Meraki

PhilipDAth

If you define a 1:1 NAT for inbound access - the MX also uses that same 1:1 NAT for all outbound access as well. It is a "special exception". I'm not sure it is even documented.

PhilipDAth

A 1:1 static NAT mapping will achieve this. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX#1:1_NAT

PhilipDAth

>Confirm Data Storage Location Alignment I want to re-state this one by @RWelch - it is critical.

PhilipDAth

What a pain!!!

PhilipDAth

There are several ways of solving this. I think I would use the AnyConnect default group policy option, and put in there any firewall rules to control what just the AnyConnect users can access. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/AnyConnect_on_the_MX_Appliance#Default_Group_Policy If you use this approach, you can later extend it to support per-user group policy to control what different groups of users can access.

PhilipDAth

Splash Access have an entire portfolio of solutions for precisely this issue. https://www.splashaccess.com/portfolio/education/

PhilipDAth

I have not been able to get username/password authentication to work in any Entra tenant that Microsoft has migrated their authentication methods (and this is a compulsory migration for all tenants). As a result, I only use certificate-based authentication now. I like use Microsoft Cloud PKI for my issuing CA, and use Intune to do the certificte deployment. https://learn.microsoft.com/en-us/intune/intune-service/protect/microsoft-cloud-pki-overview

PhilipDAth

I agree with @Mloraditch - it is up to the SAML provider if you are required to log in again or not.

PhilipDAth

What I tend to do is create a SAML role naming context like this: <Company Acronym>-Meraki-Administrator <Company Acronym>-Meraki-Observer (would have caused this "Read-Only" previously e,g. IFM-Meraki-Administrator And then create those in every org you manage.

PhilipDAth

A general tip, go to "RF Profiles": https://documentation.meraki.com/Wireless/Operate_and_Maintain/User_Guides/Radio_Settings/RF_Profiles Create a new profile. The most common one I use is "Open Office Profile". This uses sensible settings. Apply this profile to all your APs. On the RRM tab enable "AI channel planning" and "Busy hour".

PhilipDAth

This is the secret. You copy the thumbprint to every org where you want your SAML provider used. And copy the SAML group mapping you wish to use. Entra only requires a single setup. You don't touch the Entra config as you add more organisations.

PhilipDAth

When you use the search in the top right-hand corner, it searches the entire organisation.

PhilipDAth

Green to 3 through pi.

PhilipDAth

Try turning off CDP and enabling LLDP on the C1000 (if it supports this).

PhilipDAth

>Temporary changes to MFA, SAML, and security settings affecting some users ... >We are not able to share an exact timeline Scary. Especially announcing this over the holiday period.

PhilipDAth

No. You'll need to return the co-term licences and get subscription licences.

PhilipDAth

You can have per group firewall rules, but everyone has to share the same set of routes.

PhilipDAth

For the MR76 it lists these as compatible antennas: https://documentation.meraki.com/Wireless/Product_Information/Overviews_and_Datasheets/MR76_Datasheet "List of compatible antennas: MA-ANT-20/21/23/25/27 " Out of those options, the MA-ANT-27 (dual band), MA-ANT-21 (5ghz only) and MA-ANT-23 (2.4 ghz only) seem like the best options to choose from. https://meraki.cisco.com/product-collateral/dual-band-sector-antenna-datasheet/?file https://meraki.cisco.com/product-collateral/5-ghz-sector-antenna-datasheet/?file https://meraki.cisco.com/product-collateral/2-4-ghz-sector-antenna-datasheet/?file Meraki is not the strongest at bridge links. I would be a bit nervous about this use case. I would personally use a dedicated bridge solution from another vendor.

PhilipDAth

You have to delete the VMX, change the config in the Meraki Dashboard, and re-deploy the VMX.

PhilipDAth

These are the settings I am using for machine-based SCEP certificates. I don't believe the SCEP certificate deploys till you use it in something, like the SSID config.

PhilipDAth

Just a heads up. One of my workflows broke last night. I was using "Meraki - Get Organization Inventory Devices" and filtering on device type. This was previously a bit "buggy", and the only way I could get it to work was to exactly create a filter like: [MX67C] No other variation would work. Today, you need to have " around string array elements (note that a single quote does not work). ["MX67C-WW"] I suspect this affects all API calls that require arrays of strings.

PhilipDAth

You'll need to use the BGP over IPSec VPN option to make this work. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-to-site_VPN/BGP_routing_over_IPsec_VPN

PhilipDAth

I've actually had companies raise this - and then I found they had disabled the alerts by setting them to "none".

PhilipDAth

Brilliant!

PhilipDAth

It sounds like you are talking about subscription licensing. An AP subscription licence works with all current APs. https://documentation.meraki.com/Platform_Management/Product_Information/Licensing/Subscription_-_MR_Licensing

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges