Meraki

ToryDav · ‎Jul 13 2022

@PhilipDAth Has there been any update on this? I am looking for a way to stamp out vMX in Azure and was thinking Terraform also. Are there any other options?

ToryDav · ‎Jul 11 2022

absolutely nothing! As if the sign-in doesn't even occur. We rebuilt the SSO app and it is working again. So I will have them test for a period of time and see if the issue comes back around..

BenjaminN · ‎Jun 15 2022

This did the trick for one of our client too.

LeonardoSouza · ‎Jun 8 2022

Thanks you all for the help too! Also, it can happen that we need to disable IPV6. After long time struggling and trying out several options, just disabling ipv6 it worked for me. https://pandapow.io/how-to/win-disable-ipv6/ Cheers

OVERKILL · ‎May 20 2022

I'm wondering if it has to do with the 13:38:08 entry with peer port 48571. If that is also not getting forwarded, I suspect traffic can't get through and the connection is dropped.

ToryDav · ‎Mar 29 2022

Hi @MarcP, Yes I agree with you. I didn't design or implement this setup, just dealing with the effects of it. This particular organization has like 70-ish sites. So templated deployment made sense at the time I'm sure, but this limitation wasn't taken into consideration. I am working on some work arounds for them to resolve this. Where there are two or more stacks, the "Core" stack will need to be moved to a separate network. Where there is one stack, I can increase the "access" standalone switches to priority 61440 on the template and this will allow the stack with the default 32768 priority to be root. Where there are NO stacks, there is no issue. The more I work with config templates, the less inclined I am to ever use them in a deployment in the future, to your point, why even bother.

CptnCrnch · ‎Mar 24 2022

Exactly. In VPN concentrator mode, only WAN 1 is useable.

sungod · ‎Feb 25 2022

We saw API failures between 0100-0200 UTC on both USA and EU hosted organizations. Seemed to be transient, only a couple of API calls failed hard enough for our system to give up on back-off/retry.

PhilipDAth · ‎Feb 21 2022

It looks like others have already said this, but you mention the standard 802.1w. Meraki complies with the "letter of the law" to this standard. The standard does not allow for per VLAN instances. Some vendors, such as Cisco on its Catalyst line, decided to deviate from the standard in this area, and they are in fact the ones that are non-compliant. As you have mentioned, use MSTP in this mixed vendor case.

ToryDav · ‎Feb 21 2022

Thanks for the insights here. I will discuss this with them and see if it makes sense to disable, or not.

ToryDav · ‎Feb 16 2022

Well tonight all three sites did cause a brief blip that I suspect is due to the STP configuration changing slightly, and it knocks out some, but not always all switches and they require reboot after the migration. I will update tomorrow on the wireless links, but I do expect some brief outage.

ToryDav · ‎Feb 16 2022

Congratulations all!!

ww · ‎Oct 25 2021

Connections initiated from outside are not allowed. unless you created nat or forwarding rules. Geo blocking can be used with adv sec lic https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings#Geo-IP_Based_Firewalling

ToryDav · ‎Oct 22 2021

I questioned it because there is only one camera showing problems, but shorts show on several ports, and its because or what @cmr pointed out.

ToryDav · ‎Sep 20 2021

Totally! I was pleased to see only 15 minutes drop. That release also fixed all the issues I was seeing.

PhilipDAth · ‎Aug 3 2021

You'll have to configure matching back to back NAT's on the E300.

MeredithW · ‎Jul 7 2021

UDPATE: this contest has ended. Huge thanks to everyone who updated and submitted their new avatars — we thoroughly enjoyed all of your interesting submissions! Congrats to our randomly selected sock winners: @Michael_Venema and @SMontgomery.

Bruce · ‎Jul 1 2021

@ToryDav if you're using MS390 then the requirement around the Management IP are slightly less, have a look in the Layer 3 Interface Caveats listed in this document, https://documentation.meraki.com/MS/Layer_3_Switching/MS_Layer_3_Switching_and_Routing. Also, just be aware that you may end up encountering a few issues with the MS390 devices, they're physically good devices, but the firmware is still a bit raw - you'll probably want to run the latest beta firmware to get the best experience. If you're looking at future proofing, and you're not planning to do anything complex (e.g. no MAC whitelisting, not getting too carried away with 802.1x) for the moment, then you should be fine. If its a critical network (i.e. you can't afford downtime) then I'd seriously consider the MS50 or MS355 switches.

