About PhilipDAth

PhilipDAth

Just to put things in perspective when using MX and Umbrella without the roaming client; if you take the Meraki security solution and remove 3/4 of the monitoring and capabilities - you get what you have in Umbrella. In your Meraki Dashboard: Network Wide/General - Set Traffic analysis to "Detailed" Security & SD-WAN/Threat Protection - Set AMP to enabled - Set "Intrusion detection and prevention" to Prevention and Security Security & SD-WAN/Content Filtering - Enable at least --Bot Nets --Illegal --Malware Sites --Proxy Avoidance ++ Everything else you think is not appropriate Consider enabling Safe Search. Also consider enabling the similar option for You Tube on the same page. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Web_Search_Filtering_and_its_Effect_on_Google_Apps_and_Google_Search Everything about Umbrella sounds fine.

PhilipDAth

You haven't asked a question to be able to help you.

PhilipDAth

I don't know the answer. Check out this guide about using Cisco ISE and URL redirection. I would pay special attention to the section on walled garden. https://documentation.meraki.com/MR/Encryption_and_Authentication/Device_Posturing_using_Cisco_ISE

PhilipDAth

Any chance you have "deny local LAN" configured on your WiFi network? https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

PhilipDAth

> Now, all of a sudden, a few DNS entries are missing from fileshares What do you mean DNS entries are missing from file shares? DNS is used for establishing a name to IP mapping, and file shares are used for - well - file sharing. I don't get how they are related.

PhilipDAth

> Things go south whenever I plug a switch into the repeater. Anything acting as a DHCP server plugged into this switch (or the switch itself)? If so, they'll make the repeater think it is another gateway.

PhilipDAth

> the Windows agent needs to be reworked ASAP. 100% agree.

PhilipDAth

A packet capture usually highlights the issue. https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Packet_Capture_Overview

PhilipDAth

Batch your API requests together using action batches. https://developer.cisco.com/meraki/api/#/rest/guides/action-batches/

PhilipDAth

I'm wonmdering if you have a buggy firmware load on that MX. Could you trying plugging it into an existing working network and let its WAN port DHCP an address and then come online? I suspect it needs a firmware upgrade.

PhilipDAth

No idea, but they have done a great job.

PhilipDAth

I just came across these excellent tool - XCA. https://hohnstaedt.de/xca/ It is a free Windows tool that lets administrators run a CA - easily. You can easily create certificates for your users for WiFi authentication, process CSRs, export in all the common formats, and have the database shared amongst your support people - so anyone can generate the certificates. Amazing.

PhilipDAth

> Needed to build an extra phase 2 tunnel instead of putting 2 subnets in one phase 2 configuration. The unfortunate thing is this is outside of your control. You can simply put forward the solution you recommend.

PhilipDAth

Doe your phase 2 have more than 1 subnet in it? If so, then others have previsouly said you need to (on the Fortinet) " Needed to build an extra phase 2 tunnel instead of putting 2 subnets in one phase 2 configuration."

PhilipDAth

ps. If it was me, I'd just go for a fixed 60s. Give the camera enough time to really power down.

PhilipDAth

I don't know of anyway to do that. You could try querying the port status and waiting until you see it becomes disabled. https://dashboard.meraki.com/api_docs#return-a-switch-port

PhilipDAth

The closest is: Organization/Summary Report and then messing with the "Network" drop down at the top. I say "closest", because it doesn't really deliver what you are asking for. But worth a look.

PhilipDAth

I've been using it for at least a year. I've had no problems, performance or otherwise.

PhilipDAth

Because the only information the RADIUS server gets is the users name and password. The RADIUS server is not told which machine the user is logging in from. Consequently there is no way to restrict the machine being used. This is a fundamental restriction of the Windows L2TP over IPSec client. Microsoft did not create a way for the machine name to also be passed or authenticated.

PhilipDAth

You have to setup a server and the raw data will be sent to it as it is collected. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Scanning_API

PhilipDAth

What kind of device is the remote end? Is either end behind another device doing NAT?

PhilipDAth

I use AWS Lambda as well and get the same latency issue. Lamba is slow to start scripts (or slow to instantiate the script). This article seems to have a good discussion about this. https://medium.com/@zaccharles/making-net-aws-lambda-functions-start-10x-faster-using-lambdanative-8e53d6f12c9c

PhilipDAth

I don't know what BIP means. MPLS is a method of forwarding packets using labels. It is a technology used by carriers. It can be used for Internet and WAN circuits.

PhilipDAth

If you go: Security & SD-WAN/Appliance Status/Uplink you can see the current Cellular state and a graph of live circuit usage.

PhilipDAth

The API only gives you the raw data, so you would have to process that yourself to come up wit something similar. So that is not going to be simple. There is not going to be a straightforward way of getting this programatically.

PhilipDAth

Community Record

Badges