Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About JonnyM
About JonnyM
Community Record
28
Posts
16
Kudos
4
Solutions
Badges
Monday
2 Kudos
Not holding my breath but if we can integrate Wi-Fi access with Entra ID (like Aruba Cloud Auth) that is going to shift a lot of Meraki product for us.
... View more
a week ago
2 Kudos
I'm thinking API first and then they'll build the dashboard interface for it later
... View more
a week ago
Both, I think I was hoping that we'd get some DNS proxy / conditional forwarder support on the MX platform but that might be asking too much.
... View more
a week ago
Are you trying to say your Fortigate is on a dynamic IP and possibly behind NAT?
... View more
a week ago
@cmr wrote: What's new Added API support for configuring Multicast Forwarding Added API support for configuring Split DNS Is there any documentation about these two features?
... View more
Aug 23 2024
7:54 AM
2 Kudos
For 'advanced' stuff like this I have previously deployed a non-Meraki firewall alongside an MX and then created static routes between the two boxes. We had an MX running our office about four years ago but needed 20-30 IPsec tunnels to other organisations and I did them all on a Netgate appliance because things like routed tunnels weren't an option on the MX. Knowing the limitations of the MX platform and trying to keep your usage within the constraints is half the work of designing Meraki implementations.
... View more
Aug 22 2024
5:31 AM
1 Kudo
On the ASA platform it's documented how to do this here: https://www.cisco.com/c/en/us/td/docs/security/asa/asa917/configuration/vpn/asa-917-vpn-config/vpn-anyconnect.html#task_lbs_x2r_trb:~:text=saml/metadata/462950-,Configure%20Default%20OS%20Browser%20for%20SAML%20Authentication,-Specify%20whether%20or I have access to the various Secure Client downloads including the current latest version of the file external-sso-5.1.5.65-webdeploy-k9.pkg, but obviously the Meraki MX is not an ASA. Is there a way to have the SAML auth dialog presented to the user with the default system browser instead of a web view, so they can do things like SSO or use passkeys etc?
... View more
Labels:
- Labels:
-
Client VPN
-
Firewall
Aug 22 2024
5:22 AM
1 Kudo
This is resolved, it was an NSG issue relating to the VirtualNetwork service tag only containing custom routes if the NIC was in the subnet where a custom route was being applied to, even if it was in the same vnet. So adding the route to the subnet the vMX was in was making things work because the destination was being included in the service tag, not because of a routing problem.
... View more
Aug 19 2024
2:36 AM
I've just done a simple test by creating a new resource group and new vnet. Vnet is 10.0.0.0/24 and it has a router subnet at 10.0.0.0/29 and a client subnet at 10.0.0.8/29. Two Ubuntu LTS VMs have been deployed - router at 10.0.0.4 and client at 10.0.0.12. I have enabled IP routing on the NIC on router and added a route table with a single route - 192.168.0.0/24 with next-hop address of 10.0.0.4 and attached it to the client subnet. Running tcpdump on router and pinging an address in the 192.168.0.0/24 subnet from client shows no packets arriving. Pinging 10.0.0.4 shows packets as expected. Adding the route table to the router subnet also results in the ICMP packets arriving at router. Removing this route keeps the ICMP packets arriving for a few minutes, but only if they are destined for an IP in 192.168.0.0/24 that has been pinged recently, after about 15 minutes the routing fails again. I recreated the setup in US East in case my issues were a UK South anomaly, but it made no difference. My understanding is that this is not how Azure is meant to function but I'm still convinced I'm doing something wrong because surely this would have been noticed by now.
... View more
Aug 16 2024
7:40 AM
The route is a virtual appliance route, you can see on the packet capture from the MX exactly when I drop the route table off the subnet the vMX is in. Effective routes and next-hop diagnostics from Azure portal all look as they should, but traffic doesn't route unless the vMX subnet also has the route table.
