Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Brons2
Brons2
Building a reputation
Member since Jun 26, 2019
Mar 13 2020
Community Record
77
Posts
29
Kudos
1
Solution
Badges
Mar 11 2020
1:37 PM
I have a /30 WAN connection network, and a /24 public IP space for use at my/our discretion. The /24 sits behind the /30. The upstream provider router is set such that the /24 is reachable through my side of the /30. Is it possible Comcast is assuming this for your setup as well? Caveat(s): I don't have Comcast, and I don't know much about them. We use AT&T ADE, which is a straight L2 point to point metro Ethernet circuit. Our internet provider is the telecommunications department of our overall organization and not AT&T. But anyway (there are other trunks on my circuits, and a redundant circuit to a 2nd location, but that's beyond the scope of this discussion)
... View more
Mar 11 2020
1:21 PM
1 Kudo
You are correct, it's only for AP clients. I changed my post. Sorry about that, not sure how I missed that before. I spend a lot more time scrutinizing wireless clients, which is probably why I erroneously assumed it applied to all clients.
... View more
It's been a couple of months since you posted this but I would be interested in trying it out.
... View more
Mar 11 2020
10:47 AM
My setup was similar when I didn't have our datacenter network behind the (non Meraki MX) firewall. My MS425s were doing OSPF between themselves and Cisco ASRs, and whatever the datacenter vendor had on their end. I used a transport network, as you mentioned, between the Meraki and ASR, and then another transport network between the ASR and the datacenter vendor's equipment. I did not extend the internal VLANs beyond the MS425s, but I did advertise the subnets contained within the VLANs to OSPF so everything participating in the OSPF area had the information about which router had (for example) the 10.1.2.0/24 network. It took a bit of fiddling the first time to get it to work, but the problems ended up being speed/duplex between the Meraki gear and the ASR. The aforementioned MS425s replaced an old Catalyst 6509. I have now moved the datacenter network behind the firewall, as we bought some larger firewall boxes, so now FW vendor P is handling OSPF. But I would not hesitate to use OSPF on Meraki again if I had a need for it.
... View more
Come on now, they're not that bad. The 11.x firmware had issues. But prior to that, my MS42Ps ran for 7+ years with zero problems.
... View more
Mar 11 2020
10:35 AM
I wish Meraki did have a VRF capable switch. I could EOL our Cisco router fleet. As it is, I am thinking of replacing them (ASR/ISR) with some Ruckus switches with advanced IP license which my firewall reseller likes and recommends. We do not tax our Cisco routers at all and the ASR were extremely expensive, a switch that supported VRF and VRRP would work fine to replace them.
... View more
Mar 11 2020
8:53 AM
4 Kudos
SOMEBODY (not me...) set the organizational settings to Try Beta Firmware to Yes, while I was out of pocket. So the switch network upgraded itself to 12.9. I had been holding on 10.45 due to issues experienced with 11.2x. But I'm happy to report that 12.9 works fantastic for us, with none of the 11.2x issues that I experienced. Like Cisco IP phones going inexplicably offline repeatedly. And it has some neat new features, like when you click on a client it will show you the entire network path from edge to core, for AP clients. I turned the Try Beta Firmware back to No, but I'm not going to let it roll back. This firmware works good. No issues.
... View more
Feb 14 2020
1:53 PM
Exactly Philip, whatever is the next device downstream will need a static route back to any subnets that are not on the same VLAN as the connected VLAN. If you don't give it this, then it's only going to see the VLAN that it is connected to on the Meraki. This is assuming the devices are not using any dynamic routing protocols, of course.
... View more
You can prevent a smart switch being installed on a port by using STP Guard. https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_Spanning_Tree_on_Meraki_Switches_(MS) "If a port with BPDU Guard enabled on it receives a BPDU, the port will transition to a disabled state" Of course a dumb switch could still be plugged in, but there's less you can do with a dumb switch. As for 802.1x it could use any source of RADIUS. I agree I would like to see a richer feature set on here, but turning them into Meraki Catalysts is not appealing to me. We bought Meraki to get away from the Catalysts, to make our network more junior administrator friendly. The organization doesn't want to have to hire a network engineer at every subsite.
