About EricI

EricI · ‎12-23-2022

Same behaviour observed with CW9164 (no surprise) - got me confused for a while since there was no icon to "drag" when placing them in the floor plan 😄

EricI · ‎09-07-2022

Is anyone aware of the effect on the Office clients - do they recover after the failed download? Is the blocked update a Security or Feature update?

EricI · ‎09-07-2022

+us too - same file, same pattern, multiple international locations It would be good to know what Cisco TAC know about this - hopefully a false positive, and the alternative is not very promising.

EricI · ‎08-11-2022

Nope. No reports, no indications of anything similar to yesterday where all sites were affected and IPS events during the time frame increased from a normal of a few hundred to tens of thousands.

EricI · ‎08-10-2022

-Our own clients access to our own services were affected - only desktop applications, browser access was fine. -No Endpoint security related issues are reported from our endpoint security stack. -No issues are reported from the Microsoft security services used. -Clients that pass through other IPS / Threat detection services than the Meraki / Snort combo report no similar issues.

EricI · ‎08-10-2022

Yes, same problem here causing massive problems for Microsoft desktop applications unable to login using TLS 1.2. We whitelisted the Snort rule (Sid 1-60381) and reported a false positive to snort.org

EricI · ‎09-29-2020

We adjusted the lease down to 4 hours but I see no benefit from this as the IP address conflicts continue into the next lease. I ended up limiting the number of recipients receiving the IP address conflict alerts and will keep it this way for the coming weeks until the majority of iOS users are on iOS 14.

EricI · ‎09-23-2020

Thanks for the suggestion. I will absolutely be adjusting lease times. After reading a bit more about this subject it seems Apple does not really change the MAC periodically but only switches from the physical MAC to the "Private" MAC when this function is enabled, then keep this private MAC associated to that particular SSID. I guess what I am seeing is rather a side effect of guest users upgrading to iOS 14 these days, having the private MAC function enabled after the first boot, causing the "IP address conflict" situation temporarily.

EricI · ‎09-23-2020

In our guest network I have started seeing a side effect triggered by clients such as iOS 14 devices hat use MAC address randomization When a device is assigned a DHCP lease, then leaves the network to return later in the day within the address lease period, it tries to reconnect with a new MAC address at the same time re-using the previously leased IP address This causes an "IP address conflict" situation to be triggered and reported from the DHCP server on our MX - which I guess, theoretically is correct given the client behaviour. I know MAC address randomization can be disabled on corporate devices, but how to handle guests are another matter. One "solution" is of course to stop the reporting of IP address conflicts but sometimes this can be important to know about.

EricI

Community Record

Badges

Re: Map & floor plans not working properly with CW9166

Re: Advanced Malware Protection (AMP) retrospect alert

Re: Advanced Malware Protection (AMP) retrospect alert

Re: IPS Snort Microsoft Windows IIS denial-of-service attempt - False posit...

Re: IPS Snort Microsoft Windows IIS denial-of-service attempt - False posit...

Re: IPS Snort Microsoft Windows IIS denial-of-service attempt - False posit...

Re: False IP address conflict caused by client MAC address randomization

Re: False IP address conflict caused by client MAC address randomization

False IP address conflict caused by client MAC address randomization

Re: Map & floor plans not working properly with CW9166

False IP address conflict caused by client MAC address randomization

Re: IPS Snort Microsoft Windows IIS denial-of-service attempt - False posit...