Meraki

Johnfnadez · ‎Jun 29 2023

Hi! Have you tried to configure the PPoE using the local management webpage? If you only have this uplink it’s probably config is not getting applied to avoid loose cloud connectivity https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

Johnfnadez · ‎Dec 13 2022

I hope to find them 🤭

Johnfnadez · ‎Nov 28 2022

Yes, under Organization -> Summary Report you can see a report, or under Network Wide -> Event Log you can see detailed logs if you consider my answers as a solution I’d appreciate if you mark them as solution 🙂

Johnfnadez · ‎Nov 28 2022

Yes, you must apply the policy on the VLAN, in the same chart where you define the Gateway IP

Johnfnadez · ‎Nov 28 2022

Yes it works, just double check that you are tagging the traffic from SSID with the VLAN ID in question and it should work

Johnfnadez · ‎Nov 28 2022

If you have an MX upstream you can set a group policy with the filtering in the VLAN in question and all devices thru the same vlan will be under that policy. If you do not have an MX firewall I don’t think if that’s possible due SSID has some L7 firewall it but is more oriented to apps than website categories here you can find more info https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

Johnfnadez · ‎Sep 27 2022

Hola! Desde el dashboard puedes ver sí el MX está configurado para poder usar VLANs? Por defecto estos vienen con una sola subred sin usar dot1Q

Johnfnadez · ‎Sep 22 2022

Have you checked the events on the Meraki dashboard regarding Client VPN Usually I have configured windows machines generating the power shell config with this script and avoid human errors: https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html Regards!

Johnfnadez · ‎Sep 22 2022

I advise you to check the protocol used between the printers and the server, could probably using an ALG that would be working on Checkpoint but no on Meraki. For example FTP in active mode needs communication allowed to be initiated from both sites if FTP ALG is not supported. You issue would be going thru the same root cause...

Johnfnadez · ‎Sep 21 2022

Hello Jd, All traffic that doesn’t match a custom rule, takes action in the default rule which is the uplink preference or load balancing. For example, if you have load balancing on both uplinks it falls in that rule, otherwise it goes thru the uplink you have as primary.

Johnfnadez · ‎Sep 21 2022

Hello Community! I have a doubt with my CMNA Kit, I got it almost 3 years ago, eventually the licenses are about to expire. Checking the license renewal requirements I do not longer meet all those requirements since I am no longer working for a Meraki reseller. But I don’t want to covert my Meraki devices in paperweight since those won’t work without licenses. So finally my question is, are those devices suitable to buy the licenses for my own? Or those have a kind of disclaimer that doesn’t allow renew with licenses bought by me? Best regards!

Johnfnadez · ‎Sep 21 2022

I recommend to block the remote access apps on your MX Firewall and set a single app as default remote access and integrate it with LDAP Authentication. If an employee exists the company only remove the username on your Active Directory and that’s it. We as Network Security Engineer have to enforce policies in our company to keep it safe from the world. I don’t consider a good practice allow any remote access application in your Network because it opens a lot of attack surfaces. For example you can enforce to only permit RDP from Microsoft and authentication with 2FA agains Active Directory. If you consider my answer as solution please mark it as solution 😀 Regards!

Johnfnadez · ‎Sep 21 2022

Happy IT professionals day! For everyone who puts the knowledge every single day to keep the world connected and share the knowledge with the ones who are beginning on this world of networking. unfortunately my colleague that I want to mention on this post is no present on this community but I would like to mention my colleague Luis from Costa Rica, who has shared a lot of experience with my since I knew him!

Johnfnadez · ‎Aug 17 2022

Hello! I dont consider that disconnecting and isolating the network manually is a good practice for ransomware attacks, the best way is to configure policy enforcements in case of device compromising. In my experience I would consider a three alternatives: Using System Manager we can mark devices in quarintine https://documentation.meraki.com/SM/Monitoring_and_Reporting/Selective_Wipe_and_Device_Quarantine_in_Systems_Manager We can include devices in a Block List Or we can try to use Cisco ISE to enforce ACLs on the switchport and block any potential traffic. https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_maintain_monitor.html

Johnfnadez · ‎Aug 16 2022

I loved the way how everybody help each other and always are being humble!