... View more
Jan 31 2020
6:10 AM
Ok you have L3 on 2 interfaces on the 10.150.77.0/24 VLAN. the core switch at your main location and your Meraki at the remote location? Meraki L3 interface at branch is 10.150.77.1 Cisco interface (Assuming L3) at main is 10.150.77.254 I personally would not like to see broadcast domains, i.e., same subnet, go out over WAN links. You could have a packet storm going over your WAN link when the poor performance happens. Normally a router would not pass that traffic on but if the VLAN goes over the link the router is going to pass all the broadcast traffic unless you explicitly tell it not to. I see that you have the Meraki set not to route multicast but is the Cisco on the other side also set the same? If you're going to keep this setup having the VLAN go over the WAN link, I don't see the need to have L3 set up on the Meraki. You could do the opposite of what I said before, make it L2 all the way back to your core Cisco at the main location. Also I see the VLANS are configured to relay DHCP to something back at the main site. What information is DHCP handing out for this VLAN? Is the clients' default gateway .254 or .1? If you're going to continue to run L3 then the local Meraki (.1) should probably be the default gateway for clients. The Meraki switch has a static route back to the core, so you're good there. It's hard to put a handle on exactly what's going on here. But it seems non-optimal. A packet capture while you're having the problem would be telling.
... View more
Jan 30 2020
1:07 PM
Are you trying to do this all L2? Me personally I would turn on L3 on the MS250 and sent the default route to whatever IP is on the other side of the transport VLAN 30. And don't put 77 and 120 on both sides of the link.
... View more
Yes, the uplink from your 2 VLANs will be whatever the default route is, unless you put in some ACLs in preventing access to the default route, or if you have other routing protocols like OSPF that you configured to supersede the default route.
... View more
This really sounds the same as the MAC flap issue on 11.x. Or the MAC flap issue is the same as this. If it's the MAC flap issue then the STP messages are just a byproduct of the port going down. If this is a separate and distinct issue with the BPDUs as someone mentioned then the STP messages are relevant. I can say that, when I went to 11.22 my Cisco IP phones were going offline like crazy. I have Cisco 3905s and 8811s, also ATA-190s for analog bridge. The MR34 and MR52 access points that I have were stable throughout the issues.
... View more
I have 22 HP MFPs in this building and I have no issues like the one you describe. The printer models are the 67560 and the 87660 Running a mix of MS250s and MS42Ps, the printers would be plugged into one of those two models. One thing I do when I set up the printers is turn off all services on the HP side that are not necessary in my environment, like multicast, Bonjour, AirPrint and IPv6. These services are on by default. I don't know how they interact with Meraki and I don't plan on finding out because I don't need them. Also, there are fairly frequent firmware updates for the HP models I have. I try to stay on top of those.
... View more
Jan 28 2020
6:28 AM
1 Kudo
I have a similar scenario but my core is a pair of MS425s rather than MS250s. I'm pretty happy with the stacking, I also considered warm spare but went with stacking. The nice thing is that you can use port aggregation on a stack, so in effect I can get a 20Gbit downlink to a switch stack on another floor. I'm not happy with the MAC flap bug on the 11.x firmwares when using L3 on the Merakis but there's other threads about that, and I don't think it would apply since you're not running L3.
... View more
Predates 10.x? I never had the issue until going to 11.x. I'm still holding at 10.45 and it's working great in my environment, including on the stack running L3. However, I think at some point there will be a cost in staying on 10.45 in terms of losing access to new features. One thing I've considered is moving L3 to the firewall - vendor P likes to tell their customers "we can do that". Or just buying a core switch stack from another vendor, and not catalysts either. I don't understand why they can't get it together on this issue. It's been at least 5 months since this thread started. This issue should have been fixed in days or even hours.
... View more
Nov 25 2019
10:54 AM
The OP says that they cannot do the "good stuff" with Meraki switches that they could with "normal cisco switches". Well, Meraki leaves out most of the irrelevant stuff too, or is irrelevant for 80-90% of organizations. Meraki was acquired by Cisco in 2013 as a complimentary product IMO, not a replacement for the legacy Cisco switches. Meraki was meant as a product that was simple to use and to administer from anywhere, for people who don't want to keep a network engineer on staff just to type in IOS commands. These switches are junior level administrator friendly. With these products I can trust a junior PC tech to change a VLAN on a port. If you just want to have a switch to where you can set up some VLANS, some basic L3 routing and VOIP phones, they are pretty good for that, and they perform well, in my case, much better than the switches that they replaced. I would suggest that the OP didn't do his homework before buying these switches. They are not IOS switches nor were they intended to be. If you need IOS advanced features buy a Catalyst or Nexus switch, simple as that. If you just need to know when the thing went down, go buy a log aggregator or SIEM and tell the Meraki platform to export syslog to it. That's what we do. You can get actionable information from the syslog output. Or if you want to make it even simpler, use the new webhook feature. Disclaimer: I haven't personally tried this.
... View more
Nov 20 2019
7:47 AM
If you need netflow, buy traditional Cisco gear, simple as that. I don't run the MX platform myself but there's no reason to denigrate it as "garbage" just because it doesn't have some advanced feature that you think it should. The Meraki platform was meant to be simpler to manage, under the assumption that not everyone needs a Catalyst or similar advanced switch/feature set..
... View more
Nov 5 2019
11:39 AM
If it's a wireless network for corporate guests, does that mean those guests work for your company? If so use 802.1x via RADIUS from your authentication provider. If "corporate guest" means people that don't work for you, then never mind 😉😁
... View more
Nov 5 2019
11:33 AM
Yea, we don't use MX and have no intention of doing so. I'm only looking at putting DHCP on L3 interfaces on a per-site basis. I also have no intention of running DHCP across WAN links. I agree with you that I can't understand why someone would say that Windows DHCP is hard to manage. It's the easiest thing out there in a server based DHCP setup. What I ended up doing was trying it out on 1 VLAN, and leaving the others on Windows DHCP for now. So far so good.
... View more
Nov 5 2019
8:54 AM
So some of you may have read the prior thread where I was grousing about the MS120s not passing OSPF. https://community.meraki.com/t5/Switching/MS-120-won-t-even-pass-OSPF-traffic-unmolested/m-p/66401#M5228 In the process of troubleshooting the MS120s not passing OSPF on Saturday morning, I thought I would do a staged upgrade to where the MS120 would take the latest available firmware, and maybe that would fix my problem of OSPF not passing between two adjacent ports on the same VLAN. However, when I scheduled the staged upgrade, it upgraded all my switches at the site I was working at. I had been holding off on the 11.x branch, was still on 10.45. But I let it go, because, I just wanted to get my routing changes done and go enjoy my weekend. BIG MISTAKE. Got to the office before 7:30 Monday to see how things were running. I got to my desk to find the PC techs were scrambling around to re-plug IP phones that weren't registering. I just chalked it off to the firmware upgrade and maybe the phones came up before the route to the phone server did. Then my session border controller went offline. We use a cloud IVR and contact center, so this is a huge deal. People started calling downstairs from the call center. I could not even ping the session border controller. I thought, well, maybe I bumped the cable when I was working in there on Saturday, so I went in the IDF and replugged it. I was then able to ping the SBC. Then the SBC went offline again. People started calling again from the call center saying they were in the middle of a call and all a sudden they could not hear the customer any longer. I tried to ping the SBC, dead again. I replaced the cable. The SBC only stayed up for 10-15 minutes until I had to re-cycle the port again. And the IP phones kept dropping off, too. The PC techs were frantically running around replugging them. As this point I started to surmise that it was the Meraki firmware upgrade that was causing it. Went and talked to executive management, said I wanted to roll back the firmware at lunchtime. Told them everyone would be down for 15-20 minutes. They agreed to it. Went back to my desk to schedule the rollback. Got an error. The portal would not let me roll back, it said a rollback was already scheduled. !