Meraki

PhilipDAth · ‎Jul 22 2019

We are using 11.24 on our MS350 without issue. I'm pretty sure we didn't have any issues with 11.22 either. 11.24 lists this as a fixed bug which might relate to your issue. ARP entry on L3 switch expires despite still being in use -- causing brief packet loss until re-ARP occurs

PhilipDAth · ‎Jul 21 2019

Most PoE devices also allow power cubes - which are usually even cheaper.

PhilipDAth · ‎Jul 21 2019

Lucky for you, with all sites being Meraki, you can simply use AutoVPN. I quite like assigning /22's supernets to office locations. They lets you have up to 4 x /24's subnets per site. Sample uses for them are: * Servers * Workstations * VoIP * Internet WiFi Even if you only need a single /24 now, it's nice being able to accomodate changes without a big renumbering.

PhilipDAth · ‎Jul 19 2019

Note that this warning is often display when there is no problem - a false positive. If your MX plugs directly into an ISP circuit; or if it sits behind another firewall and you don't think the traffic is blocked then ignore this. If you are still concerned then you'll need to open a case with support to verify if the warning is actually correct.

PhilipDAth · ‎Jul 19 2019

There is no such API to do this test. Also this is a test to the Meraki cloud. You can't put a lot of faith in this measuring the actual maximum thoughput of your ISP circuit. It is just a general guide.

PhilipDAth · ‎Jul 19 2019

The best way will be to have an Organisation split done. To do this you have to raise a support ticket. They can only split into (and create) a brand new organisation. So don't create an organisation first. Basically you give support a list of the networks to split (in this case probably just one). The split takes a couple of minutes. Afterwards their will be a new Organisation with those networks, the kit that was in those networks and the licencing for them. After the split log into the new Organisation, clean up/add/remove any administrators you want. Add/remove any VPNs you want. Done.

PhilipDAth · ‎Jul 19 2019

It's pretty bad that the remote end can't handle a NAT-T negotiation. There really should be no reason to ever disable this option.

PhilipDAth · ‎Jul 18 2019

I think you are going to need to go back to whoever the kit was purchased from. They are going to need to check the service location tool (or escalate to Meraki) to find out if Qatar is covered.

PhilipDAth · ‎Jul 18 2019

>It sounds like we're both getting p1 timeouts This is why I asked about NAT. I wonder if their end is behind NAT. Because UDP is connectionless some devices that do NAT don't really handle long lived NAT sessions (like VPNs) very well. An extreme option - buy a Z3 and send it to them, and use AutoVPN. Tell them to treat the Z3 as an ordinary "WAN Router". They can plug it into a spare interface on their firewall, and then apply whatever firewall rules they like.

PhilipDAth · ‎Jul 18 2019

Is either end sitting behind NAT (so the public IP address is not directly on the security device)? Note that the MX has particular poor 3DES throughput. The AES throughput is good.

PhilipDAth · ‎Jul 18 2019

@jdsilva and @AjitKumar give very probably causes.

PhilipDAth · ‎Jul 18 2019

Splash Access do a rotating WPA2-PSK option with a QR code for configuring guest WiFi devices. https://www.splashaccess.com/

PhilipDAth · ‎Jul 16 2019

Can one of the switches ping the other switch (they are both in the same subnet, so this should be a very simple case)?

PhilipDAth · ‎Jul 16 2019

Factory reset it in desperation?

PhilipDAth · ‎Jul 16 2019

Sorry I didn't read this closely enough. The MX68 does not support wired dot1x yet.

PhilipDAth · ‎Jul 16 2019

I've had issues with devices when using a complex PSK. If you are using a complex PSK perhaps try a simpler one.

PhilipDAth · ‎Jul 16 2019

I have only done this using Microsoft NPS. And that is not normal behaviour. You're not using COA or anything like that to re-authorise the device on the ISE side?

PhilipDAth · ‎Jul 16 2019

Meraki uses a single co-terminated date. When you make later purchases that single date is extended. You can read about it here: https://documentation.meraki.com/zGeneral_Administration/Licensing/Cisco_Meraki_Licensing_Guidelines_and_Limitations/The_Science_Behind_Licensing_Co-Termination This makes renewals particularly simple, as everything needs to be renewed at the same time.

PhilipDAth · ‎Jul 15 2019

The IPS signatures are updated dynamically. It could happen several times in an hour and then not for several days. It just depends what new threats are emerging. The list is not publically available. I would crank it up to prefer security. You can read more about the rule sets here: https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Intrusion_Detection_and_Prevention

PhilipDAth · ‎Jul 15 2019

You realise if you are using the IPS engine that it is already getting a live feed of threats to stop? I would tell it to prefer "security" to get the larger set. https://gblogs.cisco.com/ch-tech/meraki-malware-detection-looks-also-into-the-past/ You may be manually duplicating something that is done automatically.

PhilipDAth · ‎Jul 15 2019

What happens if you put just cineblog01 in the blocked URL patterns list?

PhilipDAth · ‎Jul 15 2019

At least that involves some cooking.

PhilipDAth · ‎Jul 15 2019

And to answer your next question, you have to delete the managed application to delete the resource group tp delete the VMX so you can re-deploy it.

PhilipDAth · ‎Jul 14 2019

The community forum filters out a lot of swear words. I was thinking of using more creative words but CarolineS might not be happy with me. Here is the secret. When deploying the VMX in Azure you can select an existing virtual network and subnet. Note that the VMX itself must go into its only read only resource group. I would select the existing subnet wherever your servers are located. If you are super keen you can create a new subnet in your existing resource group. Just don't let the VMX create the subnet in its own resource group. This is stated in the deployment guide (search for "Choose an existing Virtual Network") but it should probably be in big bold lettering. https://documentation.meraki.com/MX/Installation_Guides/vMX100_Setup_Guide_for_Microsoft_Azure This really does deserve some swearing.

PhilipDAth · ‎Jul 14 2019

Correct. It is only available on the layer three switches.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges