Meraki

pdeleuw

I am Cisco instructor, teaching the ECMS (besides other courses). I do not know the current question pool. But from my experience with Cisco exams, you will always see questions which are not covered in the course. You should have some pracitcal experience before taking the exam. This is not only the case for the ECMS, but generally applies to all Cisco exams. You can find some hints for preparing the exam in the learningnetwork: https://learningnetwork.cisco.com/s/meraki-solutions One additional point regarding the ECMS: Parts of the content is not included in the student guide. The instructor shows many things using a demo environment. There are no slides for this content. It is not easy for you as student to review this content.

pdeleuw

This is correct. An AP will work in mesh mode, if it has no IP address on it's LAN interface. So one AP has to work as "regular" AP, it will be the gateway. The other AP, just powered up, will recognize that it has no IP address. Then it will connect wireless to a gateway AP. This needs no further configurations, this behavior is programmed in firmware. There is a setting in Network-wide, there you can activate or deactivate meshing. Of course, it must be activated. This is default. The APs will send a hidden SSID for meshing.

pdeleuw · ‎Jan 13 2025

Sorry, I did not do something like this via API. I think the API is a good thing for doing the same job a lot of times. but of course, if setting up the API requests is more time consuming than doing it manually, it is better to do it manually.

pdeleuw · ‎Dec 4 2024

Thank you, Karsten. IDS and IPS have different behaviors. Very new finding for me ...

pdeleuw · ‎Nov 19 2024

It seems that deep links to managed clients are not possible.

GIdenJoe · ‎Nov 18 2024

I can only confirm that this was the behavior I noticed. However it is important to note that this was matching traffic by regular L3/4 rules, not the L7 application layer detection. So I cannot guarantee it 100%.

PhilipDAth · ‎Nov 17 2024

When you apply a template the IP address and DHCP settings are lost. So first make a note of the IP address and DHCP settings, apply the template, and then restore the original IP address and DHCP settings.

pdeleuw · ‎Nov 15 2024

The AP is not aware of the syslog server and it's reachability.

jmccandles146 · ‎Nov 12 2024

The VPN is now working, there was firewall policies in Mikrotik which had be prioritized( placed on TOP below srcnat(Internet access rule). The traffic is getting back and forth now, thank you for your suggestions.

Khancock · ‎Nov 11 2024

Using Umbrella DNS should give you the built in security for the known bad or malicious sites - that constanly gets updated, but you would not be able to add your own without the Umbrella subscription,

jimmyt234 · ‎Nov 6 2024

Yes - if for whatever reason it doesn't work then you can ring Meraki support for help.

KarstenI · ‎Nov 3 2024

Oh damn, of course, you are right. It is even clearly described in the link I added, but I messed that up. Thanks for the correction.

GreenMan · ‎Oct 31 2024

As CMR suggests, if it's your email, simply change the associated password and check out availability of any 2FA tools. I would recommend SAML too - in fact; user-specific accounts more generally. How would a problematic change be attributable to one admin, if you needed to follow disiplinary (even criminal) processes, if there's no specific accountability?

FeliA · ‎Oct 18 2024

Hello @pdeleuw, Enabling SAML as @Brash mentioned is a potential alternative, however, it is correct that even if 2FA is disabled on a dashboard administrator's account, OTP can still be triggered. This feature is in place for enhanced security, and an option within the dashboard is not available to disable it. Authentication Enhancements and New Dashboard Security Features documentation If you have a very strong or unique use case, I highly recommend reaching out to Meraki Support and providing as much detail as possible to determine if a solution is available that meets your specific use case. Please feel free to link to the documentation provided above when submitting the support case, so that it is clarified that you are referencing wanting to bypass both the 2FA and OTP features for an account. A support case can be opened by navigating to (?) > Get Help & Cases > Pick a Tile to Contact Support > Submit a case or by following the steps provided in the Contact Cisco Meraki Support document here. Best, Feli

Tishman · ‎Sep 5 2024

thanks

miraso · ‎Jun 25 2024

In firmware MX17 and newer, the MX introduced Content Filtering powered by Cisco Talos Intelligence. This allows MX’s Content Filtering feature to classify URLs based on web content and threat categories curated by Cisco Talos.

pdeleuw · ‎Jun 11 2024

"Meraki VPN" ist based on IPsec and L2TP. L2TP has additional overhead. Maybe you have a fragmentation problem? Check the MTU setting on client side. For Auto VPN the MX does Path MTU Discovery. I do not know if this is true for Client VPN, too. It is not possible setting the MTU on the MX manually. You have to contact the support for doing that.

HIT1375 · ‎May 24 2024

I'm having the same issue, it is not something just with you. I'm hearing talk of a possible big back end issue. Let me know if you find anything out. I have a ticket in with support since yesterday. Our network is still working there is nothing in the dashboard however.

JonathanClark · ‎May 23 2024

Thank you very much for this. I see that when you do this, you'll see the static routes appear in the Configure->S2S VPN page. So the process is actually super straightforward. A slight lack of experience there on my behalf.

pdeleuw · ‎May 20 2024

@alemabrahao wrote: instead you have to use 192.0.1.2. Just to clarify: It should be an address from 192.0.2.0/24

pdeleuw · ‎May 20 2024

I do not completely understand your point. Why is it another point of failure? You need a routing device without NAT. NAT excemption would achieve this, I think. You can configure a VLAN interface on the LAN side with one address out of the /29 subnet.

pdeleuw · ‎May 6 2024

That's exactly my result. QUIC traffic is not filtered. If you block UDP/443, you will block DTLS. If somebody wants to establish a DTLS based RA VPN (e. g. AnyConnect) through your firewall, the client has to fall back to TLS.

pdeleuw · ‎May 5 2024

The MX supports Auto VPN, IPsec between MX appliances in one organization IPsec Site-to-Site VPN (IKEv1 or IKEv2) between MX and non-Meraki peers or MX appliances in another organization Client VPN, L2TP with IPsec (IKEv2) Client VPN Anyconnect/Secure Client The MX does not support OpenVPN, Wireguard or other VPN protocols.

KarstenI · ‎Apr 19 2024

So you say I ignore the licenses and just add the devices and one line end-date? I hadn't expected that to work, but okay, at least that is much less work.

pdeleuw · ‎Apr 18 2024

Exactly. I had tested it to verify it. The behaviour is not documented, so I wanted to explore it in detail.

Meraki

Community

About pdeleuw

pdeleuw

Community Record

Badges

Re: New Engineering Cisco Meraki Solutions (ECMS) v1.0

Re: Mesh configuration.

Re: Cloning Configuration?

Re: Intrusion detection and prevention

Re: Deep link does not work as expected

Re: Dual ISP on Hub, single ISP on Spoke-- 2 autoVPN tunnel ?

Re: Implementing Templates

Re: Behavior of MR device when syslog server become unreachable

Re: Site to site VPN ipsec issue in between Mikrotik and Meraki

Re: Umbrella DNS vs Google DNS for DHCP

Re: One company separated in 2 organization MXs licence question

Re: MX HA PAIR || Routed Mode || Does it support Per VLAN HA in LAN

Re: Delete Dashboard Account

Re: Disable 2FA for Admins

Re: Route-based tunnel supported?

Re: URL Filter: WEbroot/Brightcloud or Talos?

Re: Meraki VPN vs AnyConnect

Re: We lost access to sites / companies shared with us.

Re: L3 Switching Effects on S2S VPNs

Re: Guest Wireless does not prompt to login if DNS is changed

Re: MX75 as router with out NAT, so we can use public IP address on LAN sid...

Re: MX content filtering Support for QUIC & TLS 1.3

Re: Meraki MX: Configure OpenVPN?

Re: License Extension

Re: MX18.208 AutoVPN Summarisation Bug

Re: Route-based tunnel supported?

Re: update License to co-termination

Re: Action Batches

Re: One company separated in 2 organization MXs licence question

Re: MX content filtering Support for QUIC & TLS 1.3

Re: MX content filtering Support for QUIC & TLS 1.3

Re: MX content filtering Support for QUIC & TLS 1.3

Re: Action Batches