... View more
Aug 15 2024
11:57 AM
I have a vMX deployed in its own subnet in Azure, the vMX has IP 10.6.250.12/29, the resources in Azure that it needs to access are in 10.6.250.128/25, and VPN connected users are allocated an address in 10.6.249.0/24. The vMX is configured as a concentrator because I can't have it NATing everything out of its single interface as it becomes difficult to isolate captures from individual clients if everything has the same source IP - it also papers over missing routes and this is going to be a very stable setup once it's built. I have created a route table with a single route for my VPN clients, which is to say that 10.6.249.0/24 has a next-hop IP of 10.6.250.12. I assigned this to the subnet with my resources in, I also made sure this subnet was added in the vMX as a local network in the site-to-site VPN settings, and that it was a route that my VPN clients knew about. The VPN connects successfully, but I can't ping anything in 10.6.250.128/25. Running a packet capture on the vMX shows the packets leaving, but nothing coming back. Pinging an address in the VPN subnet from the resources in Azure results in nothing showing up in the packet capture. The only thing that brings everything to life is adding the route table onto the same subnet as the vMX is in - something that the docs explicitly say not to do. Unfortunately I have no hard proof but I am convinced something has changed in Azure here - I deployed a virtual SonicWall a month ago and had to do the same thing (add the route to the same subnet as the firewall interface) where previously I am sure you only needed to tell the subnet where the traffic was originating from what the next-hop address was, rather than needing to 'walk' the packets through the subnet your appliance lives in, it's possible I am skipping a step and forgetting but my deployment is quite simple and looks the same as the instructions. The Azure docs also say that adding the route to the one subnet hosting the resources is enough, and yet I can run a ping and make it either timeout or work depending on whether this route table has also been associated to the vMX subnet. Has anybody seen this?
... View more
Labels:
- Labels:
-
Azure
-
Virtual firewall
Jul 10 2024
2:01 AM
With the coming discontinuation of SecureX, the only options for managing multiple Meraki organisations are: Using a single user account as the organisation admin that all your staff log in as (bad) Inviting every staff account to every Meraki organisation you manage and removing the accounts again when people leave (very time consuming and open to errors) Using SAML (good, the option we use) The problem with the Meraki SAML implementation and the 'MSP Portal' in general is that it's quite a loose relationship that appears when accounts have access to more than one organisation, and in the case of SAML it's based on what SAML cert thumbprint exists in an org. configuration at the time the SAML auth is performed. Rotating SAML certificates requires a visit to every managed org. and updating the thumbprint. This is fine if you have 10-20 clients, it's a lot more time consuming if you have 300. Are there any plans to improve this, perhaps a purpose-built MSP portal where organisations are linked to it by them accepting an invitation, a link that remains in place until expressly terminated by the client or service provider, as well as SAML only needing to be configured in a single location?
... View more
Dec 6 2023
12:14 AM
4 Kudos
Registering my request to have High Availability extend to IPv6 - an idea of whether it's at least work in progress would be appreciated, I can't see that it wouldn't at least be in development but Cisco have surprised me before. Currently if we have an MX deployed and IPv6 in use we can't upsell customers to High Availability without them losing features, which isn't an acceptable option in a lot of cases.
... View more
Mar 27 2023
8:02 AM
I opened a case but it's fixed itself now
... View more
Mar 23 2023
1:49 PM
Within the last 2-3 days this message has started appearing instead of our list of organisations. I am logging in using SAML and are an MSP so we have access to multiple organisations. If I switch back to the old version I can get the list of organisations to load, but obviously it's not as quick as the new Global Overview. This issue is happening across multiple devices and in the latest versions of both Edge and Chrome. The developer console in the browser shows the following:
... View more
Labels:
- Labels:
-
Administrators
-
Other
Oct 27 2022
11:29 AM
1 Kudo
It looks like this feature is working now 🙂
... View more
Sep 28 2022
2:51 PM
1 Kudo
I can opt-in when logged in as a non-SAML user, but the opt-in process doesn't work when I use a SAML account, it just dumps me into the last network I viewed. The error on the Edge console is: POST https://n146.meraki.com/api/v1/administered/identities/me/earlyAccess/features/optIns 500 (Internal Server Error)
... View more
Sep 27 2022
12:15 PM
Looks like this is live now as an opt-in https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/SP-Initiated_SAML_SSO_Configuration_Guide but the iOS app hasn't updated yet to reflect the new feature
... View more
Sep 27 2022
12:04 PM
You can probably work around this now by opting into the new SP-initiated SSO feature and using the custom entity ID that you set, but personally I'd have one SSO configuration and use roles to determine who has access to which organisations.
... View more
Feb 28 2022
4:27 PM
Hi Joe, do you know what your policy is in accepting people into this beta? I have our MSP portal configured to use SAML at the moment (Azure AD) and filled the form in a couple of weeks ago because our staff would like to use the mobile app and SP-initiated login, but haven't heard anything back yet.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 261 | Monday | |
| 519 | Aug 23 2024 7:54 AM | |
| 507 | Aug 22 2024 5:22 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 795 | |
| 2 | 261 | |
| 2 | 1016 | |
| 2 | 519 | |
| 1 | 416 |
© 2024 Cisco Systems, Inc.
