Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About BrothersTM
BrothersTM
Getting noticed
Member since Nov 17, 2017
Jul 12 2021
Kudos given to
Community Record
44
Posts
51
Kudos
1
Solution
Badges
Dec 18 2020
5:47 AM
I followed the procedures from this article: https://documentation.meraki.com/MV/Advanced_Configuration/Restricting_Access_to_Cameras#Configuring_Role-based_Camera_Permissions_for_SAML.2FSSO Also, our school district uses G Suite so I then created a SAML app within the Google Admin Console for one click SSO for my Meraki Camera admins. The article below details that process. https://support.google.com/a/answer/7623669?hl=en I use AD groups that map to Google groups via their sync tool. In the assigning of the SAML app, I then assign it to the groups so that I only have to add/remove users from the AD group in order for them to have access to certain cameras.
... View more
Oct 12 2020
5:23 PM
1 Kudo
Finished setting up new SAML camera roles today using G Suite as the IDP. It worked very well. Added the app to users Google waffle by groups for one-click sign in to the Meraki Dashboard. Once caveat though, the Meraki dashboard will only accept a sha1 fingerprint and G Suite only offers up a sha256 fingerprint in a SAML app. The certificate itself can be either, but not the fingerprint. I used a sha calculator off of the one login site to assist in converting the G Suite certificate to a sha1 fingerprint. At that point, the Meraki dashboard accepted my fingerprint and things flowed smoothly.
... View more
Oct 12 2020
5:16 PM
@PhilipDAth is correct on SAML. That would be the easiest way. I just finished setting up some new SAML roles today using G Suite as the IDP. It worked quite well with the new SAML camera roles as well as traditional administrator access.
... View more
Sep 24 2020
1:18 PM
A slight update, I disabled band steering and this seems to have alleviated the repeated association/disassociations for the Lenovo 100e and 300e models. Not sure it is a fix, but at least they are connected steadily.
... View more
Sep 13 2020
1:23 PM
Yes, I have been in front of these devices and watched the wifi connect/disconnect repeatedly about every 20-30 seconds. I have some of both of the gen1 and gen2 100e's.
... View more
Sep 13 2020
7:15 AM
Yes! I have been seeing this issue as well. I have MR32s in classrooms with a mix of makes and models of chromebooks throughout our district. I never see the issue on our Dell chromebooks or windows laptops...only on the new Lenovo 100e's that we just put out. When you look at the AP in dashboard and its failed connections you see a lot of "bad password" connection fails. This can't be correct either because it's the same pw for all chrome devices coming from the Google Admin Console. Also, it's the same password for the windows devices. I did downgrade to 26.8.1 and the next day I still saw the issue.
... View more
Feb 12 2020
9:39 AM
Just curious...if you disable mDNS/LLMNR via GPO as the post at: https://www.blackhillsinfosec.com/how-to-disable-llmnr-why-you-want-to/ shows, will clients in the Meraki Dashboard update themselves to their correct netbios hostname instead of using the mDNS name?
... View more
Oct 29 2019
10:21 AM
I'm late to this conversation, but over the summer I upgraded our 2008 R2 domain controllers to 2019. Since then, in dashboard the detailed hostnames do not show up any longer. All device hostnames showed up prior. I have my network in dashboard configured to collected detailed info, but the hostname visibility option is no longer there as stated in some documentation...which I guess is dated at this point. Is this an issue within dashboard or in the 2019 DC upgrade?
... View more
Jul 11 2019
1:49 PM
My initial install experience with the MV21 and MV71 models went quite well (2 years ago). They have the built-in dropped ceiling grid mounting as an option for the indoor MV21. I'm finding out that the newer models do not have this option. I'm curious what methods have some of you come up with for the new models being mounted to a drop ceiling. I'm considering adding wood above the ceiling tile for support. What suggestions do some of you have that have encountered this? Thanks.
... View more
Jul 20 2018
7:23 AM
2 Kudos
Thanks kindly. Hope the video helped others in some way or another. I know I enjoyed and learned from the other postings as well.
... View more
Jul 11 2018
11:08 AM
15 Kudos
Switch port tagging in 2 minutes flat. Huge time saver for me. It's a bit rushed, but maybe you get the idea. I tag all of my ports initially with default tags of "empty", "odd", and "even". I also further disable all of the ports. I then clone this config to all of the other switches of the same model...48 port to 48 port and 24 port to 24 port. Then once I know what will be plugged where, I add more tags such as "data", "wifi", "cam", "sfp", "voip", etc. Also, as I add those tags I remove the empty tag and enable the port. Once all ports in the entire network have been tagged. Then using the switch ports page, I search for a single tag...select all...and edit a single time for all of those ports whether it's 10 or 10,000. I repeat for the remaining tags.
... View more
Jun 19 2018
5:58 PM
I also use Screencastify. Simple and does the job...for free.
... View more
Jun 19 2018
11:26 AM
17 Kudos
Switch port tagging in 2 minutes flat. Huge time saver for me. It's a bit rushed, but maybe you get the idea. I tag all of my ports initially with default tags of "empty", "odd", and "even". I also further disable all of the ports. I then clone this config to all of the other switches of the same model...48 port to 48 port and 24 port to 24 port. Then once I know what will be plugged where, I add more tags such as "data", "wifi", "cam", "sfp", "voip", etc. Also, as I add those tags I remove the empty tag and enable the port. Once all ports in the entire network have been tagged. Then using the switch ports page, I search for a single tag...select all...and edit a single time for all of those ports whether it's 10 or 10,000. I repeat for the remaining tags.
... View more
Mar 2 2018
8:57 AM
I have used it before and it does work, but just as MS states, at times the client will ignore the response. That's why MS prefers use of IP helpers/relays.
... View more
Mar 2 2018
8:56 AM
When using the AD user auth with RADIUS for BYOD purposes (which is what I do), you can add further RADIUS attributes and tie those to Meraki Group Polices for advanced functionality (multiple vlans, firewall rules, bandwidth shaping, etc.) all behind a single SSID. Just make your filter-id match the name of a Meraki group policy.
... View more
Mar 2 2018
8:18 AM
Thanks. I've read that article before too. It's a good read. Exactly why I'd like to see a helper option added when running a DHCP server on an interface. Currently, you can only run one or the other....server or relay.
... View more
Mar 2 2018
7:35 AM
Thanks, but I may not have explained it well enough. You are correct, that's all you have to do in order to add a dhcp server ONLY to an interface, but I also need that interface to forward DHCP packets using a relay/helper to the PXE/WDS server. Basically the first option and the second option built into the first option as an additional drop down. But you can only choose one or the other.
... View more
Mar 2 2018
7:20 AM
Like I said, it solves most edu issues and is easy to manage. It isn't for everyone, but it works here and works well. Thanks for the comments though.
... View more
Mar 2 2018
7:09 AM
It's no trouble at all. It's far better than left wide open and then also, not all devices will support certs. Take for example HVAC monitoring equipment. For the most part, it is pretty tight security for most users and simply prevents most unauthorized access in an education environment. Do you manage an education environment and its users? If not, it's quite different than managing a corporate environment. It's proven to be very effective for this environment.
... View more
Mar 2 2018
6:47 AM
Currently my DHCP server is a role added to a server. I'd like to get DHCP down to the L3 switch at each site. The problem I have is with my wired interfaces at each school site (not the BOE since the WDS/PXE server is on the same subnet and already hear's the DHCP requests on that subnet), I can't run a DHCP server on an interface and also forward those DHCP packets to the PXE server using an IP helper/relay. Current setup is that interface is set to relay to the server ip that has the role added as well as the WDS/PXE server. Works great, but I would like to get DHCP off the server and onto my Meraki L3 at each school site. I've added this feature as a wish. If you don't mind, please submit a wish in your dashboard for the ability to add a DHCP server to an interface, but also forward those DHCP packets to another server using an IP helper/relay for the main purpose of PXE booting images across the WAN to a WDS server. I know this can also be done using DHCP options 66/67, but it is not the recommended practice by MS when using WDS for deploying images. The preferred method is to use the IP helper/relay option on that particular interface. Thanks for taking the time to make the wish and hopefully it'll get added soon. One more little drop down and a text field for entering IP addresses couldn't be that hard for the great minds at Meraki to add.
... View more
Mar 2 2018
6:37 AM
I should add too that I have two NPS proxies (one is for failover) for load balancing RADIUS requests. The proxy sends over the requests to my AD servers with the RADIUS role added at a 34%, 33%, 33% rate. So in theory, each server gets 1 out of every 3 RADIUS requests to process. Seemed like a good idea to try and also plan for future growth. I also just wanted to see if I could do it. Seems to work well.
... View more
Mar 2 2018
6:33 AM
1 Kudo
I have MAC based port authentication using RADIUS working well. I used a few Meraki articles as well as MS technets. I have mine working as a wired policy on the RADIUS servers saying...if you're wired and a member of "this" AD group, then you can connect in full. If not, no connection whatsoever. Initially I had all ports open and exported out the bulk of our wired devices while viewing clients filtered by my wired vlan. I stripped out all but the MACs and then removed colons and made everything lowercase using Excel tools. Then using my AD management software (pitch for Dovestones Active Directory Bulk Users....buy the toolkit...you'll be glad you did!!!) I then uploaded via csv all our clients with the MAC as the username and password. I also filled in some other AD fields just for identification. I add new gear in the same manner. All my wired ports have the MAC based policy applied to them and once a client is a member of the AD group...bam...connects. I'll try to list the articles below. If you need screenshots of the RADIUS setup, just let me know and I can provide that too. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197433(v=ws.10) https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772591(v=ws.10) https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725658(v=ws.10) https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc730866(v=ws.10) https://documentation.meraki.com/MR/Encryption_and_Authentication/Creating_an_NPS_Policy_for_MAC-based_Authentication https://documentation.meraki.com/MS/Access_Control/Configuring_802.1X_Access_Policies_on_MS_Switches_using_Windows_2008_NPS
... View more
Mar 1 2018
7:17 AM
Try contacting support and see if they can enable that feature for you. Just a thought. Or if you left them DHCP, then you could just add the DNS servers of choice to that DHCP scope.
... View more
Mar 1 2018
6:42 AM
You should be able to change your dashboard back to the older version by viewing your ap's and then clicking "view old version" in top right. Then use the select all feature. Then, assign an ip address range to all as well as set DNS servers in mass. Change back to "new version".
... View more
Kudos given to
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 13001 | Dec 5 2017 7:38 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 17 | 19660 | |
| 15 | 7640 | |
| 5 | 69918 | |
| 3 | 13001 | |
| 2 | 2648 |
© 2024 Cisco Systems, Inc.
