About SoCalRacer

SoCalRacer

Since Windows 7 is end of life (EOL) I assume you won't have to worry about new updates to Windows 7. There is blocking within the OS if needed, but thats not a Meraki control/feature

SoCalRacer

Might take a packet capture focusing on the host device to see whats going on during registration, could be a bunch of possibilities.

SoCalRacer

Not sure exactly how you are using this, but usually your can schedule a WOL from a server or from the endpoint via Powershell or something you are comfortable with.

SoCalRacer

I am going to venture to say this has never worked. Also that the pfsense side is not configured correctly. /32 is host and not a network, so if they have /32 in the subnet tunnel that is a major issue. Also if you can share the config possibly I could see the exact issue.

SoCalRacer

Trusted Access might be more suited if you are Apple Only https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Trusted_Access_for_Secure_Wireless_Connectivity

SoCalRacer

Disable IDS or turn it down Security & SD-WAN > Configure > Threat protection

SoCalRacer

My understanding was that it was a unique session. So the same device could connect multiple times over a week and that would create multiple sessions on the report. @PhilipDAth might be able to confirm further?

SoCalRacer

How many VPN users do you have? Are they all in one Meraki network? How many different groups of access do you need?

SoCalRacer

The way SCEP is supposed to work with Meraki is that you download the cert from the dashboard and then you sign it with your CA, then reupload it to the dashboard. Is that the process you are using?

SoCalRacer

Have you read through these docs? https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Settings#OSPF_route_advertisement https://documentation.meraki.com/MX/Site-to-site_VPN/Using_OSPF_to_Advertise_Remote_VPN_Subnets

SoCalRacer

When Android and Windows are available I would test. Sure seems like Apple fans with the dev team

SoCalRacer

I haven't specifically done this, but I would use group policies. You can use L3 rules to limit the VLANs possible to access. Depending on how many VPN users/networks/groups of access you need this could get time consuming. After you have configured the group policies for the different type of groups access then you need to apply it to each VPN user individually.

SoCalRacer

As @BrechtSchamp asked if the MX is in passthrough will help determine the issue. Below you can check that setting. Security & SD-WAN > Configure > Addressing & VLANs > Deployment Mode - Will be Routed or Passthrough

SoCalRacer

@Colm wrote: What is MLSA? The model sounds appealing. Not 100% but I think he meant Managed SLA (Service Level Agreement) 🤷‍ ♂️

SoCalRacer

Are you and all the devices you are trying to ssh from and to behind the MX (local traffic)? Same VLAN?

SoCalRacer

I don't believe it is possible with SM. I do believe you can use many of the third-party apps that will allow remote view, but not control.

SoCalRacer

If ultimately all your DNS requests from different locations are going to AWS AD then I would go there and see if you experience the same issues on the AD server if possible. Possibly it is an issue with how your sites are connected to AWS AD or that it is internal to AWS AD.

SoCalRacer

I can confirm the UI change on node 174. Haven't seen info on the splash data.

SoCalRacer

Can you point me to where you have read that it has to use Meraki's NTP? Anything with DHCP you should be able to point to your internal NTP. This doc doesn't list a Meraki IP, just any destination with port 123 UDP traffic, so I am a bit confused. https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity

SoCalRacer

You might try disabling CarbonBlack and its extension or try on a machine without it installed.

SoCalRacer

Any endpoint protection or managed DNS solution that could contribute to the issue?

SoCalRacer

Z3 yes, not Z3C

SoCalRacer

The API may work here, but something to consider. The API changes and in all honesty breaks certain times. My trust level with that in this situation would be kind of low. You are looking for more of a set it and forget it solution. In that case I would use the logoff url from the whitepaper to test. Then in a windows logoff script have it visit that page or on a scheduled interval (60mins)

SoCalRacer

Is it me or is the cost calculator tool missing Z3C? https://meraki.cisco.com/buy/cost-calculator#appliances @CameronMoody - you might need to take a look

SoCalRacer

You can't combine and route all traffic out a virtual WAN (2 Physical WANs). You could have both of them active. Send certain traffic out one WAN and other traffic out the other. You would have no redundancy, but depends on the needs. Sometimes you see this with VOIP out WAN2 and Everything else out WAN1 https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences

SoCalRacer

Community Record

Badges