Meraki

jdsilva · ‎Oct 31 2018

Nope. I've never heard of this happening on any of our MX64's (the vast majority of which are on a cable internet service). I'd say make sure your on a Wired 14 version with the MX first, and if that doesn't help then I'd be looking at your ISP.

jdsilva · ‎Oct 31 2018

The MS120 isn't a layer 3 switch, and it has no support for PPPoE. You would need an MX Security Appliance which does support PPPoE for this.

jdsilva · ‎Oct 31 2018

Hi @Homerdan, Yes, you need Meraki at all locations you wish to deploy SD-WAN at. That is the same for every vendor's SD-WAN product out there. Not a single one has any interoperability with another. If you place both MX64's at one location then all you can leverage is Warm Spare and failover between ISPs,

jdsilva · ‎Oct 31 2018

The cases page is a mess. It's been problematic for me for ages. Every time the fix one thing another thing breaks. Luckily, creating cases isn't one of the problem I have.

jdsilva · ‎Oct 31 2018

Hey @Pugmiester, The first thing you should do is remove the dedicated cable between the MXes, That thing has been proven to cause issues with Warm Spare and Meraki had removed it from their best practices. https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Recommended_Topologies Once you're more in line with one of those topologies then next would be to check your STP Root is set correctly so that when you fail over all ports facing the Secondary aren't blocked.

jdsilva · ‎Oct 30 2018

@BlakeRichardson Do you think that's a NZ thing? I've never encountered that, and I've done a healthy amount of work travel in the last 10 years covering most provinces here in Canada. I can't think of once I've ever had my VPN blocked... Though I'm not sure I've had an IPsec VPN for work in a very long time. Maybe it's an IPsec vs SSL thing? I remember "back in the old days" NAT-T wasn't always automatic which caused all kinds of issues. Anyway, none of this is helping the OP. I'll end my ranting 🙂

jdsilva · ‎Oct 30 2018

Hotels block VPN? Really? As someone who has traveled all over my home country, numerous times, for work, I have never encountered that. It never occurred to me that could possibly be a thing. I would suggest your company deals with a hotel chain that is more friendly to business travelers. And provide feedback to those hotels you encounter that block this. In my mind that's totally unacceptable.

jdsilva · ‎Oct 30 2018

Yup, this would work just fine. The caveat would be that is WAN2 fails you won't be able to stop your specific VLAN from using WAN1 in the event that WAN2 fails.

jdsilva · ‎Oct 29 2018

@PhilipDAth wrote: You could possibly use the GPDR data privacy feature. https://documentation.meraki.com/zGeneral_Administration/Privacy_and_Security/Meraki_Data_Privacy_and_Protection_Features Hey, that's a neat idea. I might have to try that.

jdsilva · ‎Oct 29 2018

Yup. The other end of that tunnel would be an MX450. Interesting... We don't test Non-Meraki VPN. I wonder if there's something there?

jdsilva · ‎Oct 29 2018

We don't test with iPerf, so I can't comment on that. But with Breaking Point we're pushing just over 200Mbps on an Enterprise license, and about 175Mbps with an Advanced license through a VPN on an MX67 running 14.34.

jdsilva · ‎Oct 28 2018

Nope. It can do port forwarding via its WAN IP, a 1:1 NAT, or a 1:Many NAT, but it doesn't actually proxy those connections.

jdsilva · ‎Oct 27 2018

Haha I stumbled onto this not too long ago. Put a smile on my face for sure.

jdsilva · ‎Oct 24 2018

Then no. You cannot policy route over LAN interfaces on the MX, nor can you do any policy routing at all on the MS.

jdsilva · ‎Oct 24 2018

You can policy route traffic on the MX under Security appliance > Traffic shaping. I'm assuming you're using AutoVPN to connect to the DC? If so you'd use the VPN Flow Preferences section to define your policy routes. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences

jdsilva · ‎Oct 24 2018

IEEE 802.1s - This is MST, not supported. Meraki switches only do 802.1w (RSTP). IEEE 802.3x - This is Flow Control. I do not believe this is supported (I've never seen it anyway). Check with your Meraki rep. IEEE 802.3 - This is Ethernet. If it's not supported then Meraki has some serious issues... IEEE 802.3u - This is 100Base-TX. Supported. IEEE 802.3ab - This is 1000Base-T. Supported. IEEE 802.3z - This is 1000Base-X. Supported, but check the compatible SFP list. IEEE 802.3az - This is EEE. I'm unsure if this is supported... I can't find anything that says either way. Check with your Meraki rep. IEEE 802.1ax - This is 802.3ad AKA LACP. Supported.

jdsilva · ‎Oct 24 2018

As far as I know there isn't a Phase 1 on AutoVPN. The key exchange part is handled by the Dashboard with keys generated randomly and delivered via the mtunnel to each MX. As for the Phase 2 stuff, Meraki has previously stated AES128, though I have seen some stuff saying they were supposed to be moving to AES256 at some point. I'm not sure where that's at. Meraki does have a Whitepaper on the topic; https://meraki.cisco.com/lib/pdf/meraki_whitepaper_autovpn.pdf But that is a little light on specifics.

jdsilva · ‎Oct 24 2018

@smccloud Ugh! I didn't realize that was a limitation. Thinking about it though, I understand it, but I certainly don't like it. So if this is important to you, then you're going to have to split out the MX into it's own network. You can do this from the Organization overview page. check the checkbox for the combined network, and the hit the "Split Networks" button at the top. BIG FAT DISCLAIMER: I've never actually done this myself, but I know others who have. It might be best for you to test it on a dummy network first, or in a change window . Edit: Haha you removed the picture. But I did see it 🙂

jdsilva · ‎Oct 24 2018

@MacuserJim Nah, I don't think there's a big concern from the description. @smccloud wrote: We do not have any group policies defined at all. If I can accomplish what I want to that way, I can look there too. Unfortunately, the machines I have uploading to Backblaze do not show up in the clients list. Not sure if its due to how our network is setup (VLAN1 runs to a HP ProCurve which then does the rest of the VLANs, and VLAN 20 is a DMZ vlan which runs to a dumb switch). I take that to mean that the ProCurve is the gateway for those VLANs, meaning the MX doesn't see the MACs of the clients, only the IP's @smccloud likely just needs to change the Client Tracking setting on the MX. Unless I'm interpreting that incorrectly?

jdsilva · ‎Oct 24 2018

Looks right to me. Perhaps the Meraki application definition is out of date? I'd say a call to support is in order.

jdsilva · ‎Oct 23 2018

Nope. AutoVPN doesn't have any segmentation capabilities. You could look at tunneling the SSID over the autoVPN to a concentrator at your central site... https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Tunneling_and_Layer_3_Roaming_-_VPN_Concentration_Configuration_Guide That's about all I can think of to get the segmentation you're looking for.

jdsilva · ‎Oct 22 2018

@pstewart wrote: If you go into the port configuration on a switch there are options there that might interest you .. Monitor -> Switch Ports -> Port X -> STP Guard Paul Hi @pstewart, There's no BPDU Filter option in there. Only "guards".

jdsilva · ‎Oct 21 2018

Hey there, Nope, there is no BPDU Filter on a Meraki switch. But you can disable STP completely.

jdsilva · ‎Oct 20 2018

Congrats on the new job! You're gonna leave a big hole here.

jdsilva · ‎Oct 19 2018

@NolanHerring Hah! Neat. I didn't know that. Very cool.

About jdsilva

jdsilva

Community Record

Badges