Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About dromios
Community Record
25
Posts
1
Kudos
0
Solutions
Badges
Feb 2 2022
2:23 PM
Hello Everyone, I've been trying to put together a proposal for a customer to make sure when a user is let go, that they cannot reconnect. I read that you can do 802.1X authentication with the Meraki dashboard. Is it possible to use 802.1X authentication on an SSID to integrate with Azure AD using SAML SSO / Dashboard connection? I've read conflicting information on the forums and I can't mess with their infrastructure, unfortunately. They have no local RADIUS infrastructure, all machines are straight Azure AD Joined. Any insight is greatly appreciated. Thank you! Doug
... View more
Nov 25 2020
2:18 PM
It is a layer 3 switch, so we are going to go that route. Thanks for the feedback guys, I’m all set on this one.
... View more
Nov 25 2020
1:28 PM
The answer is no, the switch can't be managed in the last section. It looks like it's doable with the "extending the lan for a mixture of wireless and wired devices" with VLAN configuration, luckily this is a layer 3 switch, so I think I'll be fine. All VLANs are lost over the bridge though, so it's really just to provide management and so you can plug in wired devices.
... View more
Nov 25 2020
12:44 PM
That's what I'm trying to figure out as well, I just configured this section: "Configuration In order for repeater APs to share their wireless connection over their Ethernet port, the following requirements must be met: At least one bridge mode SSID must be configured in Dashboard (can be an existing SSID used by clients, but must be in bridge mode). APs must be configured to share the bridge SSID over their interface. By default, a client or device plugged into the Ethernet port of a repeater will gain no network connectivity. Once a bridge SSID has been configured, navigate to Network-wide > Configure > General > Device configuration, find the option to configure Clients wired directly to Meraki APs and set that option to have clients Behave like they are connected to the bridge SSID (as shown below)." I'll keep you posted once some time has passed.
... View more
Nov 25 2020
12:37 PM
Thank you, I think I stumbled across my answer here: https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Extending_the_LAN_with_a_Wireless_Mesh_Link It looks like out of the box it will work after a few configuration changes are made (post bridge connection), although it only works with access points unless you start routing on the other end.
... View more
Nov 25 2020
11:50 AM
Hello, I was currently handed the following equipment and asked to make a wireless bridge to a permanently docked ship. 1 x MX64 2 x MR70 2 x MR36 1 x MS120 - 8 FP 1 x PoE Injector The thought process is that we would set up the MX64 on land and connect it directly to a fiber circuit. We would then connect one of the MR70s outside facing the ship to a LAN port on the MX64, powering it with the PoE injector. On the ship, we would have another MR70 (powered by MS120 - 8 FP switch) acting as a repeater on a hidden SSID that only the two MR70s broadcast. We would then would power the two other MR36 access points on a different SSID and give it to the crew. From what I read, this appears to be a valid configuration, as long as no other wired devices are connected. We also want to be able to control throughput on the public SSID. Am I correct that this is a supported configuration? If not, is there anything we can do with our current equipment to make it work? When I set this all up, the right gateway comes up but all access points besides the gateway show as repeaters. Is this normal? Both SSID's are currently in DHCP NAT mode. Any guidance would be greatly appreciated. Thank you! Doug
... View more
Jun 12 2020
1:15 PM
That's correct. Good to know it works all the way back to 2012 and vice versa!
... View more
Jun 12 2020
7:22 AM
If you right click on nps you can export the config and import it quickly. Should work from 2019 to any other 2019/2016 server, not sure about 2012 or 2012 r2.
... View more
Jun 12 2020
7:13 AM
I forgot to mark this as completed. Another round of patches actually resolved the issue for me. If you don't have any more options I would put it on any server you have below 2019, that's what I did temporarily at least. It's not an ideal fix but when in a pinch it helps.
... View more
May 26 2020
1:31 PM
Hello, I have a client who had Meraki implemented by a third party some time ago and for some reason they isolated their firewall into its own network, screwing up the useful reporting features. I see that there is no way to simply move an MX device but I see that I can remove it from the network. If I remove it from the network and re-add it to the proper network (with APs, switches) will it lose its config? Would it simply be easier, and less risky, to move the other devices to the MX specific network and then rename? Thank you, Doug
... View more
Mar 30 2020
12:17 PM
I was looking at the text file auditing but just found more information in event viewer by enabling information events: I'm getting alerts that say "Network Policy Server discarded request for a user". Followed by: Authentication Details: Connection Request Policy Name: Meraki VPN Network Policy Name: Meraki Client VPN Authentication Provider: Windows Authentication Server: DC01.xxx.local Authentication Type: PAP EAP Type: - Account Session Identifier: - Reason Code: 9 Reason: The request was discarded by a third-party extension DLL file. That's something new to go on.
