Meraki

PhilipDAth

If I get bored, I'll put in a feature request to Duo to add this to the "easy" setup. I have previously asked them to add a field for AWS, and they did!

harmankardon

Any idea why this has just started happening recently, was it a change on the Meraki side or the AnyConnect side?

ConnorGray

On the Network template if you navigate to Security & Sd-wan. Then select Content filtering type https://dns.google/ in the URL box at the top and check. It will show you DoH and DoT are blocked under Category blocking. Adding in case anyone else has the issue

IvanJukic

Hey @cabricharme, Re: the pcap. 1.) Just run a raw capture, no filters at all. 60-second duration is fine. 2.) Enter "STP" in the filter of WireShark. 3.) Check the STP frames for the Server/Host Mac Addresses. If so, it is running Spanning-Tree. 4.) Log into the KVM or Web UI etc for the Server/Host to turn off Spanning-Tree. See example below; STP Pcap Example Re: The similar issues you've come across in the past. This comes from my Personal experience. Not sure if customers have posted here or not. I've also run into this during deployment.

thomasthomsen

You are right. You can only use the MR-SUB with old APs, and the Wireless Network-SUB with new WiFi7 APs. - I just learned this. But co-term licenses are "free for all". BUT .... If you acquire WIFi7 APs during your MR-SUBs lifetime you can get your MR-SUB licenses converted to Wireless Network-SUB (I just read a very long document about it). But whats really dumb is that you cannot, up front, when aquiring a new sub use the Wireless Network-SUB for old APs, why not just let me buy those ? I dont get it, at all. @GIdenJoe - I just PM'ed you a "thing" 🙂 Hope it helps. But still as I say right now about these licenses : "Alright, this has become far too silly, let's end this before it becomes sillier" - Monty Python

JGill

Hoping not to do this via API. Just trying to figure out exactly what Meraki is using so we can tweak the Domain / Network setup. I have one workstation working now, so trying to back into exactly "why" its working with the handful of changes / commands ran.

NewNothing

It would be great if there was a profile setting for a smoke/fire detector on the MT15's. I have brought this up in a few calls and webinars, but maybe it is just not possible.

sungod

I suggest post on the EA group that you are interested in this feature and would like to help with testing/feedback if possible. On other EA calls there has been opportunity to do this.

CarolineS

Thanks, grammar police! Fixed! Always nice to see you here, @MRCUR.

macnerd

hi, sorry for this delayed reply was doing testing we are running 30.7.1 for meraki we found that even laptop was station and it didn’t jump AP, the failure will occur we are in contact with meraki we have asked their help to do simulation at their eng lab to see if they can replicate this behaviour the intel ax211 driver that we are running is v23.90 which is the latest we fresh install windows and let Microsoft auto install the WiFi nic driver, it’s installing v23.60. > same behaviour we tested dell’s driver, the latest is v23.60 > same behaviour

PhilipDAth

I haven't tested this - but I would expect this to be the case (nat stops working). You would need to change the device to being in hub mode so its Internet didn't go via SecureConnect. BUT - could you configure it as a zero trust application and access it using that method?

AnthonyN

Hey there, The INVALID_ID_INFORMATION error means that the traffic selectors (subnets) did not match. Is one more specific than the other? The VPN status is showing green because Phase 1 is up, this does not take into account of phase 2 unfortunately. If the traffic selectors match exactly then I'd suggest raising a ticket with the NMVPN vendor and Meraki support to see if there's anything weird going on.

Eri1

Hi, just an update did a test with a technician, and confirmed that traffic like hairpin routing (using port forwarding) did bypass layer 3 restriction, and currently I believe Meraki did not have any feature to restrict this for now (correct me if I am wrong). Maybe if there is a way to disable hairpin or enable no-nat for certain traffic like this, it will help this vulnerability. So the alterative solution to technician had provided, was to use ACL which block and stop the traffic on the switch from reaching the router. It is fine for now, but it is not scalable as we need to create a rule for each VLAN, and each port. (If ive got 3 VLANs to restrict from using 3 port forwarding rules, I have to create 9 rules)

GIdenJoe

Most importantly: If you have 2 DC's in active active where you have overlapping IP address space. You know in cases your VM's must be able to migrate between DC's and are probably using something like VXLAN between your DC's then you only have the option to use Concentrator mode because in routed mode you cannot have overlapping IP space.

Jamieinbox

Honestly, this means a lot. Thank you.

kYutobi

It’d also helpful to track down the devices involved in the conflict, identifying the MAC addresses can give you a clearer idea of what’s going on. As for the DNS setting, switching from "proxy to upstream DNS" probably won’t fix the conflict unless there’s a specific DNS-related issue. It doesn’t hurt to test, but I’d focus more on the DHCP setup and device configurations.

GuiBertinato

I would like all MAC addresses recognized by the Meraki MR to feed into a big data system in order to analyze locations with higher user frequency, times, etc.

RWelch

Thank you.

PhilipDAth

I don't know the answer. Check this out: https://documentation.meraki.com/SM/Profiles_and_Settings/Variables_in_Custom_Apple_Profiles_with_Systems_Manager

PhilipDAth

I don't think so. You are going to need to use a lot more tags.

PhilipDAth

I posted some of the screenshots of the cloud management system of the prior system here: https://community.meraki.com/t5/Security-SD-WAN/Cisco-AnyConnect-Updates-on-the-Meraki-MX-Security-Appliances/m-p/239194/highlight/true#M53674

Helsonbarber

Set the MG51 to routed mode to act as a gateway to the ISP. Assign a public IP from the ISP to the MX84 WAN1 port. The MX84 handles internal routing, while the MG51 manages the ISP connection and public IP.

Rolitto

Thanks Philip and Caleb!

_DanieL_

First of all: The new UI looks modern, thats nice. But there are some points which I think could be better and it's primary about the Information at the first view: There is a lot of blank area and I have to scroll much more than the old design. If I enter the AP Summary page I want to see all important Information with one view. The Information on the left (SSIDs, Serial Number, Firmware, IP,...) are in the "wrong" order. I don't need to see the Firmware or Regulatory Info with the first view. The important Info for me and I think many others are: IP Information thats I want to see with the first view. And also here.. the blank gaps between the Infos. Move RADIUS and VLAN request status above Current Clients. The really first thing I want to see is, if all services are working on the Access-Point and if there are like 10 Current Clients I have again to scroll the RADIUS and VLAN request status. Have a nice weekend 🙂

Shubh3738

For Application control ? My use cases- 1. Let us assume we have 4 types of vpn users. User 1, User2, User3, User4. a.) User A - need to access only GUI Based application hosted on cloud. b.) User B - need to access only NAS server hosted on DC c) User C - need to access only Web based application hosted on Private Cloud d.) User D- need to access All Application or Servers hosted on DC, Cloud so on... Let me explain our connectivity- In DC we have MX 450 In Private Cloud- Have MX 64 In AWS Cloud - we have vmX In approx. 50 Project site location- have MX 64 All in SD-WAN ( Auto VPN) connectivity. Explaining Current VPN scenerio- - Have Fortigate Firewall- only for Forticlient VPN -Have Active Directoory - used for maping group policy and Authenticatio of users. ( All 4-5 groups created and mapped with Fortigate for user authentication and mapping the group policies). After connected the VPN, users can access services as per given access of that policy group only.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges