Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About LV_MW_MSP
LV_MW_MSP
Getting noticed
Member since Aug 28, 2017
Jul 26 2019
Community Record
30
Posts
16
Kudos
0
Solutions
Badges
Mar 19 2019
3:03 PM
Not all routers are the same, I have seen Google WIFI mesh routers block all VPN traffic. I would try enabling PNP on your main router, and also Google what the standard VPN ports are, and port forward those from your TP-LINK to your Z3 and see if that helps.
... View more
Mar 14 2019
9:57 AM
1 Kudo
We all know at times Meraki AMP will block items and not log it on the security center, this is well known. However this time we had a customer push us to get why this happened, and Meraki support told us that the security center will log IDS, but not the advanced malware protection (AMP). Just figured I would share and see if anyone else came to this conclusion, and if you did, why wouldn't they want to log AMP blocks? Would be nice for reporting to show the customers more things we are preventing + troubleshooting.
... View more
Jan 31 2019
6:54 AM
1 Kudo
We have an MX 100 on the front, tagged a WAN IP with 1:1 NAT to a MX64 (for a second business in same network) and the second business has some remote desktop servers. On January 30th 2019 in the morning, SNORT released the following rule: - OS-WINDOWS Microsoft Windows Terminal server RDP bypass attempt - Rule ID 1-49040 What I just learned from Meraki support, even though the client was white-listed, they are telling me white listing only affects outbound traffic initiated from that device. White listing has nothing to do with external traffic hitting an internal device. I guess not many people are doing what we are doing, and we will be using a layer 3 switch in front moving forward to prevent the 1:1NAT rule. It did peak my curiosity, can anyone confirm this. It seems that white listing doesn't disable AMP or IDS. Secondly, if you create a custom group policy, it is possible to disable AMP, but you can't disable IDS for a specific device. In any event, the fix was to white-list the new rule the SNORT released, and everything is working again.
... View more
Dec 20 2018
7:56 AM
That is 100% dependent on your setup. I will say though even though Meraki lacks this feature, and some other ones you would think are common, I have never hit a "there is no other way" to obtain the end result. Contact Meraki support and see if they have a beta firmware or something you can try, otherwise you will have to figure out how to make it work within the limitations of Meraki.
... View more
Dec 20 2018
7:52 AM
1 Kudo
For those still having an issue getting Windows Client VPN to work with the MX, I can shed some light on what we learned and how we fixed it. From our experience there are two types of reasons why the client VPN will not connect: 1. For Windows 10 you must edit the registry to allow VPN traffic to pass when the machine is behind a NAT. Enable UDP Encapsulation in the registry and reboot the machine. This will fix the issue most of the time. https://support.microsoft.com/en-us/help/926179/how-to-configure-an-l2tp-ipsec-server-behind-a-nat-t-device-in-windows I have my registry key set to 2 and I can VPN into most customer networks. 2. The NAT device for whatever reason is not allowing the VPN connection. The NAT device is the firewall, or whatever device the computer is sitting behind. For example, we had a remote user behind an old SonicWALL firewall and after updating the firmware the VPN traffic was able to pass through the SonicWALL. Another common one are those junk/crap Google WIFI mesh systems. Those WILL NOT pass VPN traffic, and if it does, it is only a matter of time until it stops working. The core issue is Google is unable to properly forward VPN traffic from the main router to the mesh WAPs properly, and they offer zero support. I got around this by opening the ports for VPN traffic and pointing it to a static IP, but that was a temp fix. We replaced the Google WIFI router system with a Meraki and it 100% solved the issue. At the end of the day, either your settings are wrong, you don't have UDP encapsulation enabled, or your remote device is behind a physical firewall that is not allowing the VPN to work.
... View more
Dec 20 2018
7:41 AM
If I remember correctly, there is no way to NAT outbound traffic to a specific IP address. You can NAT it out to WAN1 or WAN2, but to NAT out to ip #2 on WAN 1 I don't believe is possible. Maybe there has been a feature released allowing this since the last time I had this problem (about 6 months ago) but not sure. I would try calling Meraki support and see what they say. BA
... View more
Dec 20 2018
7:36 AM
We are also starting to get hammered with this alert -- also looking into this now.
... View more
I have a guest and private WIFI setup. Customer wants the guest WIFI going out the backup internet connection. Can I do this with NAT Mode on the WIFI SSID? I tried putting the 10 network on traffic shaping but it told me that isn't a configured subnet. If not I will setup a VLAN and bridge it to the MX and do it that way, was just curious if this can be done with NAT Mode on WIFI. Thanks,
... View more
Apr 26 2018
10:41 AM
Contact Meraki support -- they are extremely helpful and can help you navigate this. I know our dashboard is setup as an MSP -- so we have something called MSP Portal as an option which all customers are viewed in that dashboard. Call Meraki support, they can help or at least tell you how to accomplish what you need to do.
... View more
Apr 17 2018
3:37 PM
4 Kudos
Hi Jimmy, Try logging into the Meraki Dashboard, and clicking your name on upper right corner, and update your email from there. You should be able to change it from user@domain.com to whatever you want, and those permissions will carry throughout all organizations. That is one nice feature of Meraki -- let's say you fire someone and need to change the password. Once you change the PW for that account, access to ALL networks have been updated. That is because that account is granted access to each account. When we onboard a new Meraki customer, we grant access to our general MSP account, and then myself and another high level tech specifically.
