About KarstenI

KarstenI

Using these features are completely independent of having a local domain or not. A local domain will give you for example the possibility to apply different security-settings to different user-groups.

KarstenI

I don't think that it will be that easy as the MX will not see the request. Same as with Tor, either we block the ingress-nodes or we are blind for the communication.

KarstenI

I just wanted to mention that I also have a Meraki-Gnome ...

KarstenI

I would expect that the relevant sites will end up in the " Proxy Avoidance and Anonymizers " category when the feature is eventually established.

KarstenI

Make also sure that the VPN-client *and* the gateway have NAT-Traversal (NAT-T) enabled.

KarstenI

Can you do a packet-capture on the LAN and on the WAN-side of the MX450 with a filter of the IP of the other sides VPN-gateway? Perhaps that gives a hint of the problem.

KarstenI

@Shadius The overlap is more or less the URL-Filtering that can be done both on the MX and in Umbrella. But Umbrella is such a great product that really should be considered for advanced security.

KarstenI

Yes, it's a separate product in the Cisco portfolio. What are you looking for exactly? For example, if you have the MX with Security-license, it's not DNS-security, but there is some feature-overlap.

KarstenI

Yes, in combination with Cisco Umbrella which can be integrated on the MX and MR devices.

KarstenI

Perhaps what caused the confusion: On the "Firmware Upgrades" page you do not see what firmware the devices are running. It only shows the firmware-version that should be used if the devices are capable of this version.

KarstenI

I prefer to monitor my WAN-links with an SNMP-application. For monitoring of Meraki devices I prefer CheckMK which runs out of the Box with Meraki. There is also a free virtual appliance if you don't have that much to monitor.

KarstenI

7th to 10th of February 2022 ... The date conference live comes back to (more or less) normal, hopefully ...

KarstenI

As a customer, I typically would not buy this adapter. Why waste an Ethernet-port when a plain USB-C adapter does the job. The only reason I can think of is if there is only ethernet available and the next power plug is far away.

KarstenI

I do not think that it will work. PDL or not, the licenses have to be added before they can be assigned to the individual devices. And I would expect that when the license is re-added, it will again have the old starting-point.

KarstenI

To further investigate if the problem is related to any IPsec-VPN on the MX, I would add a 1:1 NAT with it's own IP for this particular PC and see if that works. If yes, it's likely that it is somehow related to the actual VPN-Config.

KarstenI

I do not think that anything can be done here for now. But for future installations new devices with licenses could be bought "just in time" to avoid "lost time". The question is if "just in time" works in a time where delivery-times are always changing.

KarstenI

An AD is no requirement, it in general just makes things easier. Where are your credentials stored? If you can make them accessible through a RADIUS-server you are good to go.

KarstenI

Practically, you can't. You can easily restrict/shape traffic and with a well-thought QoS-policy you can make all traffic-handling more "smooth". But you can't directly guarantee a bandwidth. You could shape all other traffic so that you have "rest" for that specific PC, but before doing that I would rethink about my requirements.

KarstenI

Also make sure that the AP is connected with a high quality cable. Especially with Cat5e I have some cables that only negotiate 100MBit and others go to 1Gig. And one AP changed from 1Gig to 100M after a couple of years and needed a factory reset.

KarstenI

The forth option that @cmr mentioned would work well, this feature is named "DNS views" and is supported in BIND, but sadly not on Windows Server DNS. So the best long-term solution would be not to use the same domain for internal and external resources. The internal resources should be better migrated to a different domain or a subdomain of company.com. EDIT: Wait ... just the moment I pressed "Post" I remembered there was a new feature that does exactly what DNS views in BIND are doing, the DNS policies: https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/dns-policies-overview These can be used for this, but are not that easy to configure.

KarstenI

Do you have some spare IP addresses on your WAN-side? If you do not need to keep the original WAN IPs (for example because they are whitelisted on some third-party-systems) you can start the VPN on the new network with a dummy-subnet and then just add the regular networks after the old MXes are switches off.

KarstenI

Do you only have the MXes in this network? Then it should work with your procedure. If it is a combined network which also has switches and APs, I would put the MXes in a new network to upgrade to the same version as the old MX and then remove and add the the MXes on the original network. The downtime will be a couple of minutes and if you can get a maintenance-window, this is slightly easier.

KarstenI

I always prefix the object wit a network-identifier and if there are multiple networks with similar objects I put them in a group. But yes, for templated networks, an override-feature would be nice.

KarstenI

All you need is UDP/500 and UDP/4500, and yes, your "permit any" will handle that unless the traffic is denied in rules above that permit. Do you perhaps have a site-2-site VPN between your MX and that Fortinet? That would be a reason that the client VPN will fail.

KarstenI

Didn't we have this question before? And yes, there is a solution to this question!

KarstenI

Community Record

Badges