Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Announcer
Announcer
Getting noticed
Member since Dec 5, 2017
Aug 20 2024
Kudos from
Community Record
67
Posts
18
Kudos
1
Solution
Badges
Jun 4 2024
12:19 PM
Thanks, the corp ssid makes sense, yes. If I create a group policy for the corporate VLAN, will it stop processing the firewall rules from the MX?
... View more
Jun 4 2024
11:29 AM
I want only devices on the guest wifi to access Spotify because this network is throttled. I do not want Spotify open on the corporate wifi or corporate network as it's not throttled. How would I do this? I have one guest wifi, one corporate wifi, and corporate LAN Thanks!
... View more
Feb 16 2024
3:05 PM
Thankyou, but what will prevent the client from receiving a .100 address (main scope) and not a .150 address (new scope)? I guess it gets it from the vlan interface IP when I created the vlan in the MX?
... View more
Feb 16 2024
2:52 PM
The main vlan10 is getting dhcp from my windows server 192.168.100.0/24. (Meraki option: do not respond to dhcp requests). I have made a new dhcp scope on my windows dhcp server, say 192.168.150.0.24. On the new vlan in Meraki - vlan20- would I put the option: relay dhcp to another server? (the windows dhcp server is 192.168.100.5) How will the workstations on vlan20 know which ip range to grab from the windows server?
... View more
Feb 16 2024
8:41 AM
Are you saying each mx will have a WAN address and a VIP address? mx 1 wan: x.x.x.54/29, vip: x.x.x.55/29 mx 2(spare) wan x.x.x.57/29, vip: x.x.x.58/29
... View more
Feb 16 2024
8:28 AM
I'm struggling with the physical cabling of adding a warm spare. We currently have a single ISP with /29 address. Single MX to stacked switches. (ip is just an example) If I were to add a warm spare would it look like this? I would also use the Virtual IP method so the .54 still remains the main public ip. How would using VIP change the configuration of the MX's?
... View more
Labels:
- Labels:
-
Other
I explicitly opened up port 993, 587, 465 for outgoing and we are receiving all emails now. The MR only has deny to local, and allow any any for the firewall. I still find it strange, but I guess it's working now.
... View more
When I connect a laptop to the guest ssid, traceroute to hotmail.com and nslookup to hotmail.com produce the same results as when you do it from the corporate network. I ran a wireshark and it seems port 993 and 465 are being blocked (smtp outgoing and incoming). What I don't get is that I'm not explicitly blocking these ports in the firewall. I will open them up to see if it solves the issue.
... View more
A bit more info here: Yes, the AP gets an internal address in same rage as corporate network. There are not proxys. Internet is accessible from all connecting to guest ssid There are no content policies or firewall rules explicitly affecting this guest ssid I have added 8.8.4.4 to the DNS as well.
... View more
under client id and vlan for the SSID, I have 8.8.8.8 as the dns sever. The AP ip is on the corporate network.
... View more
I have a guest ssid that has Meraki AP assigned Nat mode, which has deny all to local LAN. When users connect their mobiles to this network they do not receive email from hotmail, gmail, etc. The will receive it if they go on the coorporate network. I believe it may be a dns issue and cannot find outgoing mail servers? Any help would be appreciated. thanks.
... View more
Dec 11 2023
1:02 PM
Thanks @alemabrahao , I have the stacks setup correctly. I want to create an aggregate ports connections between the 2 different stacks so they can communicate.
... View more
Dec 11 2023
12:56 PM
I have 2 switch stacks. One stack of 3 switches with the core switch here (stack A). The other stack is a stack of 2 (stack B). If I want to create an aggregate between the two stacks, is it better to: take 2 ports from one of the switches in StackB to 2 ports to the core switch(stackA) or take 1 port from each of the 2 switches in StackB to 2 ports on the core switch(statckA) Or does it even matter? thanks all.
... View more
After taking some Meraki learning hub courses, I've noticed that our slowest switch 10/100 is the root bridge. If I want to change this to the core Meraki switch, will there be a service interruption at all? thanks.
... View more
Dec 8 2023
9:56 AM
Just to confirm: If I have 3 MS225 switches physically stacked with stacking cables at the back, do I need ethernet cables going from one switch to the other?
... View more
Nov 27 2023
8:28 AM
1 Kudo
Thank you all for the input all. I imagine option 2 would make the the list in the firewall quite large, but maybe easier to manage and decipher.
... View more
Nov 24 2023
9:56 AM
If I have 2 subnets that need port 80 and 5000 open to subnet 3, is it better to create one firewall rule for each or combine them? allow--TCP, subnet1, subenet 2, source port any, destination subnet 3, destination port 80, 5000. OR allow--TCP, subnet1, source port any, destination subnet 3, destination port 80. allow--TCP, subnet1, source port any, destination subnet 3, destination port 5000. allow--TCP, subnet2, source port any, destination subnet 3, destination port 80. allow--TCP, subnet2, source port any, destination subnet 3, destination port 5000. Does it make a difference to Meraki or the speed of process? thanks!
... View more
Labels:
- Labels:
-
Firewall
Nov 4 2023
9:06 AM
Yes, it's client vpn. Thanks for verifying.
... View more
Nov 3 2023
10:47 PM
I have one vpn setup in the MX, along with some other vlans. Where would I put access/firewall rules concerning the vpn subnet? In the inbound section or outbound? For example I want vpn subnet to have access to a file share on vlan2? What about non-vpn inter vlan access; would I put these in inbound or outbound section? thanks.
... View more
Oct 10 2023
1:07 PM
2 Kudos
ok, Thank you all for your help. The new vlan was enabled on the wrong Lan/trunk port on the MX. The one that it was enabled on was not even plugged in to the switch. I enabled the new vlan on the one port that is going to all the switches and is now receiving dhcp wired and wireless.
... View more
Oct 10 2023
12:32 PM
I am not getting any dhcp for this vlan on wired either. The vlan is active/allowed on the mx port though.
... View more
Oct 10 2023
9:28 AM
I'm trying to find out which way is better? Apply rules in the vlan group policy vs adding the rule in the mx firewall section. Say I have vlan10 192.168.10.0, and vlan 20 192.168.20.0. If I want to open up TCP port 445 to 20.0 where would be the best place to put it. I'm curious because on the vlan group policy side the last rule is allow any-any. Doesn't this cancel out any other rules I make?
... View more
Kudos from
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2333 | May 19 2022 12:58 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 2356 | |
| 2 | 2333 | |
| 2 | 40527 | |
| 2 | 4183 | |
| 2 | 3957 |
© 2024 Cisco Systems, Inc.