Johnfnadez · ‎Jun 17 2022

Hello Friends! Few months ago I saw a topic on this forum about "How to test IDS/IPS on Meraki Firewall?" I really got this question and tried to answered for my self and now I want to share with you all a way to test the inspection on HTTP traffic that can be done by Meraki MX using IDS/IPS and AMP. Its probably somebody else discovered this way before but I want to share it and documented with you on this forum to help other Meraki People to test their enviroment safely. The only 3rd party software we need it "Postman" which is a well known program for people handling Automation APIs. In summary with this program we can generate HTTP/HTTPS traffic and use methods such as GET/POST against HTTP comunications. With that concept I realized we can use it to generate traffic passing thru Meraki MX and check if it works as expected at least the Instrusion system with a well-known false positive signature registered only for testing reasons. Well, for make this test straightforward I am using this page with HTTP service enabled which can be used as our target: http://www.testingmcafeesites.com/index.html And then the well known threat copying the text inside the file that can be found on this link: https://www.eicar.org/download-anti-malware-testfile/ NOTE: Accesing the link above could trigger your antivirus/security enforcements on your computer and organization because it is used for downloading well known malicious files to test different security features. Once we have the txt file downloaded from the page above, we can use the postman to send an HTTP POST with the text contained on the downloaded file in the following way: Finally just press "Send" and your computer will open the TCP connection against the site and then send the HTTP POST as we can see on this PCAP: Finally We can go to our Meraki Dashboard on: Security & SD-WAN => Security Center and We should be able to see the trigger we have activated: If you have any suggestions please let me know, also if you have any doubt, Johnny Fernández | Network & Security Engineer

Johnfnadez · ‎May 24 2022

Sure! You can get logs in two different ways, The first (easier) Going to the Network-wide tab and then to event log, you can download the sorted logs in a CSV file: The second way and scalable solution is via API, you can follow this link if you have some coding experience: https://documenter.getpostman.com/view/7928889/SVmsVg6K?version=latest#1982f77c-5ee6-49da-94f4-ee1a28794f59 I hope this information can be useful for you 🙂

Johnfnadez · ‎May 24 2022

Hi! You can get them from Meraki Dashboard via APIs

Johnfnadez · ‎Apr 21 2022

Have you checked if using another MTU solves this problem?

Johnfnadez · ‎Jul 24 2020

Awesome! Thank you!

Johnfnadez · ‎Jul 23 2020

IKE versions hava changed, you can check your peers

Johnfnadez · ‎Jul 22 2020

You can configure a 3rd party vpn with azure in the MX. https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_between_MX_Appliances_in_Different_Organizations It also applies for Azure, AWS and any IPsec peer. I have used for fortinet, Cisco ASA and another MX in different orgs

Johnfnadez · ‎Jul 21 2020

Yes, I have asked to Meraki Support and the say that I don´t have the requirements for having this feature, but actually I have the MSP portal

Johnfnadez · ‎Jul 21 2020

I´d like to know that are the requirements to qualify? bc currently I`m administrating around 6 organizations

Johnfnadez · ‎Jul 14 2020

Hi Merakiers!!! I hope that you are doing well I have a doubt and I haven´t found out something official from Meraki. Let me explain me: I have syslog servers on all my MX around the Country and I have been receiving logs regarding with URLs and the type regarding Meraki es "url" but I´d like to apply a kind of category like Cisco where i have different levels of syslog messages regarding the severity of them... But I don´t know how to remark this kind of log what level do I have to use??

About Johnfnadez

Johnfnadez

Community Record

Badges