... View more
Apr 16 2018
10:19 AM
Best I have seen for price/performance with security enabled is Fortigate by Fortinet.. check them out, they score very high next to Palo Alto on threat detection. Out of the box they do SSL decryption by doing MITM -- I lost a bitcoin company who went with Fortinet because of price and performance. They needed a 1Gbps connection, and 100% require everyone to VPN to access all resources. The Meraki was way more expensive and slower.
... View more
Apr 16 2018
10:10 AM
Nice I will look into that.. we are setting Pingdom up now to monitor WAN 2 until Meraki can add it as a feature.
... View more
Apr 16 2018
10:08 AM
Correct, having that enabled will not send us an alert. That will alert if primary up-link fails, but let's say your ISP changes your WAN 2 IP addresses, so it fails. Meraki has no way of letting you know. You could go months not realizing your WAN 2 is broken, and only find out when primary fails and the WAN 2 doesn't pick up. Triple checked, we do have "primary uplink status change" enabled.
... View more
Apr 16 2018
9:59 AM
6 Kudos
Hi Meraki, Want to throw out a feature request. I have a customer with two WAN links. Well for some reason WAN 2 went into a failed status, and we only found out because we logged in and saw packet loss is 100% on WAN 2. No alerts were received because Wan 1 is still primary and no fail over has occurred. It would be nice to get email alert if WAN 2 is offline so we can contact the ISP and investigate.
... View more
Apr 9 2018
7:43 PM
Thanks, our accounting team is looking into it. Once I have a concrete answer I will share with the community. I appreciate the feedback.
... View more
Apr 9 2018
3:00 PM
Hi Meraki, I know sales tax is different between states, but I am trying to identify is the Meraki License is actually counted as software and should not be taxed. This link gives good information: https://www1.avalara.com/us/en/learn/software-sales-tax.html?sessionId=1523309824179&referrer=&lastReferrer=www1.avalara.com There is either canned software, or software that is delivered on tangible property. Technically the software is delivered on the tangible property, however it is unlocked through the licensed. Any feedback would be greatly appreciated.
... View more
Mar 28 2018
4:21 PM
There is no internal domain. Both of these networks are WORKGROUP -- both also have a Synology NAS. From any computer, I can open cmd prompt and type ping NAS, and it resolves. I can also do ping HOST of any of the computers in the network, it works for all of them.
... View more
Mar 28 2018
4:18 PM
Hehe, yeah, I already tried the ipconfig /flushdns I actually have a client running this configuration for a year now, and same thing, somehow internal names can resolve. I can ping any hostname from any computer, and it will somehow resolve internally.
... View more
Mar 28 2018
3:57 PM
I have a network where DHCP was set to proxy to upstream DNS. ipconfig /all shows DNS for internal clients is Meraki local IP. I then set DHCP to proxy to OpenDNS. I did ipconfig /renew and now DNS is set as 208.67.222.222 and 208.67.220.220 How come when I ping internal DNS names (like device1, device2, device3) it still works? If I do NSLookup, it fails, but if I ping, it does resolve the internal IP address properly. How is that working if the DNS servers is set as OpenDNS? Also note, I went as far as testing multiple computers, checking HOSTS file, and doing ipconfig /flushdns -- somehow the device knows to search locally for that device instead of using OpenDNS DNS servers.
... View more
Mar 3 2018
4:02 PM
That is what I thought, but why would the Meraki tag it as "malicious" -- shouldn't it be "unknown", or was it tagged as malicious because it thought it was?
... View more
Mar 2 2018
10:04 AM
Hi Meraki Community, On 2/28/18 we received the an IDS alert. Below is the screen shot of the alert from the Meraki security center. What I find very confusing is the Meraki has tagged this as malicious, however it allowed it. But then I called Meraki support, they stated that the firewall actually blocked it. They said the reason it shows allowed is they let a single packet through to scan, saw it was malicious, and then blocked the rest of the file. If that is the case, why not tag is as blocked on the dashboard? Then it gets weirder. Today we received an email alert stating the same file has gone from an unknown to malicious deposition. But Meraki support told me the first alert was known to be malicious and actually blocked (even though it reads allowed), so why am I now getting an alert stating as of today it's now malicious. Now if I go into security center here is what I see: My gut tells me the first alert on the 28th was not blocked, but actually allowed, and now the Meraki knows it was an actual threat. HOWEVER, if that is the case, why does the alert on the 28th state Malicious?
... View more
Feb 28 2018
9:50 AM
Can you create a logon script, or leverage an RMM tool to automatically keep executing a script that does this? If you have the correct version of Windows 10, you could leverage Microsoft Direct Access servers. This will make it so anytime your Windows 10 fleet has internet it automatically VPN connects back to your internal domain and systems.
... View more
Feb 28 2018
9:47 AM
1 Kudo
Unless I am missing something, can't you apply a custom group policy to this machine. Wild card all internet with * so everything is blocked, and whitelist the items you want. Apply that group policy only to your terminal server. You can also set a schedule on this.
... View more
Jan 27 2018
1:48 PM
On WAN #1 we have multiple public IP addresses. I need to force VLAN 5 traffic to a specific public IP on WAN 1. Flow preferences only show we can force it out WAN 1 or WAN 2, Meraki support doesn't think this is possible. Before we buy more hardware, does anyone know of another workaround for this? Another example, rule that entire subnet goes out specific public IP on WAN1. Previous posts also say this isn't possible, hopefully there is a work around. Thanks,
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 6 | 3126 | |
| 4 | 6247 | |
| 1 | 3874 | |
| 1 | 3560 | |
| 1 | 23738 |
© 2024 Cisco Systems, Inc.
