Meraki

Lourdes · ‎Jul 31 2022

Thanks for the reply. I guess their is an issue with Meraki's cloud. It becomes okay now.

GIdenJoe · ‎Jul 30 2022

You'd be lucky if you at least have a screen that shows ACL hits on a switch. Switches use ASIC's where statelessly forward frames so no CPU involvement. You need CPU for logging. If you really need logging you'll need to have this in your network design. For example security between VLAN's that don't require logging can be routed on the core switch. The rest need to be forwarded to a firewall. In Cisco designs (not Meraki) you have multiple VRF's on your coreswitches and you can then have networks that need to pass an upstream firewall on different VRF's and then you don't need to stretch your layer 2 over your coreswitch which is in fact not the best design.

KarstenI · ‎Jul 29 2022

Oh, I missed that! Things like these are worth a banner in the dashboard!

Inderdeep · ‎Jul 27 2022

Yeah @KarstenI you are right 🙂

SahadSalmiT · ‎Jul 27 2022

Thanks, guys I got the idea about the firewall throughput, I will be really looking into that. But right now I need to get the best possible design for the time being, if this one works with the settings of STP without any bottleneck then I will go forward with that. If not let me know, please.

KarstenI · ‎Jul 26 2022

If you capture the Association, you can see it there in the RSNE-Block if the client uses 802.11r (small "r") which is shown with the AKM type 3.

CptnCrnch · ‎Jul 24 2022

@RaphaelL congrats and a very warm welcome to the team! 😎

TrishaC · ‎Jul 21 2022

Welcome @AmyReyes and @Christopher_S! Sounds like we need to host a Meraki Community Halloween contest....:)

CptnCrnch · ‎Jul 21 2022

MQTT rocks!

KarstenI · ‎Jul 21 2022

You are talking about the ACLs that you can configure on the Switches? Then you are IMO out of luck. With an ACL deny tcp deny udp allow IP ICMP should work, but also all other IP protocols that you likely don't want. This is a job for a firewall.

Tigers · ‎Jul 20 2022

Thank you

KarstenI · ‎Jul 20 2022

Yes, that is the way to go: 1) Allow IP1 -> Server:25/465 2) Deny any -> any:25/465

PhilipDAth · ‎Jul 20 2022

If you have no 2.4Ghz user devices (as indicated), you can ignore this issue. It will be someone else's problem.

swy · ‎Jul 20 2022

Untested- idea received in another forum, results not validated.

KarstenI · ‎Jul 20 2022

Yes, just remember that you have to adjust some DNS entries for IP changes of the main server. The SDWAN will wirk out of the box as the dashboard is handling the addresses.

bxdobs · ‎Jul 19 2022

Sadly, this appears to be ISP related ... added an SFTP server inside this new network and it has exactly the same issue in the opposite direction ... have resorted to pushing the FTP Server to this New Network where the Cameras reside, and will have to use Teamviewer to pull files as required. Replacing Cameras at this point isn't an option PLUS RPi's are on backorder everywhere.

KarstenI · ‎Jul 18 2022

1) You'll find this under "Security & SD-WAN" -> Appliance Status -> Uplink There you can change the IP from DHCP to Static. NAT will be automatically done for all outgoing traffic. 2) This is done under "Security & SD-WAN" -> Addressing & VLANs There you can decide if you want to have multiple VLANs, configure your internal IPs and also set static routes if you have VLANs on the internal switch.

eLvs · ‎Jul 14 2022

their VPN is allowed and paid but its risky since they dont have any restrictions

KarstenI · ‎Jul 13 2022

That is right, AnyConnect (or Cisco Secure Client what is the new name) is a licensed product for which you need to buy a subscripton.

chadsmith · ‎Jul 8 2022

I can definitely see larger customer who would want to power this because of proximity and cost to run power, plus the additional monitoring of power to the device.

KarstenI · ‎Jul 6 2022

And for AnyConnect it also uses TLS1.2 (which is still considered very secure). And with a recent firmware we even get an A+ on ssllabs.com:

dar_ynwa · ‎Jun 29 2022

Hello, could I ask if you had any issues with the WAN port on MX85 flapping before you upgraded the firmware. I have an issue with WAN port to ISP kit flapping and causing user interupptions. Hoping this upgrade fixes. Cheers!

KarstenI · ‎Jun 27 2022

Also think about that users do not equal clients. And a connected Apple Watch will have less impact than the user developing cloud-databases.

bluecat · ‎Jun 22 2022

@tantony I'm having the same timeout issue. What permissions did you need to add to your AD user? I was thinking a plain domain user would be enough

cmr · ‎Jun 19 2022

Also bear in mind what you are expecting the devices to do, there are throughput values for basic traffic, advanced security features and SD-WAN traffic. For example an MX75 as mentioned by @Ryan_Miles above can manage 1Gbps of basic traffic, but only 500Mbps with advanced security features enabled, or over a VPN connection (client or SD-WAN).

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges