About Johnfnadez

Johnfnadez

Yes, under Organization -> Summary Report you can see a report, or under Network Wide -> Event Log you can see detailed logs if you consider my answers as a solution I’d appreciate if you mark them as solution 🙂

Johnfnadez

Yes, you must apply the policy on the VLAN, in the same chart where you define the Gateway IP

Johnfnadez

Yes it works, just double check that you are tagging the traffic from SSID with the VLAN ID in question and it should work

Johnfnadez

If you have an MX upstream you can set a group policy with the filtering in the VLAN in question and all devices thru the same vlan will be under that policy. If you do not have an MX firewall I don’t think if that’s possible due SSID has some L7 firewall it but is more oriented to apps than website categories here you can find more info https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

Johnfnadez · ‎09-27-2022

Hola! Desde el dashboard puedes ver sí el MX está configurado para poder usar VLANs? Por defecto estos vienen con una sola subred sin usar dot1Q

Johnfnadez · ‎09-22-2022

Have you checked the events on the Meraki dashboard regarding Client VPN Usually I have configured windows machines generating the power shell config with this script and avoid human errors: https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html Regards!

Johnfnadez · ‎09-22-2022

I advise you to check the protocol used between the printers and the server, could probably using an ALG that would be working on Checkpoint but no on Meraki. For example FTP in active mode needs communication allowed to be initiated from both sites if FTP ALG is not supported. You issue would be going thru the same root cause...

Johnfnadez · ‎09-21-2022

Hello Jd, All traffic that doesn’t match a custom rule, takes action in the default rule which is the uplink preference or load balancing. For example, if you have load balancing on both uplinks it falls in that rule, otherwise it goes thru the uplink you have as primary.

Johnfnadez · ‎09-21-2022

Hello Community! I have a doubt with my CMNA Kit, I got it almost 3 years ago, eventually the licenses are about to expire. Checking the license renewal requirements I do not longer meet all those requirements since I am no longer working for a Meraki reseller. But I don’t want to covert my Meraki devices in paperweight since those won’t work without licenses. So finally my question is, are those devices suitable to buy the licenses for my own? Or those have a kind of disclaimer that doesn’t allow renew with licenses bought by me? Best regards!

Johnfnadez · ‎09-21-2022

I recommend to block the remote access apps on your MX Firewall and set a single app as default remote access and integrate it with LDAP Authentication. If an employee exists the company only remove the username on your Active Directory and that’s it. We as Network Security Engineer have to enforce policies in our company to keep it safe from the world. I don’t consider a good practice allow any remote access application in your Network because it opens a lot of attack surfaces. For example you can enforce to only permit RDP from Microsoft and authentication with 2FA agains Active Directory. If you consider my answer as solution please mark it as solution 😀 Regards!

Johnfnadez · ‎09-21-2022

Happy IT professionals day! For everyone who puts the knowledge every single day to keep the world connected and share the knowledge with the ones who are beginning on this world of networking. unfortunately my colleague that I want to mention on this post is no present on this community but I would like to mention my colleague Luis from Costa Rica, who has shared a lot of experience with my since I knew him!

Johnfnadez · ‎08-17-2022

Hello! I dont consider that disconnecting and isolating the network manually is a good practice for ransomware attacks, the best way is to configure policy enforcements in case of device compromising. In my experience I would consider a three alternatives: Using System Manager we can mark devices in quarintine https://documentation.meraki.com/SM/Monitoring_and_Reporting/Selective_Wipe_and_Device_Quarantine_in_Systems_Manager We can include devices in a Block List Or we can try to use Cisco ISE to enforce ACLs on the switchport and block any potential traffic. https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_maintain_monitor.html

Johnfnadez · ‎08-16-2022

I loved the way how everybody help each other and always are being humble!

