Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About CHAadmin
CHAadmin
Getting noticed
Member since Oct 11, 2017
Friday
Community Record
30
Posts
6
Kudos
0
Solutions
Badges
Mar 13 2024
12:41 PM
Sorry to reopen this thread, but I want to see if I understand how UDLD and STP guard should be set up on my topology. Here's the high level image from the dashboard. Very simple hub-spoke. Single uplinks from IDFs (either a stack of two or just a single switch) run back to MS425. Do I enforce UDLD and loop guard both ends, or just the uplink port for the IDF?
... View more
Feb 8 2024
12:19 PM
We recently (with some help from a network consultant) created a DMZ for our facilities LAN by defining it on the MX 250, then adding a few firewall rules. Can we create a Client VPN that only allows access to that VLAN?
... View more
Labels:
- Labels:
-
Client VPN
Nov 16 2022
9:41 AM
We're full stack Meraki on the production LAN/WAN side of the business. MX 250 with Advanced Security license is our firewall. Then immediately downstream is our core L3 MS 425 that is where the VLANs are defined. Then everything stars out to our IDFs with MS 390s and MS 125s, and we have MRs of different models and gens.
... View more
Nov 16 2022
8:29 AM
We want to use the same WAN connection as our primary production VLANs, but want the traffic on this facility network to only be able to get in and out to the WAN, much the same behaviour that NAT mode on a Meraki AP isolates the client to only be able to access the Internet.
... View more
Nov 16 2022
8:11 AM
The LAN that our facilities and building systems are currently on was installed years ago and it is physically isolated from our primary data LAN for business. The facility director built it himself and didn't want to have anything to do with the IT department. Now we find ourselves with him retiring and the ISP providing WAN connectivity for that network is terminating their service offerings in our geographical area. I can either: Just go with a different ISP for that isolated network (increased cost) Somehow incorporate their network into my Meraki stack. How do I mitigate the security risks of facility systems while incorporating the network into my production data network? Is it a question of routing? Firewall rules? VLANs?
... View more
Feb 9 2022
9:36 AM
We are full stack with switches, APs, and MX. I’ve already check with our ISP to see if they can send us stats or a report but sadly they cannot. We’re trying to figure out if our upstream bandwidth is close to being saturated. We are looking into moving our phones to hosted VoIP. Can this info be obtained with our Meraki dashboard?
... View more
Labels:
- Labels:
-
Traffic Analytics
Dec 13 2021
12:40 PM
We're a K12 school using Meraki gear. We also live stream our sports through the NFHS Network and their Pixellot camera system. Lately I've been getting complaints from people that the stream is cutting out or choppy. Our ISP pipe is shared among our campus (1 Gbps/35 Mbps). I've got the live stream gear on it's own VLAN. Is there a way to tell the live statistics in the dashboard on if the pipe is being saturated? Are there wired QoS rules I can put in place that prioritizes all that streaming traffic on that VLAN?
... View more
Labels:
- Labels:
-
Other
-
Traffic Analytics
Dec 13 2021
12:23 PM
We're live streaming basketball games (just finished a 3 day tournament) and I'm getting a lot of complaints that the live stream was poor. We have a single ISP providing 1 Gbps/35 Mbps that the whole campus is sharing. I have the live stream gear on it's own VLAN. We've got 10 Gbps fiber backbone to a MS425 and then over to a MX250. I have several questions: With Meraki gear, how do I realistically monitor the live health of our network to know if my bandwidth is getting totally saturated? Are there QoS methods I can use to prioritize the streaming traffic? What are those rules and where would I put them? Thanks.
... View more
Oct 4 2021
12:54 PM
The changes were completed by 11:30pm on October 1. I know Meraki says client statistics take 24 hours to update when changing to unique client identifier (not perfect BTW). But I don't think that has a bearing on topology view. The other time when topology was screwed up was when I didn't have my STP bridge priority set correctly and we lost power for a couple days. An edge switch came back online as the root. Not fun. But everything looks to be configured correctly. Maybe a bug?
... View more
Oct 3 2021
5:16 PM
Recently completed a major upgrade to my school's network and we are now 100% full stack Meraki. Prior to the upgrade, all switches were home run to our MX250. I realized a couple years later that was a mistake since the MX doesn't handle STP, LLDP/CDP properly. But that's now fixed, as I've aggregated all IDF uplinks to a new MS425-16, which is also my L3 router now. I have a single transit VLAN between the MS425 and the MX250 and both switch ports are set to access ports on that VLAN. Static routes are entered and everything seems to be running smoothly. However, the topology view is not quite accurate. Why does the link layer view say there is not enough info to draw the root? I've got STP bridge priority set to the new core (MS425) at 4096. Clearly it's set to the root.
... View more
Labels:
- Labels:
-
Topology
So I would enter each VLAN I'm tagging per SSID and set the value to Trust DSCP correct?
... View more
Using the full stack from Meraki. Meraki MR documentation for QoS says to make sure switchports that uplink MR APs respect inbound DSCP tagging from the APs. Is that a switchport setting (e.g. STP Guard or Trust DAI)? Or is it a QoS setting?
... View more
Oct 16 2019
10:01 AM
Or do you have to specify the VLAN? And would you do it as a rule at the MX level? Thanks.
... View more
Nov 1 2018
12:41 PM
Thanks! I did see that company in search results when I was trying to find more info on Google's Secure LDAP. Does Meraki support Jump Cloud?
... View more
Nov 1 2018
12:25 PM
Maybe "messy" was a poor choice of words. A couple years ago, we did both hardware and software upgrades simultaeously. First, we replaced all aging Windows XP machines student's were using with Chromebooks and Chromeboxes. Second, we gave every student their own G Suite account (a change from student's being assigned generic "comp_xx" AD accounts every year if they were enrolled in a computer class). Now, every class is a computer class. Consequently, I've built out my G Suite IdP much more than AD, to the point where AD is stagnating, in terms of user accounts. With GCDS, it's a one-way sync from AD to Google, and rather than export from Google and rebuild AD org structure with those exports, I'd just rather use G Suite as the native IdP. I hope I'm not alone in that. 🙂
... View more
Oct 31 2018
5:02 PM
1 Kudo
I believe it uses open protocols like OAuth. It’s main use is simplifying your Identity Management Platforms. In my case, as a G Suite for Education admin, all my students are strictly G Suite users. I don’t want to deal with the messiness of GCDS. With an MX security appliance, there is a local element to authentication because it will integrate with Microsoft AD for identity-based group policies. I want that same user/group policy application for simplicity and consistency sake when my IdP is G Suite. Simplifying identity and access management for more businesses
... View more
Oct 31 2018
2:25 PM
2 Kudos
Google plans to release Secure LDAP for Cloud Identity and G Suite in the coming weeks. When Ravi Kumar, Product Manager for Google Cloud Identity, was asked about Meraki support for Secure LDAP he said that Google was working with the Meraki team, but the current limitation is Meraki's lack of support for the needed digital certificates issued by Google. Please ask Meraki to support Secure LDAP through Cloud Identity/G Suite. HP/Aruba has already announced support for ClearPass authentication with Secure LDAP as the IdP. This would solve many problems for Google admins, especially those who work in education.
... View more
Feb 9 2018
7:39 AM
No syslog server. Is there a cloud based syslog you recommend? (P.S. Meraki needs to have cloud hosted syslogs)
... View more
Feb 9 2018
7:13 AM
@DCooper That "common problem" documentation may explain a mystery that popped up yesterday. My MX100 security center said two retrospective malware detections occurred yesterday. The affected clients were two Meraki APs, not actual clients. So I can't figure out who the actual client is. @wirednot Lee, I follow you on Twitter and you're immensely helpful in sharing your experience. Thanks.
... View more
Jan 24 2018
9:23 AM
@DCooper Also, I do have an MX100. What are the recommendations you mentioned for the MX?
... View more
Jan 24 2018
6:11 AM
@DCooper Unfortunately, we are running stable firmware on our APs and the most recent stable build is 24.12. The documentation for bridge more client isolation says its is supported starting in version 25.8 Hopefully we'll get a new stable firmware build soon, because I'm also missing hosted logs and URL logging.
... View more
Jan 22 2018
2:22 PM
I'm trying to determine if a student sent a harassing email to a teacher while on campus Wi-Fi. The email was sent from an anonymous Gmail address, not our G Suite Gmail. However, it was received by a teacher on his school-issued G Suite account, so I can look at the headers. Using the IP addresses in the headers, is there a way I can tell if those IPs correspond to a client on an SSID using Meraki NAT?
... View more
Nov 7 2017
5:41 AM
For example if I set a per-SSID bandwidth limit to 5 Mbps, does it do any good to also set a client limit? What are the best practices here? I have a business cable ISP WAN connection of 300/30
... View more
Labels:
- Labels:
-
SSID
My Top Kudoed Posts
© 2024 Cisco Systems, Inc.
