Meraki

PhilipDAth

Correct, it will push. Tip - upload it with no extension. The dashboard always add a .xml extension, even if the extension is already .xml. Forceauthn means it uses SSO. It will use whatever policy you have defined in Okta. If you say a login is required once per week - that is what will happen.

PhilipDAth

Now quite what you want, but what about the Wireless Health report?

PhilipDAth

> users must re-authenticate from scratch every time. Open a support ticket and ask them to set "forceauthn" to false.

PhilipDAth

You can use my simple profile editor, and on that page it says where you have to save the profile on a Linux machine. https://ifm.net.nz/cookbooks/online-anyconnect-profile-editor.html

PhilipDAth

Hmm, you got me. I am 99% sure you have to enable it on the networks that you want to use it on. It doesn't turn on just because you have the licence (or at least, it didn't use to). I would open a support case.

PhilipDAth

Yes. Go into RF Profiles: https://documentation.meraki.com/MR/Radio_Settings/RF_Profiles Create a new profile using the "Open Office Profile". Assign it to your APs. 99% likely, this will solve your problem.

PhilipDAth

I think it is referring to this: Scroll to the very bottom and you will see: You could use this to link the Meraki Dashboard to an internal customer ID.

PhilipDAth

You have to go into Insights/Licensing and enable it there.

PhilipDAth

There are a million different possibilities to this one. Let's first start by only considering DNS. DNS servers can return different answers depending on the provider you are using. You have two different providers, complicating this further. Are you using provider agnostic DNS like Google (8.8.8.8, 8.8.4.4) or provider DNS? Provider DNS is more likely to get you into trouble when using dual providers. If you deliberately take one provider offline at a time - does the issue still happen? Does it by chance only happen when both providers are online, or only when one of the two providers is online?

PhilipDAth

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-sM5GCfm7 "A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the Cisco AnyConnect service on an affected device."

PhilipDAth

Someone has been doing a lot of work.

PhilipDAth

There is also the AI RMM to improve WiFi. https://documentation.meraki.com/MR/Radio_Settings/AI_-_RRM There is the developer portal AI to help find API functions and write code.

PhilipDAth

You need to start with isolating WHAT is loading slowly. Open Chrome developer tools (CTRL+SHIFT+I). Go to the network tab, and then type in your website. Look at all the resources it loads, and the waterfall graph. It will identify what is getting "stuck", and what component of the process is having the issue (TCP connection, DNS, SSL negotiation, etc). Once you have identified one component, and focus your time on exactly this one area. Common issues are to do with websites loading third-party components.

PhilipDAth

UDLD is only for point-to-point links. It is not suitable for multipoint links. You should disable UDLD on the associated ports. That is my tip.

PhilipDAth

>Do different customers have different versions When an upgrade happens, it starts rolling out across the shards. Some upgrades take months. So yes, different customers can be running different versions.

PhilipDAth

Those max power settings are WAY too high. The min power settings are WAY too low. Compare it to the screenshot I provided.

PhilipDAth

I think you might be able to get more. I would try 18.211.6 or 19.1.8.1.

PhilipDAth

IPS is used for traffic between VLANs. Let's confirm if this is the issue. Try turning it off temporarily. If this resolves it, try using a ruleset that includes less rules. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Intrusion_Detection_and_Prevention

PhilipDAth

What country is this in (as this affects regulations that apply)?

PhilipDAth

The MG52 supports "5G standalone (SA)" - what I will refer to as "proper 5G". The SA is the important bit.

PhilipDAth

I guess the MG52 has made it kinda obsolete. Next we'll have the Starlink version ...

PhilipDAth

@AmyReyes is never going to hit her KPI unless you all start posting a lot more. 🙂

PhilipDAth

I guess that depends on how good your recognition model is. If it only triggers on a high probability, then it shouldn't need further processing. Note that you do need to allocate a sense API licence to a camera - so I wouldn't expect you to get notification events from cameras without a licence.

PhilipDAth

Wow, 7 years went by quickly. I had to double-check. I don't see a powerful need to replace the MX67 at this stage. What would they change? I would be very surprised if IOS-XE routers became Meraki managed, but who knows. 🙂 The slide seems to indicate that is the end goal.

PhilipDAth

I have not done that myself - but it should work.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges