About KarstenI

KarstenI

I've also had misbehaving ports after firmware-upgrades. Some of them started to work normally after a full reset, some switches were replaced by Meraki.

KarstenI

I also use example.com, example.net etc. when I know I have to go to a captive portal. Luckily, modern operating-systems have captive-portal detection which always uses HTTP. In the future a new DHCP-option will be used to find the captive portal.

KarstenI

Did you convert LAN2 to WAN2 before shipping the device to the location? Then you can connnect WAN2 anywhere in the network where the MX gets internet access and start troubleshooting WAN1.

KarstenI

Then it is not the MX that is running the DHCP server and there is nothing to show on the appliance page. Relay is used if the DHCP server is a different box, for example your Windows server. If you want the MX to provide DHCP, use the option "Run a DHCP server".

KarstenI

Sometimes it's the easiest reason ... Is DHCP enabled on this third VLAN?

KarstenI

One more benefit of using MPLS compared to internet transport: If you need Multicast between your sites, it will be much more efficient with MPLS. But not all ISPs support Multicast with their offerings.

KarstenI

My stance: The more complex a VPN setup is, the more likely is that the ASA should be kept as a VPN gateway for quite some time.

KarstenI

The conversion can be done by support (or the mentioned licensing team). If I remember right, the remaining license time will be cut in half as the Advanced Security license is twice as expensive as the Enterprise license.

KarstenI

No, that's not what he says. It's just that the automatic selection and the avoidance of "bad" channels are not as efficient as with the MR33 and above. It will work, but the MR33 has some technologies to make the WLAN work "better" compared to the MR20. If there is no budget for the MR33, the MR20 will likely still do a good job for you.

KarstenI

MR20 is from 2018, MR33 is from 2017. Still, I would prefer MR33.

KarstenI

Here is a guide to follow: https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair Why are you mentioning Dual Active issues? Did you have trouble before?

KarstenI

@BlakeRichardson wrote: Think I'll give it a miss with a 4 month old and two large dogs who don't understand personal space I'll most likely fail within a few minutes. I tried to hypnotize my cat "no, it's not playtime", "no, I won't feed you now", "no, do not jump on the table and rest on my keyboard". Luckily, I had success with that. Or, more likely, the cat was not in a mood for all of that.

KarstenI

It's not the PCs, The OUI AC:CC:8E is assigned to Axis. You have to control the IP-addressing of your cameras. As Philip mentioned, they probably do not get IPs assigned the way it should.

KarstenI

Yes, theoretically AH can be used, but practically it’s not. For example, the Cisco ASA does not even have it implemented. You should look at remote access and site to site separately as the needs are totally different. Basically they only have the need for protection in common. Remote Access: Here we need the mentioned user authentication and IP configuration. Both is not available natively in IKEv1, but is available in IKEv2. With IKEv2 there is no need to use additional protocols for these functions. Site to site: you do not need user authentication, but possibly transfer IP information. These can be routing-protocols which can not be exchanged with IKEv1. This is the reason that often GRE is used and protected by IPSec. With GRE you can transmit multicast which gives you the possibility to run a IGP over the VPN. This additional encapsulation is not needed if something like VTIs (virtual tunnel interfaces) are implemented. Here you also can run routing-protocols. With IKEv2, you could theoretically go without a routing protocol as there is IKE authorization which can communicate network information through the tunnel. This is implemented in Cisco’s FlexVPN. Sadly, nearly nothing of these are implemented in our Meraki MX appliances yet.

KarstenI

Practically, there is no AH in VPNs (also not in other setups). IKEv1 is used in combination with L2TP because native IKEv1 does not have any function to authenticate the user or apply IP configurations to the remote client. Both is implemented with L2TP which is used here.

KarstenI

The hostname of the appliance itself is quite irrelevant here. You can set it to anything you want. It gets automatically prepended to a meraki-controlled part. The resulting FQDN is used in your VPN-client configuration.

KarstenI

I felt similar when first testing online. But I accepted if for a couple of reasons. Most important, there was no real possibility for me to go to a testing center in these times. Either they are closed or limited in testing times that it just didn't work for me. I assume that online-testing will stay even after covid is more controlled which I do not expect to happen in the next couple of months. I do not assume that Pearson Vue will change it's practices. They are strategic partner for too many companies and probably have long-term contracts to deliver the tests the way they think it is the right way to do. Until the testing centers open again in a normal way I have to swallow the bitter pill and do online testing as I need some of the tests for work. The most relevant reason that I do not think that this procedure will change, is that likely most people nowadays do not have any concerns with it.

KarstenI

I depends on how you want to monitor your devices with SNMP. If you want to poll the devices itself, it is configured per network under Network-wide -> General. You can also query the dashboard which is configured under Organization -> Settings. https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP_and_API https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration

KarstenI

Meraki, shut up and take my money!!!

KarstenI

The problem you are talking about is not mesh, it is roaming where a client transitions from one AP to the other. Roaming can be assisted by the AP and Meraki APs have this ability, but it is the client to decide what to do. This decision is based on many factors. iOS devices roam differently when transferring data compared to when they do net transfer data. The most important thing is to have a proper WLAN design done.

KarstenI

I do not remember any of the CCNA/CCNP exams. But I think it is slightly comparable to the CCNA. Both are very broad in the range of knowledge that has to be known. Definitely nothing to take lightly. I assume that every answer is found in the Meraki documentation. @rbnielsen what was your impression?

KarstenI

Hmm, but who of us is the zebra and who is the lion? Because eventually, the food chain will be followed ... 😉

KarstenI

I wrote a little blog-post about this and my preparation. Perhaps someone can benefit from it: https://cyber-fi.net/index.php/2020/10/08/the-cisco-meraki-solutions-specialist/

KarstenI

@CptnCrnch I already wanted to ask if you are the one. Those were also fun times.

KarstenI

I assume it could be based on the enabled load balancing. While you connect to then primary uplink, your client traffic will leave the MX load-balanced on either WAN1 or WAN2 based on the configured WAN-speeds.

KarstenI

Community Record

Badges