About KarstenI

KarstenI

What is AnyConnect listing in its Message History?

KarstenI

That would be nice!

KarstenI

Adding to what @UCcert said, if the move needs to be done from one dashboard network to a new one, cloning the old network can speed this process up. For the backup, no, sadly there is not backup in the dashboard. But third party solutions are available like the one from @PhilipDAth https://www.ifm.net.nz/cookbooks/meraki-backup.html

KarstenI

Yes, @CptnCrnch these were some hard days. And we also still needed Flash ... I nominate Peter Palúch from the Cisco Community who regularly inspired me to go deeper with certain topics than needed to accomplish a given task.

KarstenI

Same here with my MG41E, but I never considered it a problem ... 😉

KarstenI

This one is great for Windows users!

KarstenI

That is anything of your choice. Nagios, CheckMK, the market is full of SNMP monitoring solutions.

KarstenI

No, the dashboard has no insight into the 3rd-party products. But you can use one monitoring instance to monitor both the old equipment and the Meraki devices.

KarstenI

"microsoft.com" is not enough to exclude from the tunnel. Here is a Cisco Tech-Note on the needed exclusions: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215343-optimize-anyconnect-split-tunnel-for-off.html

KarstenI

Good to know about this feature! For me, I have seen this behavior also in pure Meraki networks. Have to think about it if it would improve something.

KarstenI

Hmm, never heard of this option … Now additional questions come up: what is the drawback of this option? Why is it not default? Why has support never mentioned it?

KarstenI

BTW: Most of the time it is easy to spot like my AppleTV that in fact is directly connected to the MX: Always when the uplink- and downlink-port on the L2-switch is the same, it's not shown as it's really connected.

KarstenI

Yes, although the Catalyst is not visible in the dashboard, the client shouldn't show up "somewhere else". Sadly, the moment a client is connected to an MX directly or through a third party device, this dashboard-feature gets completely screwed up. A couple of clients had support cases open for this but nothing turned out there. I think it's not a Meraki priority to fix this.

KarstenI

Just ask if there is anything unclear in your planning. IMO, the most important step is to document which services you use on the ASA and if these services are needed after migration. The MX is far less capable than the ASA in nearly everything up to Layer3/4. It can be sufficient, but I ended up very often to still have an ASA alongside with the MX.

KarstenI

You need to terminate the IPsec VPN on a different device as there is no routing between manual IPsec VPNs and AutoVPN. Regardless how great and powerful AutoVPN is, for manual VPNs the MX is just not usable.

KarstenI

@cmr wrote: We place MT10 sensors in closets to do this. have also done it this way ... 🙂

KarstenI

Yes, he announced it early August on the social media platform that you don't like. It seems that fastly.us has some new opportunities for him.

KarstenI

Sadly, there is no loop back interface on the MX. You need to use one of the data interfaces for this. If you want to send information (like RADIUS, syslog, etc) the documentation will tell you which interface will be used.

KarstenI

Make it to #1? Mission impossible … 😉

KarstenI

You can move your management-traffic to an alternate Management-VLAN and let the guest traffic flow native. On the switch port the native traffic gets tagged as needed: https://documentation.meraki.com/MR/Other_Topics/Alternate_Management_Interface_on_MR_Devices Only downside is that Dashboard-traffic is still mixed with guest-traffic.

KarstenI

Congratulation, and it only took little less than half a year ... 😉

KarstenI

I only know the trainings from Sales Connect. But have you already contacted Partner Support?

KarstenI

None of the Meraki Models. There is a Mesh mode, but that is not meant to connect two building. There are other non-Meraki devices that support a real bridge-mode.

KarstenI

Well, the newer models, like the MX85, has PoE on one of the WAN-ports. But the older devices all don't have this.

KarstenI

You can't. A single VLAN has a single IP-scope. But there are other options: If it is possible in your addressing concept you could just change the subnet mask from for example /24 to /23. If your systems get the IP by DHCP, they will automatically adjust to the new mask and you are done. Take this as a first step for some separation and build a new additional VLAN with a new IP-range.

KarstenI

Karsten Iwen

Community Record

Badges