Meraki

AlexGregoire · ‎Dec 19 2023

Security & SD-Wan->Configure->DHCP

AlexGregoire · ‎Dec 19 2023

How does a Meraki security appliance choose the DNS server it contacts for a DHCP client request? Is it round-robin, random selection, or list of priority? An F5 network does/can do an order of precedence; most industry systems do round-robin by default. I'm toying with the idea of adding a public DNS server to the list of private ones we use for our split VPN tunnel campus hub-and-spoke organization. If the tunnel goes down, all DNS is currently lost; if a public server is at the end of the list, at least clients can get to the public Internet even if the hub campus is inaccessible. But we don't want DHCP clients to lose every 1 out of 4 DNS requests for a private campus service because 1 out of the 4 DNS servers doesn't have the right private IP information.

AlexGregoire · ‎Apr 21 2022

Oh, no, campus pc has a wholly different gateway than concentrator. As I'm the WAN engineer, that's the campus LAN guys' responsibility - and in the past it did work. The new VPN WAN does not. And all the IPs changed with the new system...So I need to have the LAN guys modify static rules on campus. ETA - No, wait, that's fine - I can see that packet go from me, to building router, to (my) VPN hub - and then it drops out. Its got to be a rule I've missed. If it was the internal LAN here, it'd drop when it hits the building router.

AlexGregoire · ‎Apr 21 2022

So I've got 50-some spoke networks, all going back to the hub network, split-tunnelling traffic for main campus & internet traffic. Everything works great from spoke to hub. But something is wrong when trying to contact devices on spoke networks from the hub (main) network - example: printer in the middle of Idaho can email the mailserver in Montana at the headquarters with a scan-to-email message, and then the spoke destination workstation gets the email. But I can't manage the printer remotely via IP & web interface from the Montana headquarters! Pings and traces all stop at the campus LAN MX device IP. VPN status page says both ends of the network are exported. VPN Configuration page says all local networks are enabled for VPN mode. I've checked & proofread the subnetting on both sides of the tunnel. I'm barely running any layer 3 firewall rules. Help me from my own stupid, please. I'm sure I've just missed a step.

AlexGregoire · ‎Oct 28 2020

If the AP can't connect to Meraki with the static IP it should fall back to DHCP DHCP is on in the subnet - we just don't use it for the infrastructure equipment. It's a unified Meraki network - router-switches-APs, and the DHCP table is straightforward, doesn't have any reservations or other settings. By what you said, it ought to work.

AlexGregoire · ‎Oct 28 2020

I'm 99% sure I'm stuck unless someone manually resets the MR45 WAP - but I'm making sure. I've reassigned an AP to a new network after the old one was closed down. The AP used (and will use) a self-assigned static IP. The new network is using different subnetting, going from 192.168.120.0/24 to 192.168.167.0/24. So the AP can't call out in the new network, and doesn't have any provision for a recovery mode DHCP pickup. Am i stuck? This thing is 150 miles away and 14 feet in the air.

AlexGregoire · ‎Jul 12 2019

Hello, I'm here as Alex. I'm a network engineer for a rural governmental partnership with over a 100 local offices spread across my district. I'm administrate the entire WAN from end user to the home campus border. As the sole networking specialist; in one day I can be called to troubleshoot a WAN connection, plan a new building addition's communications wiring, enforce wireless usage standards, and install an unplanned cloud-based phone. And each office is different. We've been using Cisco VPN to connect the branch offices to the home campus - we're switching to Meraki because I frankly don't have enough time to admin a Cisco system, and we need a system that my colleagues can access and make changes to that's fault-tolerant, flexible, and easily understood. As I write this, we've put a handful offices on the system, and we're ironing the last of the beta bugs. A fun fact . . I have a degree in art. So don't be surprised that I prefer to do my documentation in visuals.

AlexGregoire · ‎Jul 10 2019

The 2nd network's admin (a contractor) says that while the SonicWall can do VLANs, they're not configured for it. I confirmed the static LAN IP and their static routing is still 192.168.0.135 as before with the Cisco, so using the same settings on Meraki should work. <br>Troubleshooting late yesterday he attempted to sidestep the VLAN tagging issue by making a VLAN 2 on his router with the subnet 192.168.1.0/24, bridge interface IP 192.168.1.135, and having it static route everything from 192.168.0.0/24 both ways, leaving the original network unchanged and un-disrupted. Still no joy.

AlexGregoire · ‎Jul 9 2019

The 1841 was used only for our network, LAN 10.0.0.0. Clients on their network, 192,168.0.0., could print to 10.0.0.0 printers.

AlexGregoire · ‎Jul 9 2019

"they" = I'm assuming this is the bridging port from our network to theirs. Which is yes, the bridging port is set to VLAN 2. Or does every port that services a 10.0.0.0 client who needs access to the file server in 192.168.0.0 needs to be set to VLAN 2 as the native?

AlexGregoire · ‎Jul 9 2019

I have branch office using a 10.0.0.0/24 LAN subnet with a Meraki MX appliance. The LAN connects back to the home office on VPN and everything works great. The problem is that they share physical space with a cooperative 2nd office that I'm not the admin of, and the two offices share printers and a local NAS file server. The 2nd network is a SonicWall on a flat network LAN of 192.168.0.0/24 with no VLANs defined. The previous Cisco 1841 router simply did this to make it work: interface FastEthernet0/0 description 2ND LAN Interface ip address 192.168.0.135 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip virtual-reassembly duplex auto speed auto I've tried defining the 2nd network as VLAN 2 with the correct LAN & same IP, verified the physical port connection, made sure the port is trunking, but no joy. I've got to be missing an obvious solution here because it's not supposed to be this hard. (or so I'm told)

Meraki

Community

About AlexGregoire

AlexGregoire

Community Record

Badges

Re: DNS resolution question for DHCP clients

DNS resolution question for DHCP clients

Re: Auto VPN - why is the street one-way?

Auto VPN - why is the street one-way?

Re: Reassigned MR45 to new network, will not fetch new config

Reassigned MR45 to new network, will not fetch new config

Re: Welcome! Please introduce yourself.

Re: Shared Network dilemma

Re: Shared Network dilemma

Re: Shared Network dilemma

Shared Network dilemma

Re: Welcome! Please introduce yourself.

Re: DNS resolution question for DHCP clients

Re: Shared Network dilemma