@#$%#%@^$&. Exact error message was Error rolling back. No changes have been made to your staged upgrades. Network already scheduled for rollback At this point called Meraki support. He didn't seem to understand at first what was happening, but after starting a remote session he could clearly see the error. Turns out, I needed to bring ALL my meraki switches online and up to 11.22 before I could roll back. I had some older MS42Ps that I had replaced with MS250-48FPs last fiscal year. Well I had to go find them and plug them back in so they could upgrade to 11.22. Then I still could not roll back. So the Meraki engineer took over and rolled them back from his end. But the whole process took way longer than the lunch hour, so there was an outage for the business after 1pm of about 20 minutes. After the rollback to 10.45 everything worked. I asked Meraki Support to please clarify why my staged upgrade did not work. They said they'd ask the engineers 🙄 So now I'm debriefing on the outage, and looking at release notes for various version. I came across this for 11.24: Bug fixes ARP entry on L3 switch expires despite still being in use -- causing brief packet loss until re-ARP occurs If this is the case, WHY DID THE 11.22 FIRMWARE GET SCHEDULED AS THE NEXT VERSION?!?!?!? FOR ANY CUSTOMER?!?!?!? While we're at it, I need a manual reversion process. The web upgrades are great and all, but if I need to roll back, I can't be having to go through support to do it for me. In closing, Shame on you Meraki. You have really shaken my confidence. I have other choices for network equipment. The budget has not had a final decision for this fiscal year yet (Sept 1-Aug 31). I would like to be able to continue this relationship, but, you really need to change some things.
... View more
Nov 2 2019
9:52 AM
1 Kudo
Ok, so I've had this pair of MS120s sitting between an HA firewall pair (not MX) and an HA router. I've just been passing tagged VLAN traffic and it's been working fine for several months. I had an emergency with another switch vendor's products going down, and since we have an ever expanding Meraki presence, I just threw those 120s in there in a pinch and it's been great until now. Well today I tried to add another VLAN that has OSPF traffic on it. I don't expect that the MS120 will perform any functions with the OSPF traffic, it's not capable of doing so. But I would expect that it would pass any packet I sent to it to be sent on to the destination port, so long as it's on the same VLAN. Does that not seem reasonable? Well when my ospf neighbor was invisible I started doing packet captures. I can see the OSPF traffic being sent out on from the firewall and from the router on the port that it is connected to. But I never see it show up on the other port. It literally will not pass the OSPF packets between the ports. I mean I understand that this is not an L3 switch, that's fine. But I would expect that it would pass any packet I sent to it to be sent on to the destination port, so long as it's on the same VLAN. I grabbed a cruddy old HP 10/100 off the shelf that is definitely not L3 capable and plugged both into it. Bang up came the OSPF traffic. What gives, Meraki? It seems to me that you are intentionally are stripping routing packets. I don't expect you to perform any L3 functions, but I do expect you to pass on the traffic if it's on the same VLAN, regardless of what's in the packet. If I set up two ports on the same L2 VLAN, I expect all traffic on the ports to be passed regardless of what switch series it's in. Anyway, in the end, I created an isolated L2 VLAN on a MS250 in the adjacent rack and plugged the routers and firewalls together that way and it worked. The 100Mbps limitation on the old cruddy HP was not an option, of course. But thanks so much Meraki for turning what should have been a 30 minute task on my Saturday morning into 3 hours of troubleshooting.
... View more
Nov 1 2019
7:17 AM
2 Kudos
You mean there are people that don't maintain a list of static IPs in their environment? 🤣🤣🤣🤣
... View more
Nov 1 2019
7:04 AM
Thanks Nash, that was the sort of feedback that I was looking for, although it makes me a bit sad.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 4727 | Feb 14 2020 1:53 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 1880 | |
| 4 | 4044 | |
| 3 | 9320 | |
| 3 | 13362 | |
| 2 | 7082 |
© 2024 Cisco Systems, Inc.
