Meraki

rhbirkelund

I think you are mixing the two Client VPN functionalities. Cisco Anyconnect/Secure Client can not be used for L2TP. Meraki Client VPN uses L2TP, and it usually something you configure directly in Windows. If you wan't to use Cisco Secure Client (Anyconnect) you need to conifugre that on the Meraki Dashboard, and not Client VPN.

rhbirkelund

A case open since 2022, and support still won't answer? Tried getting an SE to push for an answer?

rhbirkelund

You will still require MR licenses, to continue use of Meraki Access Points and manage them in the dashboard. There is no console on Meraki - management is only available through the Cloud-based Meraki Dashboard. You will also need to ensure that the new Firewall allows all communication to the Meraki Cloud for your APs to continue to function. You can see the required firewall openings in the Dashboard by clicking on the Help Button and Firewall Info.

rhbirkelund

Is it a third party supplier that has been installing the CCTV cameras? In my experience, these third parties tend to either configure the NVR to hand out DHCP addresses to their cameras or that the cameras are statically configured with an IP address. They also tend to supply their own unmanaged swtiching infrastructure. which they uplink the camearas to, which may also be connected upstream to the rest of the network infrastructure.

rhbirkelund

Is that MX behind a Firepower by any chance?

rhbirkelund

While I rarely use it, setting all branches to Hub is essentially configuring a Full Mesh AutoVPN topology. It’s one of the Meraki deployment models, and there’s nothing unusual about it.

rhbirkelund

This ought to be possible using a combination of local L3 rules on the MX and S2S VPN FW rules. On each site you'd have to separate the networks in Vlans on the MX. Then you'll have to create a FW rule per MX that denies traffic between the two vlans, within each site. E.g. if site A uses 10.10.1.0/24 for prod, and 10.20.1.0/24, then you'd define a fw rule that denies traffic from 10.10.1.0/24 to 10.20.1.0/24 and vice versa. Then you'll have to create a rule on on Site-to-Site VPN Firewall rules which denies all traffic between 10.10.0.0/16 and 10.20.0.0/16, and one vice-versa. The rules per MX allows separation between the Vlan per site, and the S2S rules should allow for sepearation between the Prod and HA supernets.

rhbirkelund

https://community.meraki.com/t5/Dashboard-Administration/dashboard-meraki-com-down/m-p/254700 A known issue. Keep and eye on status.meraki.net for updates.

rhbirkelund

It doesn't look like there's any battery packs that are able to provide the required input power for a Z4C. I think your best bet would be to get an inverter and 12V battery, and use the power supply that comes with the teleworker.

rhbirkelund

If I want to change the allow list on e.g. the NM-4C module, I can't just change it. I need to reduce the allow list on all modules, to for example 1-10, before I can change the allow list to what I need on the NM-4C module which is infact installed, unlike the other modules.

rhbirkelund

rhbirkelund

I use Python for my scripts. Meraki has a published Python Library, which works wonders. I am not aware of any .NET implementation of Meraki, but if .NET has support for restful APIs it should not be a problem to use it. But then again I have no experience with .NET so I wouldn't be able to say for sure.

rhbirkelund

I think maybe that my greatest annoyance with this switch is the fact that for those C9300s where it supports an NM module, to change to vlan allow list you need to select all NM types and change on them. Not just the NM that is currently installed in the switch..

rhbirkelund

Configure Split Tunneling like shown in the screen shot and add 0.0.0.0/32 to the list. This should provide local access to printers, while still being on VPN. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Local_LAN_access

rhbirkelund

In my opinion you should push back on the requirement to provide one SSID per dorm room. This will resullt in a very poor Wireless network experience due to the many SSIDs wasting airtime. It is up there right next to "APs in the hallways for dorms/hotels". As mentionend, I think you should look into using WPN for the deployment.

rhbirkelund

Thanks for the contribution! 😄

rhbirkelund

If it is because you need to separate each student in their own network, without them being able to reach eachother over the network, I think you should probably look in to using WiFi Personal Network - WPN. Essentially it's iPSK, where you create one SSID, and assign different group policies according to which PSK is being used.

rhbirkelund

Why exactly do you need to create 50 SSIDs, one per dorm room? Why does each room need to have their own?

rhbirkelund

https://documentation.meraki.com/MX/MX_Overviews_and_Specifications/MX67_and_MX68_Datasheet

rhbirkelund

Just some Apple shortcuts made by Adrian. https://www.intuitibits.com/2023/09/21/yet-another-wi-fi-details-shortcut-for-ios/

rhbirkelund

The formatting in your script is messed up a bit. Could you perhaps use the code block, and add your script there?

rhbirkelund

You may want to connect the Camera with a wired connection first and leave it for about 30 mins or so, to ensure it has upgraded, pulled config and wireless profile. Afterwards, you should be able to install it with the wireless connection, assuming there is adequate wireless coverage.

rhbirkelund

No, if the switch is born in Meraki persona, you’ll have to boot it up, and contact Meraki support, to have them initiate the conversion process.

rhbirkelund

I’m rather certain that AT&T has a roaming agreement with danish ISPs. So I would suppose that it will connect anyway, eventhough it is using a different ISP? I haven’t had an opportunity to mess with a MG52 yet, though. So I can’t say for certain.

rhbirkelund · ‎Oct 31 2024

Congratulations, @cmr . You deserve it. 🙂

About rhbirkelund

rhbirkelund

Community Record

Badges