Meraki

PhilipDAth · ‎Sep 19 2017

The MS250 also uses an 80Gb/s stacking connector so uses the same cables. The cables are not that expensive compared to the switches. I often include extra cables because of this. Having an extra unused cable is much easier than having a cable too short and is unusable.

PhilipDAth · ‎Sep 19 2017

Correct. If the switches are going to be right next to each other you'll be able to use the shorter stacking cables such as MA-CBL-40G-50CM (this is assuming you are using a switch with 80Gb/s of stacking [aka 2 x 40Gb/s cables] like an MS225).

PhilipDAth · ‎Sep 19 2017

Edit the SSID properties. Under "Splash Page" select "Systems Manager Sentry enrollment ". Under "Systems Manager Sentry enrollment" select "Strict".

PhilipDAth · ‎Sep 19 2017

I wouldn't personally put them closer than 300mm to each other. You don't want the RF energy from one to bleed into the other. I would let the Meraki system work out the channels to use rather than manually controlling the channels. Then the system can adapt to interference and other transient issues. If possible, I would try to equally space the access points amongst the high density users, but sometimes you can't do that easily.

PhilipDAth · ‎Sep 19 2017

Negative. You need two cables to create a ring.

PhilipDAth · ‎Sep 19 2017

I disagree with nearly everything you say. I've written several password breaking tools for Cisco products: http://www.ifm.net.nz/cookbooks/cisco-ios-enable-secret-password-cracker.html http://www.ifm.net.nz/cookbooks/passwordcracker.html The larger the source pool of characters that the password is drawn from the more time it requires to crack. An 8 character password that consists of only letters (and where this is known) is considerably faster to crack than an 8 character password that consists of letters, numbers and special symbols. Any modern password system does not store passwords in an easily reversible manner. Having the crypted version of the password is just the starting point of breaking the password. The more complex the password set of charcaters the more time it takes to break the crypted text. A long strong password combined with a good algorithm can be impractical to crack because of the huge amounts of CPU time involved. Pretty much if the algorithm requires more than 1000 years of computing time on high end distributed kit you are pretty safe. I do agree that if the unencrypted passwords are captured by a key logger then you are screwed. You need two factor authentication to mitigate that threat.

PhilipDAth · ‎Sep 18 2017

Perhaps try recovery mode to wipe the device. https://support.apple.com/en-nz/ht204306

PhilipDAth · ‎Sep 17 2017

Change/remove the policy that causes the issue. Then in the Meraki console ask the device to check in.

PhilipDAth · ‎Sep 16 2017

You would have to put each customer into their own subnet so each customer had their own VRRP gateway. Would you also need some kind of layer 2 circit between the two sites that trunked all the VLANs.

PhilipDAth · ‎Sep 16 2017

I'm confused by your question. With regard to servers, if you dual connect them to two switches and configured the NICs on the server as Active/Standby then a single port failure will cause the server to start using the standby NIC in the other server.

PhilipDAth · ‎Sep 16 2017

When content filtering blocks something it gives a reason why. What reason is it giving?

PhilipDAth · ‎Sep 14 2017

It would be great if you could give me some Kudos as well. 🙂

PhilipDAth · ‎Sep 14 2017

Identity should be their email address. Leave "anonymous identity" blank. Password should be there password. Make sure their account is "authorised". I found this guide on how to set it up. https://documentation.meraki.com/MR/Encryption_and_Authentication/WPA2_Enterprise_Profile_Setup_on_Android

PhilipDAth · ‎Sep 14 2017

If you have no VPNs configured then you don't have an issue. If you are only using AutoVPN you don't have an issue. If you are using either client to site VPN or a third party site to site IPSec VPN then you have an issue. The only "fix" you have to use is to make sure you are using a long hard pre-shared key. Personally - I use 24 character pre-shared keys. This will mitigate the risk - but the PCI report will still say the same as it wont know you are using a PSK that is nor practically break-able.

PhilipDAth · ‎Sep 13 2017

I think I have figured this out. Set the phase 2 authentication to MSCHAPv2.,

PhilipDAth · ‎Sep 13 2017

Negative, the Cisco "Support Forums" are on Lithium as well and they don't have the same limitations .

PhilipDAth · ‎Sep 13 2017

If you think my response helped it would be great if you could give me some Kudos and mark my answer as correct.

PhilipDAth · ‎Sep 13 2017

You can also say to create the new network by copy the existing network.

PhilipDAth · ‎Sep 13 2017

I noticed that usernames are very restrictive as well. My surname has an apostrophe in it and I couldn't enter that either.

PhilipDAth · ‎Sep 13 2017

You are correct, It is software limited to that maximum speed. To support Gigabit you would need to jump all the way up to an MX250. https://meraki.cisco.com/products/appliances/mx250 An MX100 can do 750Mb/s. https://meraki.cisco.com/products/appliances/mx100

PhilipDAth · ‎Sep 12 2017

I don't know the answer, but I would have thought it should be using PEAP rather than TTLS.

PhilipDAth · ‎Sep 10 2017

It would be great if you could mark my answer as the solution to your original question. Every app has an ID. For example, the ID for the "standard" camera app is "com.android.camera". This guide gives one way to get the bundle ID. https://documentation.meraki.com/SM/Tags_and_Policies/App_white%2F%2Fblacklisting_in_security_policies It appears you can do wildcards as well (never done it myself. So you should be able to do: com.samsung.* I haven't done it for a while, but I recall doing a settings.applications/about option somewhere to get the ID.

PhilipDAth · ‎Sep 10 2017

Try adding the setting: More Android/System Apps Change the list type to "BlackList". This will allow all system apps except the ones you put into this list. I think a factory reset will be needed as well to get the apps back.

PhilipDAth · ‎Sep 7 2017

ps. We actually use Systems Manager ...

PhilipDAth · ‎Sep 7 2017

Let me be more specific. If you go Network-Wide/Clients you can see all the end points that the Meraki platform can see (for that network at least). Lets pretend there is 1,000 endpoints. Lets now pretend you want to manage 100 of these in Systems Managers. You buy 100 licences, and install the Systems Manager agent (often by enrolling the devices) on those endpoints. You now see these managed endpoints in Systems Manager/Clients. Systems manager will strictly only see those devices that have an agent on them. It will not see the other 900 end points.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges