Meraki

rhbirkelund

I think I remember that it is a bug. There was another thread about it some weeks ago. The doc also explicably says that it’s not present for read- and monitor-only users.

rhbirkelund

Where do you see that read-only and monitor-only users can do pcaps?

rhbirkelund

Sparked my curiosity as well. o.O

rhbirkelund

If you need detailed information about the MTBF, I think you'll need to reach out to your Meraki AM or open a case with Meraki Support.

rhbirkelund

Do a PCAP and check the Beacon Frame. IE 221 should tell you that it's enabled.

rhbirkelund

PXE boot across the WAN? Is that a thing?

rhbirkelund

If migrating the site to Meraki, in order to leverage AutoVPN isn't an option, you could use an MX as a termination point of the Non-Meraki VPN, and route that, statically or dynamically, into the rest of your Meraki topology. It would require you to buy another MX and create a "Gateway" network, which function as the entry point between AutoVPN and Non-Meraki VPN.

rhbirkelund

You will likely need to engage Meraki Support. in order to convert the switch from Cloud Configuration to Device Configuration ( => Meraki to Catalyst).

rhbirkelund

Besides what @Mloraditch says about verifying with Support whether or not 6 GHz is supported on Meraki in Indonesia, make sure to also configure your SSID correctly for 6 GHz. The AP will not broadcast it in 6 GHz if it is configured incorrectly. Make sure you are using WPA3 and 11w is set to Enabled to Required. Also make sure that the SSID is checked for 6 GHz in the Radio Profile.

rhbirkelund

Genereally speaking. any switch that supports RADIUS is compatible with ISE. It depends on which features you intend to be using. Do you need Downloadable ACLs? Then there are certain limitations.

rhbirkelund

🤣

rhbirkelund

Without argueing whether or not something is off in AirMarshall, often people tend to confuse dB witth dBm (or dBW or any other measurement). Decibel, or dB are generally just a measurement of ratio, or gain as @alemabrahao also notes. When we talk about a change in 10 dB, this refers to a change in order of magnitude, while 3 dB is a change in 2's +3dB is times 2, while -3 dB is times 0.5). When we talk about dBm, this is a measurement of change in decibels in reference to milliwatts. If the reference point it watts, it'll be dBW. Honestly, showing neighbors or rogues seen by own Access Points with a measurement of dB, doens't really make sense to me. A measurement of 137 dB could be a lot - but it could also be insignificant. It depends on the frame of reference. 137 dBf, and no one bats an eye. 137 dBW, and you're cooked. Well done, even.

rhbirkelund

https://community.meraki.com/t5/Feature-Announcements/Credit-Hub-Unlock-IoT-Outcomes-with-Meraki-Advanced-Wireless/ba-p/283920

rhbirkelund

I wonder how long it’s been there. 🤣

rhbirkelund

This must be it!

rhbirkelund

From Wikipedia, we can learn the following of the letter R, R, or r, is the eighteenth letter of the Latin alphabet, used in the modern English alphabet, the alphabets of other western European languages and others worldwide. Its name in English is ar (pronounced /ˈɑːr/ ⓘ), plural ars.[1] The letter ⟨r⟩ is the eighth most common letter in English and the fourth-most common consonant, after ⟨t⟩, ⟨n⟩, and ⟨s⟩.[2] I know times are tough at the moment. But in case Cisco is struggling, I'd be more than happy to donate some Rs. Here are a couple, but use them wisely - RRRRRrrrrrr.

rhbirkelund

From what I can tell, based on your description, that topology is not one that is compatible with Meraki. Meraki does not support VRFs, and without VRFs you can not do overlapping ip subnets on the Meraki MX, as it will be unable to distinguish between the VRFs. I am not that much into VRF and MPLS VPNs, but perhaps you can do a transit VLAN for the Meraki, and on the C9300L do NAT'ing between the transit VLAN in the GRT and specific VRFs with routeleaking? Regardless, I'd reach out to my Meraki SE, and have a chat with them on what's possible, if it were me.

rhbirkelund

That should be possible. Usually I go with 8443. The users will have to explicitly enter the port when using VPN, if you change it to something different from 443. E.g. they'ææ have to enter vpn.acme.org:8443 in the VPN client. Also, if they have a certain VPN profile installed on their computers, that'll have to change aswell. But, other than that, it should be Okay.

rhbirkelund

I am not sure if you can forward 443 to your nginx server if it is also being used for VPN. You could try and see if the MX picks up the VPN, before forwarding traffic to nginx. Otherwise you'll need to change the AnyConnect VPN port to something other than 443. This can be done on the Client VPN page.

rhbirkelund

Updating the DNS A record to the new WAN IP of the MX75 should be enough. Remember, if you have MX'es in Warm Spare, you'll need to sign a certificate for the Spare MX as well, since it is device specific.

rhbirkelund

"less than the time it takes for your switch to reboot" - Meraki switch or Catalyst? 😉

rhbirkelund

Single-Client throughput testing isn't really a valid way of testing whether or not you are able to achieve whatever speed you're testing. Instead you might want to try and do speedtests with multiple clients simultanously, and aggregate the results. Also you may want to test the uplink speeds by ensuring that all NGFW features are disabled (Content Filtering, IDS/IPS, AMP, etc).

rhbirkelund

Is it only on smartphones, that the block message does not appear?

rhbirkelund

At this time, only EntraID is supported. Other IdPs should be roadmapped for support. For an ETA you might want to reach out to your Meraki AM.

rhbirkelund

If you use Objects and Object Groups, it'll be a bit more complex, as you'll have to keep track of the IDs, assuming you'll be moving rules between organizations. It it's between networks within the same organization, it shouldn't be much difficult, other than you'll need to keep track of the source networks. If I remember correctly, the source ip network, needs to exist in the Meraki Network for it to work.

About rhbirkelund

rhbirkelund

Community Record

Badges