Meraki

PhilipDAth

https://documentation.meraki.com/CiscoPlusSecureConnect

PhilipDAth

Purchase a support contract for Secure Client, and you'll be able to download it directly from Cisco.

PhilipDAth

Have you checked the manufacturer of the Lenovo WiFi chipset (Intel?) (not Lenovo) to see if there is an updated driver? This is most likely to be a driver issue.

PhilipDAth

Is the TV Ethernet or Wireless connected? Is the laptop Ethernet or wireless connected? Is "Deny Local LAN" turned off? https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

PhilipDAth

Wahoo! Well done.

PhilipDAth

If I get bored, I'll put in a feature request to Duo to add this to the "easy" setup. I have previously asked them to add a field for AWS, and they did!

harmankardon

Any idea why this has just started happening recently, was it a change on the Meraki side or the AnyConnect side?

ConnorGray

On the Network template if you navigate to Security & Sd-wan. Then select Content filtering type https://dns.google/ in the URL box at the top and check. It will show you DoH and DoT are blocked under Category blocking. Adding in case anyone else has the issue

IvanJukic

Hey @cabricharme, Re: the pcap. 1.) Just run a raw capture, no filters at all. 60-second duration is fine. 2.) Enter "STP" in the filter of WireShark. 3.) Check the STP frames for the Server/Host Mac Addresses. If so, it is running Spanning-Tree. 4.) Log into the KVM or Web UI etc for the Server/Host to turn off Spanning-Tree. See example below; STP Pcap Example Re: The similar issues you've come across in the past. This comes from my Personal experience. Not sure if customers have posted here or not. I've also run into this during deployment.

thomasthomsen

You are right. You can only use the MR-SUB with old APs, and the Wireless Network-SUB with new WiFi7 APs. - I just learned this. But co-term licenses are "free for all". BUT .... If you acquire WIFi7 APs during your MR-SUBs lifetime you can get your MR-SUB licenses converted to Wireless Network-SUB (I just read a very long document about it). But whats really dumb is that you cannot, up front, when aquiring a new sub use the Wireless Network-SUB for old APs, why not just let me buy those ? I dont get it, at all. @GIdenJoe - I just PM'ed you a "thing" 🙂 Hope it helps. But still as I say right now about these licenses : "Alright, this has become far too silly, let's end this before it becomes sillier" - Monty Python

JGill

Hoping not to do this via API. Just trying to figure out exactly what Meraki is using so we can tweak the Domain / Network setup. I have one workstation working now, so trying to back into exactly "why" its working with the handful of changes / commands ran.

NewNothing

It would be great if there was a profile setting for a smoke/fire detector on the MT15's. I have brought this up in a few calls and webinars, but maybe it is just not possible.

sungod

I suggest post on the EA group that you are interested in this feature and would like to help with testing/feedback if possible. On other EA calls there has been opportunity to do this.

CarolineS

Thanks, grammar police! Fixed! Always nice to see you here, @MRCUR.

macnerd

hi, sorry for this delayed reply was doing testing we are running 30.7.1 for meraki we found that even laptop was station and it didn’t jump AP, the failure will occur we are in contact with meraki we have asked their help to do simulation at their eng lab to see if they can replicate this behaviour the intel ax211 driver that we are running is v23.90 which is the latest we fresh install windows and let Microsoft auto install the WiFi nic driver, it’s installing v23.60. > same behaviour we tested dell’s driver, the latest is v23.60 > same behaviour

PhilipDAth

I haven't tested this - but I would expect this to be the case (nat stops working). You would need to change the device to being in hub mode so its Internet didn't go via SecureConnect. BUT - could you configure it as a zero trust application and access it using that method?

AnthonyN

Hey there, The INVALID_ID_INFORMATION error means that the traffic selectors (subnets) did not match. Is one more specific than the other? The VPN status is showing green because Phase 1 is up, this does not take into account of phase 2 unfortunately. If the traffic selectors match exactly then I'd suggest raising a ticket with the NMVPN vendor and Meraki support to see if there's anything weird going on.

Eri1

Hi, just an update did a test with a technician, and confirmed that traffic like hairpin routing (using port forwarding) did bypass layer 3 restriction, and currently I believe Meraki did not have any feature to restrict this for now (correct me if I am wrong). Maybe if there is a way to disable hairpin or enable no-nat for certain traffic like this, it will help this vulnerability. So the alterative solution to technician had provided, was to use ACL which block and stop the traffic on the switch from reaching the router. It is fine for now, but it is not scalable as we need to create a rule for each VLAN, and each port. (If ive got 3 VLANs to restrict from using 3 port forwarding rules, I have to create 9 rules)

GIdenJoe

Most importantly: If you have 2 DC's in active active where you have overlapping IP address space. You know in cases your VM's must be able to migrate between DC's and are probably using something like VXLAN between your DC's then you only have the option to use Concentrator mode because in routed mode you cannot have overlapping IP space.

Jamieinbox

Honestly, this means a lot. Thank you.

kYutobi

It’d also helpful to track down the devices involved in the conflict, identifying the MAC addresses can give you a clearer idea of what’s going on. As for the DNS setting, switching from "proxy to upstream DNS" probably won’t fix the conflict unless there’s a specific DNS-related issue. It doesn’t hurt to test, but I’d focus more on the DHCP setup and device configurations.

GuiBertinato

I would like all MAC addresses recognized by the Meraki MR to feed into a big data system in order to analyze locations with higher user frequency, times, etc.

RWelch

Thank you.

PhilipDAth

I don't know the answer. Check this out: https://documentation.meraki.com/SM/Profiles_and_Settings/Variables_in_Custom_Apple_Profiles_with_Systems_Manager

PhilipDAth

I don't think so. You are going to need to use a lot more tags.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges