Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Stealth_Network
Stealth_Network
Getting noticed
Member since Sep 19, 2017
Wednesday
Community Record
75
Posts
41
Kudos
1
Solution
Badges
Nov 19 2019
11:51 AM
No problem, the packet capture did not give us any results. It was iteration after iteration to find that it was thinking Encrypted P2P was being used (Falsely). The biggest challenge was Meraki claiming they are not blocking anything. I had to demonstrate they were. A log of the block would have helped.
... View more
Nov 19 2019
11:46 AM
I work on ASA's and FTD's daily...
... View more
Nov 19 2019
9:59 AM
Good point, I will test, but I think if you block specific things like P2P you should be able to log them locally.
... View more
Nov 19 2019
9:47 AM
1 Kudo
So had a really tough issue to figure out, when a client doing SQL queries from Branch to Hub. THe issue was the first authentication failed, but then the DB would hold creds in it and it would work afterward. Had this at all branches to 2 SQL servers in the hub. Meraki said nothing is being logged so it's not them, but if I whilelisted the client it worked. I create a custom policy to try to figure out where is was being block, when I just added in an any any rule (and using all the other MX defaults) it worked. Then I took out the P2P rule and country blocks from the MX and it worked. I then added back the country blocks and it still worked. When I added back the P2P it failed. So now I had the problem. In speaking with support my questions were why isn't this block in the logs, and what ports/protocols are the P2P blocks using. Answers - Layer 7 blocks are not logged and we don't know the ports/protocols P2P uses as we just get the feeds. My other questions is when I created the Policy I only allowed the firewall features permit any any so the layer 7 rules still should have kicked in and blocked P2P, but they didn't . So now I think there are some bugs going on here, but why not log any blocks?
... View more
Nov 13 2019
9:38 AM
I know this is challenge on the enterprise side, but we would like to own and manage all the gear. I assume I can add subscriptions to each customer as long as the end customer is identified, but use our emails for all notifications and subscriptions? As well, it would be nice if the app was multi-customer not just having an email for each. (I've already submitted the wish). Any idea when this will be available in Canada?
... View more
Nov 13 2019
8:38 AM
Put me on the list as well. Still trying to figure out if this is going to kill one of our service offerings; can they buy cheaper from Amazon than a partner?
... View more
Sep 25 2019
2:19 PM
OK everything I said won't work 🙂 This requires a little more thought, I assume you are using the static (while next hop responds to ping) for the MetroNet, (but not having it on any VPN's) are you also advertising the Hub LAN subnets over VPN's on the backup link? I have had issue before thinking traditionally with Meraki gear like having a high cost static if dynamic routing fails; it works just the opposite. Without "cost" on static routing this becomes difficult, do you have dynamic routing behind the MX? I don't think you can achieve all you want to; you can have the internal networks work the way you wish ( go to hub, then fail to vpn), but if the next hop is up but the path is down the VPN will never kick in (blackhole) The other issue is ALL traffic, you can't really advertise the default routing in multiple scenarios; over the static route, then over the VPN efficiently, you still have a blackhole possibility. Is VPN'ing over the Metro network an option? Both ports in WAN 1 and 2 gives you the most options
... View more
Sep 25 2019
1:32 PM
I may have gotten it wrong, you are NOT using VPN over the Metro Links? In re-reading I did get it wrong. You are using the LAN port for your Metro link not WAN 1 and 2, so I assume no VPN. That changes everything...
... View more
Sep 25 2019
1:24 PM
Yes but he wants ALL traffic to go to the central hub (0.0.0.0), no split tunneling, and only fail to backup link in the event primary is down (as far as I understood it)
... View more
Sep 25 2019
1:22 PM
On the S2S page for the Branch you will see an Exit Hub there (in Mesh) select your Egress Hub. Then setup SD-WAN with your VPN ISP connection as the primary, it should fail to secondary if primary goes down. I haven't tried this exact config, but the Exit Hub has saved me with a few weird ISP issues
... View more
Sep 25 2019
1:15 PM
1 Kudo
I have both hybrid environments (both) and full swap out. As stated costs are only one factor. From the technical side you need to fully understand what you need as Meraki does have limitations over traditional Cisco gear. Sometimes you don't come across them until after the fact 😉 It really depends on what features you need.