... View more
Mar 30 2020
12:11 PM
The dial-in properties are set to use NPS.
... View more
Mar 30 2020
11:57 AM
We have been using the Windows Server 2019 Standard built-in NPS for RADIUS. Nothing was upgraded, but Windows Updates were run and the servers rebooted before this stopped happening. I followed the documentation outlined here: https://documentation.meraki.com/MX/Client_VPN/Configuring_RADIUS_Authentication_with_Client_VPN It worked like a charm out of the box. I tried removing the Calling Station ID per the article, as it said some RADIUS servers wouldn't like it, but it didn't make any difference. I'm being prompted for the username and password but when I connect it get's stuck on "Verifying your sign in information" and it eventually says "The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is no permitted on the remote access server."
... View more
Mar 30 2020
11:47 AM
Hello, We have a client that is using RADIUS authentication for client VPN. It's been working fine up until the servers were patched. Has anyone run into this issue, and if so, come up with a resolution? Regards, Doug
... View more
Mar 30 2020
11:23 AM
I haven't been able to find documentation on doing MAC address filtering with wifi over radius. Do you happen to have any documentation or guidance?
... View more
I'll have to check and see if the users will show up but I remember specifically reading that you need to use Meraki authentication for users to show. I haven't had much time to play with it given recent circumstances.
... View more
Mar 12 2020
9:47 AM
Hello, I am looking for a solution to implement mac-address filtering along with user identification when a users connect to an SSID. From what I've read, to identify users Meraki Authentication must be used with a splash page, and LDAP/AD/RADIUS cannot be used. I saw that there was an option to connect via mac-address but that the solution does not offer encryption, which is upsetting. The only thing I've come up with to accomplish these goals is to set a small DHCP scope with hardcoded reservations for users and expand the scope by one any time a new user needs access to the network. This solution, coupled with splash screen Meraki Authentication seems cumbersome. I pondered simply renaming the wireless devices with the user's name, which may be a solution, but also cumbersome. Am I going about this the wrong way? Is there another option out there? Thank you, Doug
... View more
Mar 4 2020
10:55 AM
Okay, thank you for the clarifcation and your patience while I stumble through this ugly process 😛 You've been a real help.
... View more
Mar 4 2020
6:36 AM
@PhilipDAthto verify you are speaking specifically about the Azure extension. I was just confused because you said it was horrible. I thought you were implying that was an alternate way to do MFA using the authenticator without that extension.
... View more
Mar 2 2020
3:09 PM
I apologize for my ignorance, you mean the ability is just built into NPS. It's not the Azure extension or another extension?
... View more
Mar 2 2020
12:59 PM
Would you happen to know where I would get that extension to push notifications to Microsoft Authenticator? I've been googling around and can't find any documentation on it.
... View more
Mar 2 2020
12:58 PM
It seems to work great when it's set up and working, I was using something called a VMware Universal Access Gateway to tie into RSA. I don't have much experience with it outside of that. The appliance won't key with the endpoint. A different headache for a different day.
... View more
Mar 2 2020
12:35 PM
I appreciate the response. I work with RSA in a VDI environment and I know it's a pain. DUO would be my option but we were trying to leverage existing products and I thought Azure would be my best bet. They use Microsoft Authenticator already for MFA for Office 365, are you saying that there's a way to utilize radius and hook them up with a code? If so, I haven't been able to find it. Is it an NPS extension?
... View more
Mar 2 2020
9:03 AM
1 Kudo
Hello, We are looking to implement MFA for client VPN, and after some research, it seems like there are three options: RSA DUO MFA Server Since the MFA server isn't an option for new rollouts, I read that an Azure MFA NPS Policy extension can be used in conjunction with a Radius server to achieve the same result; this is what I was aiming to ultimately do. Here is where the confusion comes in. When I reached out to Meraki support, I had multiple technicians tell me that MFA for client VPN used to be a feature but it no longer is. Am I missing something, or did I get a few technicians who are misinformed? I was thinking it could've been that there were built-in (non-3rd party) solutions in the past, that has since been deprecated. I rephrased my question and both agents said that MFA and client-side VPN isn't an option anymore, even with the aforementioned technologies. Would someone be able to clarify the current situation, and if these technicians were misinformed, is the Azure MFA NPS Policy Extension a viable option? Thank you in advance. Doug
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 9647 |
© 2024 Cisco Systems, Inc.
