- About IT_Magician
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
IT_Magician
Here to help
Member since Jan 20, 2020
06-22-2020
Community Record
17
Posts
2
Kudos
1
Solution
Badges
06-02-2020
10:25 AM
Hi Nash, Thanks, we have standard setup, not sure if split or full tunnel but will investigate. In this scenario, how would virtual appliances work? The reason we deployed Umbrella Roaming client is to protect laptops with content filtering while they are outside of the network and not connected to the VPN, which means no firewall security. The goal is to have Roaming Client on laptops so they have content filtering outside of the office, but these users also require VPN from time to time. Mabye we could create a script where event log shows VPN connected and it disabled Umbrella client and when event logs shows deactivated it re-enables it.
... View more
06-02-2020
09:23 AM
YoYo Community, does anyone have a work around for this? Long story short, Cisco Umbrella support is saying Windows 10 VPN and Cisco Umbrella roaming client isn't compatible. You would think since Meraki only offers the built-in client VPN and Cisco owns both companies there would be a better integration, but that is not the case. Basically remote laptops with Umbrella client stop processing external domain DNS lookups once they connect to the VPN. Technical reason is below, but does anyone have a work around on this? From Cisco Umbrella support: The reason you are having issues with this VPN is because it utilizes a Microsoft connection API that requires DNS be sent to the local NIC, not 127.0.0.1 and therefore cannot connect. While there are some VPNs that are compatible with the Enterprise Roaming Client, unfortunately the built in windows VPNs are not at this time. Thanks, and go team!
... View more
05-09-2020
07:11 PM
Hey Bruce, Thanks for this - I got it working how I originally suggested. I am about to call the ISP though but wanted to see if you or anyone thinks this is an issue. Now on the client list I see devices from the ISP, not sure what they are, looks like all their stuff and mostly public IP addresses. If I click on my port 1 on the switch and look at current clients there is a list that keeps changing with new IPs.
... View more
05-09-2020
07:09 PM
1 Kudo
Go to network wide and clients, and sort by usage. Do you see large amounts of UDP traffic that could mean a broadcast storm somewhere?
... View more
05-09-2020
04:55 PM
Long story short, when the second MX is on the same LAN nothing works. Meraki has suggested we put all locations in their own organization. If that doesn't work I am out of ideas and will have to get a different unit. Very frustrated right now with all of this.
... View more
05-09-2020
03:42 PM
Ok 100% confirmed this is what is happening: We have auto-vpn MX We have a second non-meraki VPN MX The moment we plug the non-meraki VPN mx either directly into MX, or directly into Meraki switch, we get about 90% dropped DNS traffic. This is same result on WAN 1 or WAN 2. From Meraki dashboard it can pass traffic, but something is getting messed up once the second MX is plugged into the same LAN as the primary non-meraki MX. Any thoughts?
... View more
05-09-2020
03:24 PM
I am going to read this article you sent. I got it 100% working, but then 24 hours later we have an issue. DNS traffic will not route! No idea why, but if I remove the second MX which is handling our non-meraki VPN peers from the local LAN where the primary auto-vpn MX lives, the problem goes away. Meraki support believes we have a traffic leak somewhere - wanted to see if anyone had any insight? When I say DNS traffic can't pass, Google DNS, Cloud Flare, OpenDNS all fail to resolve DNS. I can ping 1.1.1.1 but no DNS traffic will work on either WAN 1 or WAN 2.
... View more
05-09-2020
01:07 PM
I have two sister companies in the same building. Our ISP provided us two WAN IPs but the modem only has 1 uplink port. We have a Meraki ms125 switch. What would be best practice for a setup like this: 1. Port 1 = WAN UPLINK from ISP 2. Port 2 = Internet 1 port on First MX 3. Port 3 = Internet 1 port on Second mX 4. Each MX internet port configured with the WAN IP from the ISP In this setup, how would I have to create a VLAN on ports 1 2 and 3 on the switch? Trunk or access? Or would I only do access port on PORT 1, and then tag on the UPLINK port on the MX to use VLAN on that section?
... View more
05-07-2020
03:03 PM
Hi Phillip, Thanks for your suggestions, the new MX came in and I am starting the configuration. I do have a question, can you double check this strategy is correct: 1. WAN 1 goes into New MX 2. I will build VPN tunnel on new MX to HQ This is the part want to make sure I don't mess up.... On new MX I created 192.168.100.0/24 network, MX IP is 192.168.100.1. I will assign that to a port, and then that port will become the internet uplink of my existing MX? If that is the case, where do I program the static route? On the existing MX?
... View more
05-01-2020
06:48 PM
Awesome, thank you so much for the suggestion. I want to clarify, when you say AutoVPN hub, you just mean the MX?
... View more
05-01-2020
12:29 PM
It is short sided on both sides, but we are just happy to win the contract and have to play by their rules. Why does Meraki not make this possible? It is simply a routing table, why does it care? I'm sure Meraki didn't go out of their way and has a reason this is not possible. We are going to purchase another firewall and make that the upstream WAN device and see if we can trick the Meraki. My hope is since Meraki will use it as the WAN anyway, once it its the upstream firewall it will be smart enough to route the traffic as needed.
... View more
05-01-2020
07:48 AM
After 100% success rate with Cisco Meraki installations, we have hit our first ever road block where Meraki isn’t working. It is a unique situation, and am really hoping someone here can provide some insight. Here is the setup: We are required to have a VPN tunnel with HQ. HQ only allows a single VPN tunnel, it is their corporate policy, no exceptions. We have no control/say/access over this network, but it is critical to the business. We have two locations, both 100% Cisco Meraki stack (MX67 with M S120 switches) Here is the issue: We have the VPN tunnel between HQ and Site 1, works 100% no issue. We have a Meraki Auto VPN between Site 1 and Site 2, works 100% no issue. Site 2 needs to go across the VPN to Site 1, and then across the VPN tunnel to HQ. This is our issue. Here are the things I have tried: Setting a static route on site 2, Meraki doesn't allow this. Settings site 2 as a spoke, with default route to site 1. Called support, they said Meraki doesn't support this type of configuration. Does anyone have a clever way to get around this? If we need to purchase more equipment or whatever it takes we will do it.
... View more
01-20-2020
04:02 PM
1 Kudo
Want to let everyone know - putting the MX in passthrough mode was the solution. By going into passthrough mode, I have this setup: WAN1/WAN2 plugs into SITE A MPLS Router MPLS Router plugs into Meraki in passthrough mode Meraki plugs into network switches In this setup, everything works as needed & the MX still does security functions
... View more
01-20-2020
03:15 PM
I guess that is my question. For site A, how would you configure the WAN port and LAN port on the MX?
... View more
01-20-2020
02:13 PM
The router 192.168.10.1 on SITE A has two WAN vendors: 1. A high speed 3rd party vendor 2. The MPLS vendor themselves have a WAN connection out here They handle all of this so I am not worried on this. On the Meraki MX devices, how do I actually configure the MX devices? Where I am getting confused, there technically is no WAN here, just a static route to the next hop. Does that mean I simply configure the MX with a static route, put in the information, and everything works correct? Do I keep MX in bridge mode or route mode? How do the settings on the MX look for something like this?
... View more
01-20-2020
01:57 PM
On Site A, WAN 1 and WAN 2 are both plugged directly into 192.168.10.1 - that vendor handles all WAN and fail over. The goal of the MX devices are to: - Have it so all devices show up in the client list - Have security services work (content filtering & threat protection) Do I need to confirm what IP addresses the LAN devices are being given? I didn't get that info because that is handled by a DHCP Windows server, but I can obtain that if needed.
... View more
01-20-2020
01:47 PM
Hi Meraki Community, I am replacing legacy SonicWALL routers with new Cisco Meraki MX routers. The existing SonicWALL routers are between the MPLS/WAN vendor's router & the network switches for the local LAN. All traffic is routed through SITE A. Site A has WAN 1 and WAN 2 provider, which plugs into the MPLS/WAN vendor router. Site B has the SonicWALL's WAN configured as the private network on the site A side. I built a diagram below, can someone help me understand how to configure the Meraki MX devices to work in this setup?
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 491 | 01-20-2020 04:02 PM |
My Top Kudoed Posts