... View more
Sep 25 2019
1:06 PM
Interesting question, I would assume you could use the main hub as the Exit Hub for all branches, and setup SD-WAN at the branches to egress locally if the VPN goes down on the main tunnel. Worth a trial
... View more
Aug 7 2019
7:21 AM
Hi, You shouldn't need routes setup on the vMX, as you should see them advertised over the VPN from the MX. If you take them off do you see them advertised? As suggested packet captures will help troubleshoot Good luck
... View more
Jul 30 2019
5:47 PM
Awesome! Glad I could help, this was a super hard problem to troubleshoot (for me), so I am glad the ISP took responsibility (they usually don’t) 😄
... View more
Jul 30 2019
10:01 AM
2 Kudos
I have had a similar issue where the traffic actually was changed on the path between sites. One of the many ISP's had an issue on a US to CDN handoff. I found MTR was really helpful in troubleshooting showing where traffic was dropping. We ended up using another tunnel as the exit point to bypass the poor path until it got fixed. Good luck
... View more
Jul 30 2019
9:55 AM
Our rep got a hold of me regarding this, and it's the first he's heard of it. They are working on coming up with a solution to make the customer happy so we'll see. Does anyone know if the 250's have this issue?
... View more
Jul 29 2019
8:33 AM
Just spun up an 84 in my office, no noise whatsoever... I've let the client know they can downgrade (and lose bandwidth) or we can look at a Firepower 1120, but I have no idea if it has the same loud fan issue, plus they would lose all the simplification of the current Meraki environment. We prefer to stick with Cisco products
... View more
Jul 29 2019
7:53 AM
It is in their data closet, but can be heard from 15 feet away. This is not a DC and to say putting it in a DC fixes the issue in not a helpful response. They need to 100 due to the bandwidth requirements. We have never had this issue with any lower model
... View more
Jul 29 2019
7:41 AM
To follow up my post, customer took a video and we opened a case, they RMA'd the MX100 and the new one is just as loud as the old one. The response from support: It looks like this is an expected behavior then for MX100. The customer is pissed, now asking to send the box back and go with another vendor...
... View more
Jul 12 2019
9:10 AM
1 Kudo
Just got the same complaint from a client that just installed one...
... View more
Jun 24 2019
12:38 PM
2 Kudos
I have a new avatar!
... View more
Dec 15 2017
3:49 PM
That's really helpful - thanks
... View more
Dec 15 2017
2:36 PM
I may be missing something 🙂 We do use templates but I did not know that these are always in sync across the networks they are applied to (we don't modify the templates after initial network build). The other point was a lot of networks were setup without templates so I guess I could apply a template to them all with the changes. I guess I need to understand if individual sites configurations get trumped by the template. I'll do more reading - thanks
... View more
Dec 15 2017
2:25 PM
I would like a feature request - the ability to apply content filters, URL filters and Firewall rules across the whole org. Let's say you have a customer with 100 networks and you want to block a county; rather than doing it 100 times, can there be a way to apply this across all networks - or have this feature at the Org level. Same holds true for firewall rules, whitelists, blacklist and applications, and others that you would normally apply across a corporation I'm dreading having to block certain things across so many networks Thanks in advance
... View more
- « Previous
-
- 1
- 2
- Next »
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 8759 | Jul 30 2019 10:01 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 4684 | |
| 3 | 1854 | |
| 3 | 4557 | |
| 2 | 8759 | |
| 2 | 42163 |
© 2024 Cisco Systems, Inc.
