Meraki

SoCalRacer · ‎Jul 15 2019

I think you might have a couple options. 1) Block streaming media. Then start whitelisting the known good services you want to allow. 2) Start doing to research/packet captures on the data. Find out what port it is using or maybe it used a common CDN everyday even thought the domain in changing. Then block that URL. 3) If you have a small subset of users doing this, then you might create an alert or rule to block all internet after using 1GB of data on that service. Then coach the user or forward to their manager.

SoCalRacer · ‎Jul 12 2019

If the splash page is hosted on a outside server there might be an issue with DNS. Usually the way Android will work is ping the gstatic page before going there. Also you may want to wait a min to get the sign in now notification on the phone.

SoCalRacer · ‎Jul 12 2019

415-937-6671 is working for me Also opening a case from the dashboard worked. @Raj66 Might be able to confirm what is going on.

SoCalRacer · ‎Jul 12 2019

By default the WAN port on the MX does DHCP. So the modem should hand a public address back to the MX WAN. Then the MX does internal DHCP on its own private subnet (192.168.128.0/24) which is the range that should be handed to the MS. You might want to check the local status pages to see the config on the devices. Below are some docs you might want to review that pertain to your hardware/setup. https://documentation.meraki.com/MX/Installation_Guides/MX65_Installation_Guide https://documentation.meraki.com/MX/Networks_and_Routing/MX_Addressing_and_VLANs https://documentation.meraki.com/MS/Installation_Guides/MS120-8_Series_Installation_Guide https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

SoCalRacer · ‎Jul 12 2019

If the cable runs are Cat6 I think you will be ok without a switch, but YMMV. If it is Cat5 it is a pretty good chance you will need a switch. Best thing would be do a cable test pre and post install. You will get loss, but if the amount is acceptable then you might be ok, but is going to depend on the cable and the environment, then the Injector. This seems outdated, but might help regarding the injector. https://meraki.cisco.com/lib/pdf/meraki_datasheet_poe_8023af.pdf

SoCalRacer · ‎Jul 12 2019

Multiple authentication options, I don't believe is available. My recommendation would be use WPA2 PreShared key that you change monthly (possibly with the API and randomly generated) Then use a click through splash page with your wifi policy displayed. This will allow all users to authenticate without accounts on specific services. The only downside would be if you wanted to capture those accounts.

SoCalRacer · ‎Jul 11 2019

I would say customize the splash page. You can make more fields and write the code to send an email with those fields data to the approver. Ideally you could use a Google Form and have all the fields you want and then have those pushed in the email, but that isn't available yet. Sponsored guest is pretty new (no API calls im aware of) so I would expect updates in the pipeline.

SoCalRacer · ‎Jul 11 2019

I would do what @Nash recommended in changing the VLAN id on the MX from 18 to whatever is named on the server. Other option, possibly out of normal business hours plug that server into the MX and see if the MX and clients can ping the virtual IP, if so then you know it is a switch config issue.

SoCalRacer · ‎Jul 10 2019

Have you done a powerwash? I never trust end users to setup devices correctly. This always rules it out or gives you the cause.

SoCalRacer · ‎Jul 10 2019

Might take a look at the below doc to help you see if there are any issues with interference. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Using_the_Channel_Utilization_Live_Tool

SoCalRacer · ‎Jul 10 2019

Mountain Dew! A must for IT people

SoCalRacer · ‎Jul 10 2019

I got the badge, but i am missing from the list Congrats to all!

SoCalRacer · ‎Jul 10 2019

I am assuming the MX is handling the DHCP? If so I believe you will need to setup DHCP relay on the juniper to point to the MX. I am not familiar with the Juniper switch, but with HP or most others each VLAN will have a DHCP relay server set. I don't see anything in the config like that. Also next time possibly post a pastebin link to your config instead of the whole config.

SoCalRacer · ‎Jul 9 2019

Check the per-port VLAN settings. The port they are connected to will need to have VLAN 2 set as the native VLAN.

SoCalRacer · ‎Jul 9 2019

Thanks for the update! Regarding LTE carrier compatibility, please confirm. MX = T-Mobile is supported Z = T-Mobile is not supported If that is true then AT&T is the only US support carrier on both MX and Z series?

SoCalRacer · ‎Jul 9 2019

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering/Content_Filtering_Troubleshooting#URL_Blocking Possibly share a screenshot of the URL rule? I have seen many times where the intent is to block a specific URL, but in fact the service/site uses multiple URLs that need to be blocked.

SoCalRacer · ‎Jul 9 2019

I believe this is a MX65 which should have 2 dedicated WAN ports. @jdsilva is there any doc or release on this bug? I have been able to do this before on devices. I was thinking maybe it is related to the local status vulnerability.

SoCalRacer · ‎Jul 9 2019

2 possibilities, would be that you need to disable it in the dashboard first then from the local status page or the port has to be unplugged to be disabled.

SoCalRacer · ‎Jul 9 2019

Is the rule not showing after you hit the save button or the actual rule is not being applied and you are able to access the url?

SoCalRacer · ‎Jul 9 2019

The picture you posted is of the Ethernet tab. It should be under the configure tab. Were you prompted for local login (usually serial number)

SoCalRacer · ‎Jul 8 2019

1 - Check this setting on the SSID to see if it is set to block all access until sign-in is complete Captive portal strength 2 - You might try L3 Firewall rules on that ssid to block the below ports that Psiphon uses, as I don't think you have the need for VPN users on an Open SSID 53, 80, 443, 554, 1935, 7070, 8000, 8001, 6971-6999. 3 - Also another option may be sponsored guest login https://documentation.meraki.com/MR/Encryption_and_Authentication/Sponsored_Guest

SoCalRacer · ‎Jul 8 2019

I think it depends on if you have applied the licenses. I would assume unused applies to the 30 day return policy. If they have been applied I believe you can undo them. Not sure if the 30 day return policy applies then though. https://documentation.meraki.com/zGeneral_Administration/Licensing/Cisco_Meraki_Licensing_Guidelines_and_Limitations/Removing_and_Undoing_License_Claims

SoCalRacer · ‎Jul 8 2019

The way I trust the best to shut down a WAN port is via the local status page. MX - http://mx.meraki.com , http://wired.meraki.com or use the LAN IP https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page If you have access that is your best bet. If needed remote into a device on the network and then get access from there.

SoCalRacer · ‎Jul 8 2019

I believe connected category is done by mac address. At least in my experience and my networks, the connected devices matches the devices in the network. So it looks like it is not counting each session as connected.

SoCalRacer · ‎Jul 2 2019

@ham737 Then bring your next order to me and I will get you some swag.

About SoCalRacer

SoCalRacer

Community Record

Badges