Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Stoerfaktor
Community Record
7
Posts
0
Kudos
0
Solutions
Badges
Jul 1 2022
3:57 AM
Why are you routing the MX traffic through the switch? Do you have any need to access the switch directly from the internet? I would have tried to switch the traffic through your MS instead of routing it. That would also save you some public ip addresses, and you are managing the switch over a connection to the internal core anyway.
... View more
Jul 1 2022
3:46 AM
I have 2 MR33s running in my lab and one iPhone SE3 for almost 2 months now and there are zero issues with connectivity. I am running MR28.6. What is the issue with the firmware upgrade? Can't it be done at night when it won't disturb anyone? I would heavily recommend to upgrade to MR28.6.1 and see if the issue resolves itself.
... View more
Jul 1 2022
3:34 AM
Hi NesAlba, thanks for your answer. Unfortunately Port Management Privileges are defined per network, and therefor can only be assigned per network and user. They cannot be set on tags. Also, the tags from the switchport are not the same tags you can set rights on in the UpdateOrganizationAdmin, those would be the tags from the network.
... View more
Jun 30 2022
1:37 PM
Hi all, I try to update the port management privileges of several users over roughly 200 networks. While I can update the admin with network rights, the api does not accept when I try to update the port management privileges. It seems to me that it cannot be done right now, but perhaps someone here has some more info? What works: dashboard.organizations.updateOrganizationAdmin( org_id, admin_id, networks=[{'id': net, 'access': "read-only"}] What does not work: dashboard.organizations.updateOrganizationAdmin( org_id, admin_id, networks=[{'id': net, 'access': "switchport", 'privilegeName': 'CustomerAdmin'}] It gives me an error that the access must be "full, read-only, guest-ambassador or monitor-only". However, when I do a getOrganizationAdmin, this is what I get: {'id': '*snip*', 'name': 'some name', 'email': 'some_email@domain.com', 'authenticationMethod': 'Email', 'orgAccess': 'read-only', 'accountStatus': 'ok', 'twoFactorAuthEnabled': False, 'hasApiKey': True, 'lastActive': '2022-06-30T11:23:36Z', 'networks': [{'id': 'some_id', 'access': 'switchport', 'privilegeName': 'CustomerAdmin'}, So it seems I can read out port management privileges, but cannot update them. Does anyone know a way around this?
... View more
Sep 7 2020
12:22 AM
@ww wrote: You advertise the default route at mx400 into vpn? Try uncheck default route at the spoke config We tried to advertise the static default route as well (which should not be necessary), but it did not make any difference.
... View more
Sep 7 2020
12:21 AM
@jdsilva @cmr You cannot put a default route with a next hop reached via a LAN port. That will break the MX completely as it interferes with the WAN port reaching the cloud. If the WAN port can't reach the cloud then the MX doesn't forward traffic. It will also interfere with AutoVPN and establishing tunnels. You can install a default route towards LAN, and AutoVPN will work fine. Also, cloud reachability is afaik not influenced by static routes. I assume there is an internal routing for the cloud ranges that overrides anything you configure in the dashboard. I tried to static route the ranges of the meraki cloud towards LAN in the lab, and the MX happily ignores them and sends the traffic out over WAN. 🙂 @PhilipDAth If you do a packet capture on the MX400 LAN, do you see the traffic arriving from the spokes? If so - the issue is upstream (check they have routes for your spokes, firewall rules allow it, etc). If not, you have an issue on the Meraki side. The packet capture shows the packets arriving on the MX400 and leaving on the LAN port, but we never get a reply back. As soon as I enter a static route for a prefix, that prefix suddenly seems to work. However, I have not been able yet to run packet captures with that to verify that the replies actualy come back over LAN. Perhaps we have some asymmetric routing going on and haven't noticed it yet. I will follow up on this as soon as I get hold of the customer for some tests.
... View more
Sep 3 2020
8:51 AM
For a customer we have build a Hub&Spoke VPN, but the customer has to use the internet access of the parent company. Therefore we installed a static default route on the hub (MX400) towards to the customer. However, it seems that default route does not work, as all the spokes are unable to reach sites in the internet. For testing purposes and as a workaround, we have started to add a bunch of static routes for destinations in the internet on the MX400, and those destinations can be reached by the spokes. It seems it is only the default route that is not working. And yes, I checked that the spokes are using the default route to the hub 🙂 Does anyone else have experience with this? Is it not possible to use a default route towards LAN?
... View more
© 2024 Cisco Systems, Inc.