Johnfnadez · ‎06-17-2022

Hello Friends! Few months ago I saw a topic on this forum about "How to test IDS/IPS on Meraki Firewall?" I really got this question and tried to answered for my self and now I want to share with you all a way to test the inspection on HTTP traffic that can be done by Meraki MX using IDS/IPS and AMP. Its probably somebody else discovered this way before but I want to share it and documented with you on this forum to help other Meraki People to test their enviroment safely. The only 3rd party software we need it "Postman" which is a well known program for people handling Automation APIs. In summary with this program we can generate HTTP/HTTPS traffic and use methods such as GET/POST against HTTP comunications. With that concept I realized we can use it to generate traffic passing thru Meraki MX and check if it works as expected at least the Instrusion system with a well-known false positive signature registered only for testing reasons. Well, for make this test straightforward I am using this page with HTTP service enabled which can be used as our target: http://www.testingmcafeesites.com/index.html And then the well known threat copying the text inside the file that can be found on this link: https://www.eicar.org/download-anti-malware-testfile/ NOTE: Accesing the link above could trigger your antivirus/security enforcements on your computer and organization because it is used for downloading well known malicious files to test different security features. Once we have the txt file downloaded from the page above, we can use the postman to send an HTTP POST with the text contained on the downloaded file in the following way: Finally just press "Send" and your computer will open the TCP connection against the site and then send the HTTP POST as we can see on this PCAP: Finally We can go to our Meraki Dashboard on: Security & SD-WAN => Security Center and We should be able to see the trigger we have activated: If you have any suggestions please let me know, also if you have any doubt, Johnny Fernández | Network & Security Engineer

Johnfnadez · ‎05-24-2022

Sure! You can get logs in two different ways, The first (easier) Going to the Network-wide tab and then to event log, you can download the sorted logs in a CSV file: The second way and scalable solution is via API, you can follow this link if you have some coding experience: https://documenter.getpostman.com/view/7928889/SVmsVg6K?version=latest#1982f77c-5ee6-49da-94f4-ee1a28794f59 I hope this information can be useful for you 🙂

Johnfnadez · ‎05-24-2022

Hi! You can get them from Meraki Dashboard via APIs

Johnfnadez · ‎04-21-2022

Have you checked if using another MTU solves this problem?

Johnfnadez · ‎07-24-2020

Awesome! Thank you!

Johnfnadez · ‎07-23-2020

IKE versions hava changed, you can check your peers

Johnfnadez · ‎07-22-2020

You can configure a 3rd party vpn with azure in the MX. https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_between_MX_Appliances_in_Different_Organizations It also applies for Azure, AWS and any IPsec peer. I have used for fortinet, Cisco ASA and another MX in different orgs

Johnfnadez · ‎07-21-2020

Yes, I have asked to Meraki Support and the say that I don´t have the requirements for having this feature, but actually I have the MSP portal

Johnfnadez · ‎07-21-2020

I´d like to know that are the requirements to qualify? bc currently I`m administrating around 6 organizations

Johnfnadez · ‎07-14-2020

Hi Merakiers!!! I hope that you are doing well I have a doubt and I haven´t found out something official from Meraki. Let me explain me: I have syslog servers on all my MX around the Country and I have been receiving logs regarding with URLs and the type regarding Meraki es "url" but I´d like to apply a kind of category like Cisco where i have different levels of syslog messages regarding the severity of them... But I don´t know how to remark this kind of log what level do I have to use??

Johnfnadez · ‎06-24-2020

Bienvenida!!

Johnfnadez · ‎06-24-2020

The best option for you es creating a "Configuration template" and then after creating networks with it`s own MX bind the template to the network. https://documentation.meraki.com/zGeneral_Administration/Templates_and_Config_Sync/Managing_Multiple_Networks_with_Configuration_Templates Just take in count the firmware upgrades bc in the future you only will be available to upgrade firmware ussing those templates. The best practice is to divide it into networks that physically are near from each other, just in case that the meraki device does not work fine after upgrading Regards.

Johnfnadez

Community Record

Badges