ToryDav · ‎May 20 2021

All, The MX swap went flawlessly. We stood up the MX100 in parallel, put a static IP on it within the local status page and cut over the uplink. I did have to reboot the MX 100 as it didn't reach the dashboard right away. Once it came online all the configuration applied from before, with the exception of the site-to-site VPN. We simply turned on the site-to-site VPN and didn't need to reconfigure it in any way. Our 1:1 NAT didn't work, but rebooting the upstream router cleared its tables and restored connectivity to the webserver behind the NAT. To troubleshoot this I took a PCAP and watched the TCP SYN from my public IP address hit three times and then saw the fast retransmission occur, but we never received any SYN/ACK. Looking at the source and destination MAC addresses, I could see the packet source from the CISCO router upstream, destined for the old MX port 1 MAC address. Rebooted the cache upstream. Thanks, Tory H. Davenport

ToryDav · ‎Feb 23 2021

*Sigh of relief*

GIdenJoe · ‎Feb 11 2021

That person that configured loop guard on endpoint ports does not understand STP. It only makes sense to use BPDU guard on access ports to endpoints. Since I haven't seen any Meraki network using OOB cloud access I have never been able to implement loop guard because dashboard configuration does not allow it.

cmr · ‎Jan 22 2021

As @GreenMan said if you have major traffic found between VLANs then route on the switch, if most traffic is going via the WAN then route on the MX. Having said that, we route all sites on the switches as the only sites we have with fast enough MXs to not be an issue, the majority of traffic is between VLANs... i.e. a site with 355s and 40Gb inter switch links to a blade chassis has MX100s that only route at 750Mb severely limiting throughput...

KarstenI · ‎Jan 13 2021

On my "Help>Firewall Info" page, the field "Destination" is populated with my real RADIUS-server. I think it is taken from the dashboard-config. For the firewall-rules: Traffic to 1812/1813 is always from the NAD to the RADIUS-server, traffic initiated by the RADIUS-server is typically a CoA which runs on port 1700. There is also one situation where this traffic is really "inbound": When the Meraki RADIUS-proxy is used. But I would not use it as long as there is no DTLS support.

PhilipDAth · ‎Jan 11 2021

Yes.

D_Tak · ‎Nov 30 2020

In regards to both of your questions, the switches or the network itself would revert back to whatever previous configuration was configured whether it be the default Meraki configuration or another config. There are no specific "gotchas" to be aware of but there will be downtime when moving the templates for the devices to pull the new configurations and if any subnets are to change if any static devices were programmed they would need to be reprogrammed under the new subnet.

Meraki

Community

About ToryDav

ToryDav

API Early Access Group

Community Record

Badges

Re: Azure VMX Terrraform - AUTOMATION NOW!

Re: Azure AD with SAML SSO Weird Issue (vMX - Anyconnect)

Re: VPN Client Failed

Re: VPN Client to site can not establish

Re: Anyconnect Connection Failures

Re: Configuration Templates, switch profiles and STP root bridge placement.

Re: Meraki MX Load balancing dual wan with port forwarding question

Re: Meraki API did not work for about 1 hour. Why?

Re: IEEE 802.1W (PVST+) implementation on Meraki switches

Re: OSPF and NSF

Re: Considerations around moving APs tied to a configuration template

Re: Revealing Your 2022 Meraki Community All-Stars!

Re: Blocking inbound connection attempts on MX

Re: Meraki Switch Cable Test

Re: MS 390 Strange Behavior

Re: Meraki MX Port Forward Design Question

Re: [CONTEST CLOSED] Update your avatar, win Meraki swag!

Re: MS Switching / MX Campus Design Peer Review

Re: MX 80 to MX 100 Migration

Re: Meraki Switch WAN Breakout

Re: STP LoopGuard on Access Ports

Re: MS-355 Layer 3 pros/cons

Re: Upstream firewall rules

Re: Wireless 802.1X with RADIUS migration questions

Re: Switch Configuration Template Migration

Re: Custom Hostname Cert issues AutoVPN - ZeroSSL

Re: Configuration Templates, switch profiles and STP root bridge placement.

Re: MX 80 to MX 100 Migration

Re: VPN Client to site can not establish

Re: MX 80 to MX 100 Migration

Re: MS 390 Strange Behavior

Re: Community Challenge: Folding@home

Re: Cisco Meraki and DNA-Center Integrations