Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About EricC
EricC
Conversationalist
Member since Sep 9, 2019
Jan 15 2020
Community Record
9
Posts
0
Kudos
0
Solutions
Badges
Dec 29 2019
10:09 AM
To add to the SoCalRacer's post, here's a template of a script I used to create Windows 10 VPN connections. It worked great. First, open a text editor of your choice. Then copy and paste the text below into it: Add-VpnConnection -Name CONNECTIONNAME -ServerAddress VPNHOSTNAMEHERE -AuthenticationMethod Pap -force -L2tpPsk YOURVPNKEYHERE -PassThru -TunnelType L2tp Change the variables CONNECTIONNAME, VPNHOSTNAMEHERE and YOURVPNKEYHERE to what they should be. Example: CONNECTIONNAME: VPN VPNHOSTNAME: my.vpn.com and VPNKE: vpnpassword, the script would look like this: Add-VpnConnection -Name VPN -ServerAddress my.vpn.com -AuthenticationMethod Pap -force -L2tpPsk vpnpassword -PassThru -TunnelType L2tp After you've changed the variables, save the file as a name, with the file extension PS1 at the end. For example, vpn.ps1. Then right click on it, and choose "Run with powershell". NOTE: A lot of text editors will default .txt at the end of the filename. So you may have to rename AFTER you've saved it.
... View more
Dec 28 2019
1:19 AM
Hi Phil, I understand your idea but the problem here I feel is more on the Meraki side. When we had our ASA, I was able to set it up properly to route traffic to and from VPN Clients to Amazon. I would hope the Meraki would be able to do the same thing. Eric
... View more
Dec 27 2019
3:06 PM
Hi Nash, Thanks for the reply. I'm sorry I forgot to include a screenshot, but yes, the 10.0.3.0 client VPN subnet is set to "Yes" under "VPN Participation". I'm also working with Amazon to allow the routing as well. I just added a static route on Amazon's side for 10.0.3.0 and they also responded with this: "You need to summarize the two subnets which are 10.0.0.0/24 and 10.0.3.0/24 into one /16 network for Ex: 10.0.0.0/16 at your end (Meraki). So that 10.0.0.0/16 network under policy on Meraki will accommodate both your local networks instead of putting two separate /24 networks. For example: 10.0.0.0/16 -> 10.128.1.0/24. Summarizing both the networks into a single network is necessary as AWS end point can have only one inbound and outbound security association active. Hence, you having two networks separately inside your policy will cause disconnect for one of the network. Hence summarizing both the networks into one[1]. Therefore, please enter a single 10.0.0.0/16 network under local subnets and remove the two local subnets that you had before. Once making the changes to the policy on Cisco Meraki, bounce the tunnel." However, when I attempt to do that on the Meraki, I receive: The local subnet cannot overlap with the client VPN subnet. Maybe we're at an impasse? It seems a shame that the old ASA could do this, but not the Meraki.
... View more
Dec 27 2019
2:49 PM
Hi Nolan, Thanks for the reply. That's what I'm struggling to figure out as well. WHERE to put the routing statement saying "If you're on 10.0.3.0 subnet and want to go to 10.128.1.0 subnet, go HERE". The Meraki is already doing the routing for that to extent between our Local LAN and the Amazon, but apparently not telling the CLIENT VPN where to go.I've attached a screen shot of the VLAN setting. I tried to add a static route to the Amazon VPN but I get the following message: "The static LAN route subnet 10.128.1.0/24 conflicts with a remote VPN subnet on the non-Meraki peer (10.128.1.0/24)."
... View more
Dec 27 2019
11:49 AM
Hi Nolan, That's the Meraki. It's IP is 10.0.0.1 and it has the VPN tunnel established to Amazon. From there, users on our internal LAN (10.0.0.0/24) can access 10.128.1.0/24. Eric
... View more
Dec 27 2019
9:53 AM
Hi everyone, I'm not sure if this would be a "Split tunnel" issue or what. But here's the setup we have: Internal LAN (Meraki): 10.0.0.0/24 Client VPN: 10.0.3.0/24 Amazon VPN: 10.128.1.0/24 We currently have a Meraki MX64 that provides us with VPN access to our systems on Amazon. Computers on the 10.0.0.0 subnet can access computers on the Amazon 10.128.1.0 subnet. When a VPN client connects to the Meraki, it gets a 10.0.3.0 IP address and can access everything on our internal LAN. However, it can NOT access the devices on the Amazon side, and vice versa. Back on our ASA we used to have routing setup that would allow this. However, I don't see where I can do this on the Meraki. Does anyone have any experience with this? Eric
... View more
Sep 10 2019
3:12 PM
Hi Philip, Thanks for the reply. That's correct. Simple switches, single subnet, Meraki MX64 is the gateway. It's running version 15.16 right now. I've tried it with the stable firmware, release candidate firmware, and now the beta firmware. No changes. Eric
... View more
Sep 10 2019
6:51 AM
Hi Phillip, Thanks for the reply. The answer to your questions is Yes. The Meraki is in gateway mode. The only thing between it and the clients are regular switches. I have the domain controllers setup to audit logins and failures via their local policy. I can see my login in the domain controller security log as well. This is what it shows (edited for security). An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Impersonation Level: Impersonation New Logon: Security ID: XXX\username Account Name: Username Account Domain: Domain Logon ID: 0x1615B078 Logon GUID: {987b0278-4d73-0cbb-d464-e3a8f6b5f794} Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: Correct Source Network Address: Correct IP address. Source Port: 50373 When I look under "Clients" on the Meraki and find my machine, it even shows I've authenticated against Active Directory: Clients › ComputerName Status: currently connected send WOL User: CN=Correct, OU=Correct OU=Correct,DC=Correct,DC=com (Active Directory). In the Meraki event log, I see my domain account repeatedly authenticated as well: Sep 10 09:45:32 VGEPC033 Domain authentication user: Correct Sep 10 09:44:37 VGEPC033 Domain authentication user: Correct Sep 10 09:44:22 VGEPC033 Domain authentication user: Correct Any thoughts?
... View more
Sep 9 2019
10:33 PM
Hi everyone, We have a Meraki MX64 and so far everything is working fine except a policy I'm trying to create. I've opened a ticket support and they've tried to help me, but I guess either I'm not explaining correctly, they don't understand me, or, it can't be done. I'll explain my setup. By default, we block the typical stuff: Adult sites, gaming, proxy and spam sites and so on. We also have a default limit of streaming video to 1MB per client. Basically what I want to do is have an active directory policy that allows all content based on the domain groups that a user. I have the domain controllers in the Meraki configuration and they get green check marks. I can see the LDAP groups. I created a policy called "Allow all" and applied it to the LDAP groups. However, the content is still being blocked, and streaming is still limited to 1mb. I've attached a screenshot of the "Allow all" policy I have. I imagine it's something simple I'm missing, but I simply can't figure a way around it. I've been on the phone with Meraki technical support several times over the last week for at least 2 hours at a time. I've done everything they've wanted from delete and re-create policies, to delete and re-add the domain controllers, factory reset the Meraki, reload the firmware, you name it. One thing that confuses me is under the group policy setting. I notice under "Blocked Website categories", you can't choose "Ignore" like you can the rest of the categories. You can only override or append. What if you don't want to block ANY? I tried using *, and *.* in the white list URL pattern but that doesn't. I've changed the Block Defaults to every choice available as well. Am I missing something here? Thank you in advance. Eric
... View more
© 2024 Cisco Systems, Inc.
