? Thanks.
... View more
Labels:
- Labels:
-
Interfaces
07-21-2022
12:46 AM
Meraki TAC have told me that it's a recognised issue and they are working on a fix. I'll update this thread as and when I get more news.
... View more
05-16-2022
02:19 AM
@Armelin, thanks, would have been happy to stay on 15.44 if it did not have the SNORT vulnerability.
... View more
05-16-2022
02:04 AM
2 Kudos
@cmr Thanks for the heads up on 17.7. We upgraded the MX100 to 17.7 over the weekend but throughput still comes out about half of what we had on 15.44.
... View more
05-12-2022
02:51 AM
1 Kudo
I'm wondering if anyone else has had performance issues on the MX100 once upgraded to 16.6 or 17.6. We've got an MX100 that runs great on 15.44 but plain internet throughput seems to drop by about half on version 16.6 or 17.6. We need to upgrade from 15.44 due to SNORT vulnerability. This MX100 has content filtering and AMP and IDS enabled. We've rolled back to 15.44 from 16.6 and 17.6 a few times now and performance always returns to normal. Thanks
... View more
05-04-2022
04:25 AM
1 Kudo
Hi JWill, did you ever get anywhere with this? We've got the same requirement too. Thanks.
... View more
01-12-2021
06:55 AM
1 Kudo
Thanks LandrinLong, Yeah those model numbers correspond with what I've heard. Shame about the MX84 and MX100 in particular.
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 9 | 7860 | |
| 2 | 16717 | |
| 2 | 2986 | |
| 2 | 3307 | |
| 2 | 12060 |
