Meraki

PhilipDAth

>and then configure the secondary with the same IP on both? No. Well, I guess you could as long as you only plug in one at a time. But generally, no. Lets take a step back - do you even need to use virtual IP mode. Because if the answer is no, things get simpler. I probably use virtual IP mode on only 10% of deployments. Virtual IP mode: * Can made AutoVPN fail over a little bit faster. * Makes client VPN failover a little bit faster. * Is a must for third party site to site VPN connections where you need HA. * It makes all outbound web browsing appear to always come from a single IP address, rather than two IP addresses. Is any of the above "a must" for you?

PhilipDAth

I've tried again with 19.1.6 to AWS. BGP portion still fails to come up. Meraki thinks it is sending a BGP hello but doesn't get a response.

PhilipDAth

I can't speak for AT&T. What I can tell you is that for my customers I sell them a "term" based AnyConnect subscription that matches their Meraki subscription. These kinds of licences automatically include a support contract. When I get the contract from Cisco I forward it onto my customer. My customers are then fully entitled to use AnyConnect and can download the latest software from Cisco directly. They can also ask me to download it on their behalf. SWG is a Cisco Umbrella. https://umbrella.cisco.com/products/secure-web-gateway Cisco Umbrella does also offer a remote access solution (which does not use the MX option), called Secure Connect. SecureConnect includes an engine that can do client updates automatically. https://www.cisco.com/c/en/us/products/plus-as-a-service/secure-connect.html It is not clear to me from your screenshot above which remote access solution you have been sold. I would go back to AT&T and ask about how you get SRA configured (or even which solution it is that you have bought), and how you are meant to get software updates.

PhilipDAth

Check out this detailed post on multicast routing. https://community.meraki.com/t5/Switching/Multicast-Basic-s/m-p/25867/highlight/true#M2125

PhilipDAth

I believe it is purely done by mac address.

PhilipDAth

Your screenshot shows that 192.168.200.1 is the MX. Remember - the MX is excluded from the firewall rules. You have to ping from another device to a different device (something that is not the MX).

PhilipDAth

I've seen this issue with firmware bugs as well. Make sure you are on current stable or better firmware.

PhilipDAth

We've gone 100% work from home. No more people using vehicles to go to work and back each day. No more office.

PhilipDAth

Are you by chance using IKEv2 and have multiple subnets selected? IKEv2 on Meraki only supports a single subnet combination. You have to use IKEv1 if you need to support multiple subnet combinations. I echo your sentiment that MX is weak in the third-party VPN area. When I tend to do, when I need to link orgs, is put an MX from each org next to each other in one central site, add static routes between them, and reidstribute those static routes back into AutoVPN on each side. That works rock solid.

PhilipDAth

That is not good.

PhilipDAth

Have you got a 1:1 NAT configured to allow access from the outside in? And is the FQDN you are using a public DNS name? 1:1 NAT also acts on traffic from the inside.

PhilipDAth

Negative. Layer 7 rules do block inbound traffic as well, such as when using NAT to allow the Internet to access an internal server.

PhilipDAth

Your firewall rules look correct - but they don't get applied to traffic generated from the MX itself. You'll need to test with actual devices plugged into those VLANs.

PhilipDAth

That is also my experience. If you want to use WPA3, put it on a seperate SSID. There is poor device compatibility with WPA3 at this point in time.

PhilipDAth

I'll take a punt. DHCP reservations are typically done based on the MAC address, but some clients don't present the MAC address in the DHCP client ID field. I did a Google and one article said to add "dhcp-identifier: mac" to the /etc/netplan/01-netcfg.yaml file. Hopefully that is enough to start your Googling journey.

PhilipDAth

In steps the API. 🙂 Write a script to injest your file of things to block, and update that single object group.

PhilipDAth

It will need its own seperate Zigbee infrastructure and management platform.

PhilipDAth

That looks good. I think that will increase your chances.

PhilipDAth

Create a layer 7 firewall rule to block access to a group. Create a group and load all of the IP addresses into that.

PhilipDAth

I don't think you'll be able to use "Deny Local LAN" in this case. You'll need to create a firewall rule to block access to your internal LAN. The SSIDs involved will need to be in bridged mode. I assume the SSIDs are in different VLANs. You will probably need to play with Bonjour forwarding options. https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/Bonjour_Forwarding The device doing the routing between the VLANs might need to be Bonjour capable as well.

PhilipDAth

https://documentation.meraki.com/CiscoPlusSecureConnect

PhilipDAth

Purchase a support contract for Secure Client, and you'll be able to download it directly from Cisco.

PhilipDAth

Have you checked the manufacturer of the Lenovo WiFi chipset (Intel?) (not Lenovo) to see if there is an updated driver? This is most likely to be a driver issue.

PhilipDAth

Is the TV Ethernet or Wireless connected? Is the laptop Ethernet or wireless connected? Is "Deny Local LAN" turned off? https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

PhilipDAth

Wahoo! Well done.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges