Meraki

DCooper · ‎Feb 9 2018

@wirednotMade me think a little more about this, we list out "common problems" and limitations in these documents: https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP#Common_Problems https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment .. However, I do not see the other limitations I mentioned above, no 802.11r, k, v, w and limited AirMarshal features. I will have them add that into the documentation.

DCooper · ‎Feb 9 2018

Lee, your designs are always the exception. 🙂 *My opinions aren’t worth much, let’s get that out there.

DCooper · ‎Feb 9 2018

@wirednot Yes, I have experienced multiple “unintended features” , performance issues at high load and no roaming support where I personally (Can’t speak for others) shy away from using NAT mode to my customers. No Airmarshall “Contain on LAN”. I think the only time I have recommended it was a library with low consumption on a guest SSID. In what setting have you deployed this? Other than logging how has your experience been?

DCooper · ‎Feb 8 2018

Do you have other hardware in this network or is it just a switch? I am going to assume you have a combined network per the error :), this API call will not work in a combined network. In a combined network we have individual network ID's for each product, unfortunately we do not give you access to these yet. You will need to call into support with your passcode of the day and ask for the unique switch network ID number. They will send it to you so you can replace it to look something like this https://dashboard.meraki.com/api/v0/networks/N_60854889964xxxxxxx/ <- which is the unique switch ID inside the combined that you will now have access to adding a static route.

DCooper · ‎Feb 8 2018

@JoshVanDeraaWe only support PAP, we will refuse any other method (any CHAP or EAP)

DCooper · ‎Feb 7 2018

Yes sir, your correct on adding the routes. Copy them over.

DCooper · ‎Feb 7 2018

@DannyTaylorThe answer is yes, We can create a multi-point PTP connection. I am not sure how far these sites are but we have several different external antenna's. I typically recommend backhauling on 5ghz and not even using the 2.4. We have a great CVD on this exact design your looking into, i have provided the link below. As @PhilipDAth mentioned we do mesh, the benefit of this is it is built for resiliency not necessarily throughput. The APs will automatically connect with limited configuration on your part and dynamic fail over. The drawback is no matter what MCS rate your shooting for, your going to be capped around 200mbps in the most ideal setup (from my experience). https://documentation.meraki.com/MR/Deployment_Guides/Mesh_Deployment_Guide_(CVD)#Point_to_multi-point_.2F_Multi-point_to_multi-point

DCooper · ‎Feb 7 2018

Something that is overlooked. Using the API doesn't restrict any more or less access, it will just allow you to "mask" that access. For example, if you create a guest ambassador which is about the most restrictive write access you can have, this user will have an API key, all permissions that you would have via logged into the dashboard you would have via the API (assuming there is an API call for those functions they are allowed to do).. You could make a front end web service to your end users that would mask the API key so to that end user never gets their hands on it. Keeping the API key hidden and out of people's hands is vital, if they have access to the key they have access to the permissions to that user/key and could really do some damage if the user had full permissions.

DCooper · ‎Feb 7 2018

Based on your configuration the only thing that should be allowed is one host, that is the 192.168.2.50/32 device. Everything from all sites would be denied so what your seeing is expected behavior. Your using a implicit deny, so you will need to specify every single rule above that implicit deny. When inputting those rules they apply for outbound traffic for all sites, not return traffic so there is no need to add rules for return. You may want to take a different approach and leave the implicit accept and only deny what you want to deny.

DCooper · ‎Feb 7 2018

@OSPF71Can you provide more information as to the point to point. Is is a layer 2 through the PTP private link to your branch office? everything is flat from MX/watchguard to that office or is there routing being done between the sites? If it is L2 like your post is semi-alluding to, your on the right path, if you have L3 your going to need some routes on the MX250. I also assume this site comes back through that private link to get to the internet/services?

DCooper · ‎Feb 5 2018

At the very minimum your going to need two IP addresses to get this to work on both comcast and your WAN. Do you have this? If you can get additional IPs I would recommend getting an additional two per connection. You cabling is also incorrect but without the IPs there is no reason to cable this up. If you can get the IPs it would be best to put a switch between comcast/WAN and the two MX's. If you cannot get this your going to be stuck with a manual failover. Let us know and we can help with the diagram of what it would look like either way.

DCooper · ‎Feb 5 2018

I would open up a case with support. Most likely the IPS/IDS or AMP could be blocking this. A packet capture and internal digging within the MX would need to be done to confirm this. Once they find the culprit as to what is blocking this they can override it to get it to work.

DCooper · ‎Jan 31 2018

@Dark239We have limited support for 3rd party VPN so what your trying to accomplish cannot be done. Our AutoVPN technology is seamless VPN setup and we recommend customers using Meraki to Meraki so you can get Hub/Spoke VPN, SDWAN, AMP, Sourcefire, Content Filtering, ThreatGrid integration, Geo Based firewall and now Meraki Intelligence. Your not going to get those features out of an ASA with firepower. What are you looking for in ASA that the MX doesn't have?

DCooper · ‎Jan 31 2018

Do you have a minimum bit rate set high on your SSID under access control?

DCooper · ‎Jan 31 2018

All features in passthrough are still available. You would have to arrange something like this Users<->switch<->MX<->netgear<-> internet. We are going to pass along VLAN tags and any QOS markings, we don't alter the traffic unless it needs to be blocked per policy. It should work, test it and let us know!

DCooper · ‎Jan 30 2018

@AdoPut them in the same VLAN not separate VLANs.See the document below. Or you could take a different approach and put the MX in passthrough mode (bump on the wire) so you get all of the security features but do not have to use it as a router. Also, Meraki isn't consumer focused so most likely there won't be development around this feature. PC<->MX LAN (Passthrough)MX WAN<-> Netgear. https://documentation.meraki.com/MX-Z/Other_Topics/Universal_Plug_and_Play_(UPnP)_support

DCooper · ‎Jan 30 2018

@AbrahamMunozIf able try upgrading the the latest stable RC and see if the issue persists. I cannot remember when this was fixed but positive your seeing a bug.

DCooper · ‎Jan 30 2018

@AbrahamMunozNot sure what version your on but there was a bug that exhibited the exact behavior in older version of code. Make sure your on the latest GA.

DCooper · ‎Jan 30 2018

We only advertise routes. See here: https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Using_OSPF_to_Advertise_Remote_VPN_Subnets

DCooper · ‎Jan 29 2018

Community, If you haven't seen the Meraki integration with Alexa here are a couple of videos and development/setup guide information around it. Feel free to share any comments or development with the community! Videos https://www.linkedin.com/feed/update/urn:li:activity:6360505361736310785 https://www.youtube.com/watch?v=dfHxSDMS82U https://www.youtube.com/watch?v=N7xOYmCt_ZQ Github https://github.com/meraki/alexa-skill?lipi=urn%3Ali%3Apage%3Ad_flagship3_detail_base%3BW9AmY7IJTgWNTQ3FC74Yvw%3D%3D

DCooper · ‎Jan 25 2018

Either design should work, the second design is more optimal so stick with that. Do you have egress security on the firewall southbound in your sandwich DMZ? I have a hunch that is blocking traffic, You’ll know if it still doesn’t work, take a look at the logs. @PhilipDAth FWIW-We are told that that AutoVPN LAN termination feature only works from MX to MX.

DCooper · ‎Jan 24 2018

@CHAadmin You could enable netflow and collect web traffic via Syslog. Both would provide granularity your looking for. This is making the assumption you remove the NAT mode. This would of allowed you to map back the time period in the email headers to who was on gmail at that given time. Wouldn’t be the silver bullet to finding the culprit but it would allow you to narrow down the computers that were used at that time.

DCooper · ‎Jan 24 2018

Typically (but not always) devices without a fan don't have a MIB or monitoring capabilities, this is industry wide and is a physical limitation not something in software. There are temp alerts on our Meraki MS switches that will come through via syslog/event log, just no way of pulling this information via MIB.

DCooper · ‎Jan 24 2018

Your going to need to get a wifi analyzer tool to track the device down. You have already checked that is isn't on your LAN correct?

DCooper · ‎Jan 23 2018

Yes sir, leave that unchecked to stay protected.

About DCooper

DCooper

Community Record

Badges