Meraki

KarstenI · ‎Jan 10 2022

The C3560CX-8XPD had been my first choice in the past. Now I would go with the CBS350-12NP-4X. With 4*SFP+ you can also connect the MX WAN-ports with DAC-cables instead of SFP+. And not using a Meraki Switch for the WAN switch removes the hassle with cloud-connectivity from the WAN-side to the internet.

KarstenI · ‎Jan 7 2022

At least the "Core"-approach will work straight forward as it is a completely common way todo it. The way with multiple access-layers to the MX is possible also with 3+ switches, but you have to take care not to mess up the different native VLANs to the different access-layers to "repair" the STP-setup.

KarstenI · ‎Jan 7 2022

The MR44 is more powerful on 5GHz with 4x4 radios which gives you also a benefit with 2x2 clients. I really like this device. But for low budget, the MR36 is also a great device.

KarstenI · ‎Jan 6 2022

Are you referring to "only" having a 1Gig uplink to your switch? You miss nothing as you will likely never hit that throughput.

KarstenI · ‎Jan 6 2022

But nothing that could not be managed with proper switch configuration. And a “Core” would also be connected redundantly and we have the same situation.

KarstenI · ‎Jan 6 2022

A modern switch typically doesn't really care if it forwards Ethernet-frames or IP datagrams. Adding in the Switch as a core will add a couple of nano-seconds which is irrelevant for Internet-access. And with that many SFP-Ports on the firewall, I still would directly connect the access-switches and see the firewall as "the core".

KarstenI · ‎Jan 6 2022

There will be no practical difference in throughput if you have an additional Core-Switch or not. But it really seems that it is not needed here for functionality. The only problem could be connectivity of the firewall to the switches. With three floors you need a lot of SFP-ports on the firewall to directly connect the access-switches. Or do you have copper from the firewall placement to the access-switches? Firewall-redundancy is definitely more important, if you use Meraki MX, you only need an additional appliance and no additional license. That comes pretty cheap.

KarstenI · ‎Jan 6 2022

I would probably configure it that way. Depending on the amount of users perhaps one VLAN per floor for some separation and also extra VLANs for Voice, printers etc.

KarstenI · ‎Jan 5 2022

If there is only one link and no plan to add a second, then I would not aggregate them. It will work, but the second link in the bundle will be constantly listed as failed.

KarstenI · ‎Jan 5 2022

There will nothing be adjusted automatically. You need to configure the aggregated Interface on the MS corresponding to the Nexus. For example both are trunk, both have the same allowed VLANs.

KarstenI · ‎Jan 3 2022

You use the ports that connect to the neighbour switch. These are typically two or four of your uplink ports on the MS that connect to your Core/Distribution-Switch (The Nexus 9k)

KarstenI · ‎Jan 3 2022

Just go to Switch -> Switchports , select the right ports and select "Aggregate":

KarstenI · ‎Jan 3 2022

Yes, the Meraki switches support port-channels with LACP. The Nexus needs a port-config similar to that: channel-group X mode active

KarstenI · ‎Dec 30 2021

It's under "Organisation". If it is not available to you, you likely don't have the needed permissions.

KarstenI · ‎Dec 30 2021

New business-opportunity: Bundle an MV camera with every AP to have a video of the AP ... 😀

KarstenI · ‎Dec 29 2021

Yes, the Firewall rules on the MX are for traffic that is sent through the firewall to the outside or to other VLANs. It doesn't affect traffic to or from the MX.

KarstenI · ‎Dec 28 2021

I am not aware about MSP licensing. But as long as all potential users are covered by a license I would expect that it should be fine. But better ask a Cisco SE for that. It could be difficult with devices like FTD as these use smart licensing and the license needs to be assigned to the right customer. But with the MX, where we don't have Smart-Licensing at the moment, it would at least technically work.

KarstenI · ‎Dec 27 2021

Yes, the license is assigned to the company that buys the license. It doesn’t matter in which site the licenses are used. This is the ordering guide: https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-og.html

KarstenI · ‎Dec 27 2021

25 users is the minimum amount you can buy. But it is not per site, it is for AnyConnect users in your organisation (if you choose the per user licensing which is most often the best fit).

KarstenI · ‎Dec 23 2021

Personally, I don’t like the MR advanced licensing model. First, you are forced to move to per device licensing regardless if it a good fit or not. And I prefer to have Umbrella as a separate product as the visibility features and flexibility of the “real” Umbrella is really good.

KarstenI · ‎Dec 23 2021

Duplicate post, discussion started here: https://community.meraki.com/t5/Wireless-LAN/MR-Advanced-license/m-p/136423

KarstenI · ‎Dec 21 2021

Okay, next week is still ok … 😉

KarstenI · ‎Dec 21 2021

Yes, you can do that in with the MX.

KarstenI · ‎Dec 20 2021

Hi all, the subject says it ... I would like to change my LAN2 port on an MX67 to WAN2 to use it as the secondary WAN. But I don't find the corresponding API-call ... Any hints? Hope you have all a great holiday-time, Karsten

KarstenI · ‎Dec 16 2021

You can use IKEv1 with AES, SHA1 or SHA256 and Group14. That works like a charm.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges