Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About JohnT
JohnT
Getting noticed
Member since May 13, 2019
yesterday
Community Record
53
Posts
35
Kudos
1
Solution
Badges
a week ago
1 Kudo
This is slowly becoming a deal breaker for us as well. With so many services moving from on-prem to the cloud we need the ability to send guest traffic out a separate IP address. My current work around is to individually block access to all of the cloud services on every guest network. It's like whack a mole, and I'm sure I'm missing some. It's becoming a serious liability for us and I'm having difficulty explaining to the board why we continue to use Meraki. Is there anyone from Meraki reading this board who can chime in on this feature?
... View more
2 weeks ago
4 Kudos
I was able to do this in 2001 with a Cisco Pix firewall. I don't understand why this is so hard for Meraki. It's one of the most basic features of a firewall.
... View more
02-15-2023
02:46 PM
2 Kudos
A year later and still nothing. This is killing me. Has anyone heard of any updates on this?
... View more
02-10-2023
10:26 AM
1 Kudo
@Craig_Tompkins It's been many years since I used an ASA, but I believe you had to use a dynamic access policy (DAP) that inspects the registry on the local host. It won't pass the computer name via radius, but rather it communicates directly with the firewall to dynamically assign the policy based on the host posture. This link may point you in the right direction. https://community.cisco.com/t5/vpn/vpn-for-domain-computers-only/td-p/2730898
... View more
02-03-2023
05:26 PM
The only way we could get it to work was to install the Windows Certificate Server web server on our certificate authority. Each user on a Mac would have to run the certificate wizard in the keychain to create a certificate request and then submit it through the Windows certificate server. It's not ideal, but it works. Also, just a heads up that using MacOS certificates and AnyConnect is broken on 17.10.2. We are working with support and are stuck on 16.16.3 right now.
... View more
10-19-2022
03:54 PM
Yep, same here. We use it to monitor our robotic automation rooms and non-IT people need access to the data in CSV format. I'm working on extracting this data from the API, but I'm having trouble with the JSON paths changing dynamically every time I run it. It randomizes the JSON paths for each of the metrics. I've opened a ticket with Meraki to see if they have any advice on how to keep them from changing.
... View more
10-14-2022
11:00 AM
I'm having the same issue. I would love to find a way to give regular users access to only the sensors. As far as I can tell, they need full read_only access to the entire network. The "monitor-only" role does not seem to give access to the sensors for some reason.
... View more
09-01-2022
08:01 PM
I hope we finally get source NAT.
... View more
08-19-2022
01:52 PM
I'm dealing with this right now and I'm not actually sure how to handle this. We use the splash page on our guest network so the guests can accept the terms of service. It seems that I have three options. 1) Allow non-HTTP traffic and allow guest users to bypass our network firewall rules. 2) Block all access to the network until the splash page is clicked. Knowing that half of the guest users will just time out because they are accessing HTTPS. 3) Turn off the splash page and just have an open network with no terms of service I've opened a ticket with Meraki support and I'm not sure they even understand what I'm talking about. The Meraki documentation clearly states that what we are experiencing is as designed. https://documentation.meraki.com/MR/MR_Splash_Page/Enabling_Click-through_splash-page Curious, how are you all handling your guest network portals?
... View more
06-21-2022
09:57 AM
@Cakes I would be interested to know if you can get access to this feature. We are considering leaving Meraki because it's becoming impossible to manage all the silly work arounds. It didn't seem to be a priority with Meraki so we got a little hopeless. This would be great news if they are actually going to solve this.
... View more
06-17-2022
11:48 AM
It's unbelievable that we still don't have this basic feature yet. We have a lot of externally hosted services that utilize IP allow-listing and it's getting extremely difficult to manage all of the content blocking on our guest networks. I currently have to use layer 3/7 Firewall and Traffic Shaping rules to block access from guest networks to the publicly hosted services that need to be unavailable to guest networks.
... View more
04-05-2022
07:45 AM
We have such a small amount of Macs that I would be ok with a manual process. Ideally, the ability to do this from the command line would be optimal. I'm guessing there must be a way to generate a CSR and have it signed by the Windows CA.
... View more
04-04-2022
07:13 PM
1 Kudo
Hi There, I currently have a working setup wtih AnyConnect and a Windows Certificate Authority and it work great. However, we have a few MacOs laptops that I'm struggling to figure out how to generate a user certificate request to process on my Windows certificate authority. The Macs are not domain joined. is this even possible? I would be interested to know if someone has this working.
... View more
Labels:
- Labels:
-
Client VPN
08-11-2021
03:05 PM
Unfortunately, I'm not running the web enrollment feature so I don't have the web interface. However, I can export the root CA with the MMC GUI, and also via the certutil command line with no luck. I'm running a single CA and it seems to be functioning properly otherwise. I'm not sure what else to do.
... View more
08-11-2021
09:17 AM
@FlyingDutchman That's great news. Did you export the CA Root with or without the private key?
... View more
08-11-2021
08:14 AM
Good call on base 64, but that didn't seem to work either. Same error.
... View more
08-10-2021
02:25 PM
I've tested on previous builds, and I'm on 16.11 now with no luck. It's possible I'm doing something wrong or misunderstanding how this feature should work.
... View more
08-10-2021
11:26 AM
I'm experiencing the same issue. I have a Windows AD CA on my local domain. I exported the root certificate and imported it into AnyConnect. My laptop has a device certificate signed by the root authority. Everything looks good, but it won't let me connect and I receive a certificate error.
... View more
07-29-2021
02:07 PM
I suppose that would solve some of my AWS issues, but I forgot to mention we also have some sites in CloudFlare as well so it's a little more complicated. I love Meraki, but this little limitation is killing me.
... View more
07-27-2021
05:14 PM
I'm curious what work arounds people are using to get around the source NAT'ing limitation of the Meraki firewalls? We generally run two WAN connections with one primary and one for failover. We have some resources in AWS that we would like to restrict with source IP address, and Meraki makes this difficult because the corporate and guest networks exit to the Internet with the same external IP address. I know we can block certain destinations on the guest network with the layer 3 & 7 firewall rules, but it's becoming difficult to manage as our AWS infrastructure grows. Is anyone using a link aggregator like a Peplink or something? I'm guessing someone has found a solution for this. Thanks.
... View more
Labels:
- Labels:
-
AWS
07-27-2021
04:35 PM
I've been holding out on upgrading my last Sophos SG210 firewall until the new models came out. I'm torn between the MX85 and MX95. On paper, the MX85 looks sufficient with the exception of the 250 device count, although I've always been able to far exceed the device count on my MX67's with no problem. I'm curious how these stack up to the MX84/MX100.
... View more
07-25-2021
08:56 PM
I think you are right, I missed that. It looks like it was listed in 16.9 as a known issue.
... View more
07-25-2021
08:25 PM
1 Kudo
16.10 lists this as a known issue. Due to a regression, MX appliances are not able to properly utilize dashboard auto-enrolled certificates for AnyConnect VPN connections. MX appliances will default to using a self-signed certificate, which will provide users connecting to the AnyConnect VPN service with a warning message about connecting to an untrusted server.
... View more
07-14-2021
09:22 AM
1 Kudo
I upgraded from 16.4 to 16.9 and now I'm getting an "Untrusted Server Blocked" error message when I try to connect with AnyConnect. The dynamic DNS name appears to be the same so I'm not sure what would cause that. Maybe something went sideways with the certificate during the upgrade. I'll probably open a support ticket.
... View more
06-04-2021
11:15 AM
This could be done with the Cisco ASA and AnyConnect, but I don't believe this feature exists on the Meraki implementation. I would also be curious if someone has found a workaround for this. It looks like certificate authentication may be the solution for this.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 12091 | 08-15-2019 09:55 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 276 | |
| 4 | 10329 | |
| 3 | 6766 | |
| 3 | 12091 | |
| 2 | 678 |
