About PhilipDAth

PhilipDAth

@HodyCrouch is correct - it is specific. Attached is an example of Help/Firewall Info from one of my clients. Note your firewall rule requiments may be different. This is just an example.

PhilipDAth

You could consider using a product like Cisco Stealthwatch Cloud, but it is a tad pricy so usually suited to larger organisations. https://www.cisco.com/c/en/us/products/security/stealthwatch-cloud/index.html As @BrechtSchamp says, this works by funneling the logs to it. Note that it can collect logs from other kinds of devices as well (including things like Amazon AWS), so is a more encompassing security monitoring tool.

PhilipDAth

IDS alerts are usually generated by MX appliances, which have no concept of the SSID (unless you are using an MX with built in WiFi). So there is no way for Meraki to provide this information. You might have vlans configured, and if you map an ssid uniquely to a vlan then I guess you have your mapping.

PhilipDAth

If the tunnel is not up on WAN2 (so assuming you are using AutoVPN over MPLS) make sure the that the public IP address that the spoke gets NATed to is the same as the public IP address that the HUB is nat'd to when the traffic goes over the MPLS, otherwise it wont work.

PhilipDAth

It can't be. They must have connected at some point in the past.

PhilipDAth

Any chance you are using MFA in Office 365, and the new users are not setup with an App Password? When you say you can't access - what exactly happens? Does the web page load? Do you try and login and then get an error?

PhilipDAth

Want to help build it? https://meraki.cisco.com/jobs?gh_jid=1561060

PhilipDAth

What have you got powering these AP's? I hope it is at least using 802.3af, as opposed to the older Cisco proprietary PoE in use at that time. The 1142 is really really old technology now. I think anything in the Meraki line up would be an improvement. Like the others, I prefer the MR42 unless you are using it in dense environments, and then I would go for the MR53. The MR42 and MR53 wont work on the older proprietary Cisco PoE. They will work on 802.3af, but it will restrict its functionality. You really need 802.3at PoE to operate them at their full potential. So consider how you are going to power the solution. You may need to upgrade your PoE switches as well.

PhilipDAth

See if the SonicWall has an option to enable dead peer detection and/or keepalives.

PhilipDAth

I lie, the AutoVPN routes do show up. How long have you had it in place? The topology view takes a while to update - like wait a day.

PhilipDAth

AutoVPN routes don't show up in L3 topology. Only routes that exist locally in the current network.

PhilipDAth

I don't see how you can resolve that one. The WiFi autrhentication sends back a yes/no response. The Mac has no way of knowing if a "no" is because of a password change or not. You could consider changing over to certificate based authentication (no more passwords, problem solved).

PhilipDAth

Why don't you run a script via Systems Manager and have it post the results back somewhere for your Python script to process? Might not be as nice, but should be workable.

PhilipDAth

If you are bridging your SSIDs (which I would tend to do), then I would do the traffic shaping on the MX. If you are using NAT mode on the MR and you want to be able to do per-user traffic shapping then I would do the traffic shapping on the MR.

PhilipDAth

Oh I see - sorry I am not aware of an API endpoint to do this. You can only do it do it via the dashboard.

PhilipDAth

If you are referring to Windows and Mac - yes. You can select them all at once, and run a command against the whole lot.

PhilipDAth

I'm with @NolanHerring - sounds like Windows Firewall. Can you ping the MX LAN IP's over AutoVPN ok?

PhilipDAth

https://meraki.cisco.com/blog/2009/09/os-fingerprinting/

PhilipDAth

I assume you are able to save in in the Meraki dashboard, but that the access to the web server is not working?

PhilipDAth

If you don't have access to the original email address used to manage the account then you can't do anything. You can put then in the rubbish bin.

PhilipDAth

Do you perhaps have a splash page enabled still?

PhilipDAth

I did it once by accident. It seemed to worked, but the dashboard had a big warning on it for the site concerned.

PhilipDAth

Good news is when they are paying for lunch.

PhilipDAth

Who's coming? https://ciscolive.cisco.com/anz/

PhilipDAth

It looks like it might be to do with an issue that Microsoft Flow only supports simple key:value pairs, and the Meraki WebHook sends it in a more structured format. https://www.reddit.com/r/meraki/comments/9r2p2r/meraki_alerts_with_webhooks/

PhilipDAth

Community Record

Badges