About KarstenI

KarstenI

Just to add to what Bruce said: make sure you configure the Ping-checks on both ends. Both sides must use the p2p link *or* the s2s-vpn. Otherwise you get asymetric routing and the traffic will be dropped. Another possibility: If your internal switches support these connectivity-checks or a dynamic routing-protocol *and* you don't need any filtering between the sites, then you can terminate the L2-link on an internal switch.

KarstenI

First I would correct the lifetimes on your strongswan box to match the values on the MX (although this is typically no problem): ikelifetime=8h lifetime=1h It seems to establish the tunnel and I would expect the routing to be the problem. I never used a "tunnel all" with the MX, but at least it is documented to be supported. But to make sure that the VPN itself is ok, I would first configure the left side to only use a particular local subnet. The counters show that the MX is not sending traffic to the tunnel: 0 bytes_i, 26292 bytes_o If that works we can troubleshoot further. And also make sure that the outbound VPN firewall permits the traffic.

KarstenI

I am not sure if this is your problem, but it looks similar: If macOS devices (and HomePods have the same base as macOS) get the same IP, they automatically change the name with an incrementing number. Make sure that there are not two DHCP-servers in your network with overlapping DHCP-scopes.

KarstenI

And to add to what @cmr said: It will be one of the most beautiful doorstop on the market. 😉

KarstenI

First we have to find out the relevant information: - AutoVPN is in use, but uses SplitTunnel - It is traffic to the internet - Load balancing is enabled - The only flow-Preference for the source is the last one for 9.9.9.9/32. Although it is an address on the internet, it's not "the internet". It is not a) or b) as we have load balancing enabled but no flow preference matches It is not c) or d) as it is no AutoVPN-traffic The answer should be "e".

KarstenI · ‎02-02-2021

I just don't care as it is very often out of my control. The patch panels are often SC or ST, sometimes LC. The network-equipment is nearly always LC nowadays. It's just important to have enough different cables with the right connectors in you bag.

KarstenI · ‎01-28-2021

If you need a 1:1 NAT for this amount of hosts, a little script with a loop and an API call could be used: https://developer.cisco.com/meraki/api-v1/#!get-network-appliance-firewall-one-to-one-nat-rules

KarstenI · ‎01-28-2021

Yes, the syntax is correct: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX Have you done a capture on the WAN-port to see if the packets are really coming?

KarstenI · ‎01-28-2021

I think this could be done with the help of the API. A monitoring station checks for RADIUS-functionality on both PSNs. If both are offline you issue an API call to change the port-settings to something useful in that situation.

KarstenI · ‎01-27-2021

Or I remembered wrong ... I also do not find it. Anyone else?

KarstenI · ‎01-27-2021

I remember a discussion here in the forum that it is planned to be included in the next release MR28.

KarstenI · ‎01-27-2021

I did some tests with my MX64W and this is what works: The MX Port-Setting: The ISE Authentication policy: First rule matches on MAB, second rule matches on 802.1X for both wired and also my SSID "MX-TEST-EAP". The last rule matches on the client-VPN. Actually, I don't really like how it's implemented. The MX is quite limited for this kind of konfig. It doesn't even apply the returned VLAN to the session. For a pure Home-Office environment I could think about using this, but not anything more complex.

KarstenI · ‎01-27-2021

This is typically done differently. Just ask your ISP to route the new subnet to the IP that you have on the MX. If you use HA, the new subnet has to be routed to the virtual IP. After that, you can use this new IP-range in your NAT-configuration on the firewall.

KarstenI · ‎01-27-2021

This is part of the "Network Device Profiles" where the ISE has the infos how to do AuthC, AuthZ, if CoA is supported, how VLANs are set and so on. This is what is used if you use the Network Device Profile "Cisco": At the moment I don't know which attribute can be used for Wired MAB on the MX.

KarstenI · ‎01-25-2021

You can use any switch. Having PoE would be nice to power the APs but is also not necessary as you can power them with external power supplies and/or power injectors. But using Meraki Switches with Meraki APs give you a better visibility into your network as they integrate in the dashboard.

KarstenI · ‎01-24-2021

I think it is important to look exactly at what is happening here. It wouldn't make any sense to upgrade a Z1 to 15x, but we are not really upgrading devices. We are just setting the intended Firmware-version for a dashboard network whatever devices are in there. And the network can easily be configured for v15 regardless if it is a Z1 in there or a Z3. But the moment the Z1 is replaced by a Z3, the Z3 will run the configured version.

KarstenI · ‎01-24-2021

@cmr This network is running in this combination for at least two years. Roaming ... Well, I never captured it in that network and I can not tell if it really roams or just disassociates and associated again. The most used SSID is PSK anyhow. I think I have to try it again with FT on my SM-enabled SSID when I am in that network again. But that will not happen in the next couple of days.

KarstenI · ‎01-24-2021

This is one of my mixed networks: The MR30H is in the process of upgrading just now. And this is one SSID without one of the 27.x features:

KarstenI · ‎01-23-2021

If it's in the same VLAN, it stays on the stack. If it's from one VLAN to another, it must go through the MS-425-core as it gets routed there.

KarstenI · ‎01-23-2021

I think you are getting it quite right here. For your use case, the MS125 should be a "good enough" switch. Personally I always like to push the decision to a 2xx switch as there are some features (some that you listed) that are quite nice to have or needed to be there. If you are low on budget, take the MS-125. If you want more flexibility for the future (if that is important in your use case), go at least for the MS225.

KarstenI · ‎01-23-2021

I am not aware of any "recommendation", and if there are some, they are typically for specific scenarios. But I would also consider a different solution, but it depends if it matches your needs: Probably you want to run your VLAN-routing on this stack. My own preference is to have a pair of switches as the "core" with servers connected and the routing on it. And all the other devices go to an "access" stack that is connected with n*10Gig. Your possibilities to manage ports wherever they are is not limited here as you still have your "virtual stacking available in the complete Meraki Dashboard-network.

KarstenI · ‎01-23-2021

I also really don't know. But if this would be a real exam I would approach it the following way: - One of them (b) is organisation-based and a clear candidate for UTC. - Two of them (a and c) are for events that are local to a network and the network has it's own timezone. - One (d) is a log that is based on a Meraki network but he events can relate to any timezone because the devices are roaming, This would also be a candidate for UTC. With (a) and (c) ruled out there it is 50:50 chance and my guess (based on what is more likely) would go to (b).

KarstenI · ‎01-22-2021

@Dustin_Hollis @Twitch And now look again *which* Tags you use there. The ones assigned to a network or the ones assigned to an AP.

KarstenI · ‎01-22-2021

After this lengthy discussion, do you understand why I just place another VPN gateway to the network? 😉

KarstenI · ‎01-20-2021

Done, you don't need to wait for the survey to finish, you can directly send the bottle my way ... 🙂

KarstenI

Community Record

Badges