Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Become a member of the Cisco Meraki Community today
Get answers from our community of experts in record time.
Join nowAbout dalmiroy2k
dalmiroy2k
Getting noticed
Member since Mar 6, 2019
Jun 7 2024
Dalmiro Couto
Buenos Aires, Argentina
Community Record
40
Posts
19
Kudos
1
Solution
Badges
Dec 19 2019
9:09 AM
Great point BrechtSchamp. /24 subnets were allowed during initial setup but I should setup the servers addresses only.
... View more
Dec 19 2019
7:18 AM
Hi guys, I currently running a Hub-and-spoke topology and I only need remote endpoints to reach both a local DNS and an HTTPS internal web page in the HQ subnet. So far I have enabled those subnets and ports and a implicit deny all at the bottom (on top of the implicit allow all). My objective is reduce malware propagation and threats originated internally through the VPN (Ports scans, DDoS). Both Endpoints and HQ have Advanced licence with IDS set @ Prevention / Security I was wondering what are you Site-to-site outbound firewall best practices? Any other tip to control and secure VPN usage? Thanks!
... View more
Jul 19 2019
11:57 AM
1 Kudo
If you have an MX, go to Security & SD-WAN | Firewall | Layer 7 firewall
... View more
Jul 11 2019
5:14 AM
2 Kudos
Go to the port settings in Switch | Switch Ports and disable both RSTP and STP guard.
... View more
Jul 2 2019
12:30 PM
You can use Active Directory validation or, if you have system manager licences, Systems Manager Sentry VPN security validation. https://n129.meraki.com/manage/support?search_term=4057
... View more
Jul 2 2019
11:56 AM
1 Kudo
The hostname xxxxx-yyyy.dynamic-m.com works like a free dynamic DNS included with your MX appliance. it should be pingeable from internet. Event log should give you more information of what it went wrong with the VPN session. You should test the VPN client session with your admin account. Configure the L2TP session in your smartphone with your admin account and check everything is working fine. If by any chance you have System Manager licences and a combined network, you can automatically push VPN profiles to your enrolled devices. it works great.
... View more
Jun 28 2019
5:44 AM
You will have better luck using an external Ethernet 4G/5G modem via WAN 2 (supports both load-balancing and failover) or a USB Dongle for cellular backup. I know Huawei and ZTE are somehow banned or disliked in the US, but here in latin america they can't be beated in both cost and complete LTE band support. I'm currently using a Huawei E3276 as cellular backup for my MX64.
... View more
Jun 25 2019
5:35 AM
Yeah, I agree. I would love a future option to completely disable 2.4 GHz radio propagation (even scanning). It's a waste of power in my case.
... View more
Jun 24 2019
12:35 PM
3 Kudos
I have a new avatar!
... View more
Jun 24 2019
12:15 PM
I have the same question. While SSID broadcast is disabled on 2.4 GHZ, the radio is still on and I can't find a way to completely disable 2.4ghz band.
... View more
Jun 10 2019
11:55 AM
I would add capped max uplink bandwidth. Example: MX64 can only process up to 250 Mb WAN. Cisco ISR 4000 series suffer the same fate, unless you use the Boost Licence which unlock the limitations.
... View more
May 30 2019
8:45 AM
_ Checkout Air Marshall settings. Allow rogue AP for the test. Make sure your iphone client is actually connecting to your MR33 and not other vendor AP with the same SSID down your network. _ Disable 802.11R and 802.11W. _ Switch from Dual band operation with Band Steering to Dual band operation (2.4 GHz and 5 GHz). _ Consider creating a dedicated SSID for iphone and other problematic clients. After this changes: Erase the stored WIFI session in your test iphone and scan the SSID again. Store the credentials.
... View more
May 27 2019
6:28 AM
Also, keep in mind that if you buy a 10 GbE SFP+ Fiber Transceiver, you also have to use a 10Gb SFP+ transceiver in the other endpoint you are connecting to. You can't downconvert the 10Gb SFP+ to 1 Gb speed in your MX 250.
... View more
May 20 2019
8:44 AM
If your xDSL modem is configured in router mode, so it dials the PPPoE connection and has a DCHP server with NAT, connecting it to a MR33 (With Power Supply) will work and it will reach the Meraki Cloud. Most ADSL modems are set up this way by ISPs.
... View more
Apr 26 2019
6:02 AM
Hi, I was wondering if you have experienced adding a third-party WiFi Access Point to your Meraki network to extend WIFI coverage. If so, tell me your experience. Current Setup: MX64+MR33+Archer C7 So far, MX64 manages the network as it act as a security appliance, Wan uplink, DCHP server for both MR33 and Archer C7 in Access Point mode (No routing). Things to consider: _ Go to Air Marshall and enable "Allow clients to connect to rogue SSIDs by default". Add your SSIDs to the whitelist. _ Your Third-party AP should have an static IP, So it's easy to manage. _ Client discovery via Mac Address for your non-meraki portion of the network works great, in most cases. _ Bw and firewall Policies are working fine for any client (both meraki and Archer). Things to try: I wonder if roaming works seamlessly if I use the same SSID in both MR33 and Archer C7.
... View more
Apr 23 2019
5:19 PM
It's only useful if you manage a large campus or enterprise and have dozens of units deployed. Same with the blinking leds option.
... View more
Apr 22 2019
1:56 PM
2 Kudos
If some of the APs in your network are third-party (Non Meraki) that may be the problem. Go to Wireless --> Air Marshall and check the following: "Allow clients to connect to rogue SSIDs by default" is selected Check the Rogue SSIDs tab, it may have banned some of your Non-Meraki Mac address or SSIDs.
... View more
Apr 15 2019
12:22 PM
Given that you need at least two subnets: One for your LAN and one for Client VPN, I tried to create Vlans. Sadly, I wasn't able to create a VLAN for the client VPN subnet so it can route through the LAN subnet.
... View more
Apr 3 2019
5:48 AM
HUAWEI E8372 USB stick works great with MX64 and most APs, even Z3. I mostly use it a cellular backup. Private APN configuration is made on the modem itself and connectivity should be tested on a PC before deploying on the MX.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 7041 | Jul 11 2019 5:14 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 3 | 46696 | |
| 2 | 7041 | |
| 2 | 28916 | |
| 1 | 3849 | |
| 1 | 12577 |
© 2025 Cisco Systems, Inc.
