About RomanMD

RomanMD · ‎10-21-2022

Once upon a time, there were network devices which had CLI interface ... 😬 The peoples administrating them were called Network admins... then a Merakle happened and all those admins left without a job 🤣

RomanMD · ‎10-06-2022

I only know the following regarding NTP. So, MX will use public NTP to sync time and is heavily dependent on it. If the MX will not be able to reach any NTP server it uses, it will reboot (don't ask me how I know this). So, I am not sure how you can perform audit stuff but whats I want to say is that as long as the MX is working then it reaches NTP and most probably is synced. I also don't know why would you really need it - since all events in Dashboard will most probably use cloud time instead of device time. Roman

RomanMD · ‎10-06-2022

Much appreciated! Thanks! Although this is not a competition but just a community where peoples are helping each other, it is nice to see some recognition for the effort. Thanks Roman

RomanMD · ‎09-14-2022

In a hell of an enterprise this is not easy doable. That's the long term goal, but not for the near future.

RomanMD · ‎09-14-2022

It depends about which Client VPN you are talking - IPsec VPN or Anyconnect? Meraki doesn't support it natively, but it is possible to integrate with 3rd party authentication solution which will provide another factor auth. (https://documentation.meraki.com/General_Administration/Other_Topics/Two-Factor_Authentication)

RomanMD · ‎09-14-2022

Hi everyone, recently I had the need to configure Meraki AnyConnect for a prof-of-concept project and I ran into some merakian issues. So, this post is meant to help others if they encounter the same problems. Let's start with the requirements: The main requirement was that users should authenticate with SAML, so that we can leverage 2FA. However, our SAML IdP is on-prem Active Directory Federation Services. The problem: Meraki does not have any specific guide on how to configure the SAML Authentication with ADFS. 👎 I went ahead and asked my ADFS team to configure the IdP as close as possible to what was described in the guide for Azure AD SAML configuration. However, this did not work properly. 😢 The user was prompted with the Authentication window to enter the username, password and the OTP, but then AnyConnect client returned some errors🤬: I did not know why it wasn't working, because I have no access 😤 to our ADFS environment. According to the AnyConnect troubleshooting guide and the error from Event log - it said to contact Meraki support, therefore I decided to engage Meraki support 🫡. After few ping-pongs 😴 with the support, I was very "surprised" 🤨 to hear that ADFS is not supported as Identity provider for AnyConnect. This was the message from development team which was relayed by the support engineer to me. But it was just another non-sense 🖕 from Meraki guys, since the ADFS or Azure AD would both use SAML 2.0 SSO which, by the way, the Meraki documentation says it is supported. I've decided not to rely on support anymore and go forward with my own testing 🥸 💪 . I spun up my own AD + ADFS Lab environment and figured out settings Btw: it was piece of cake to make it work. 🫢🥳 So, here we go: For this tutorial we will asume the network dynamic DNS is your-network-name.dynamic-m.com, however, for a production environment a custom DNS is recommended. In the Meraki Anyconnect setting we have to configure the following: 1. Upload ADFS Metadata XML file. 2. Configure the AnyConnect server URL: this is basically the network Hostname . You should add the port at the end, if you're not using port 443 for AnyConnect. This is all that has to be configured in the Dashboard. 🤪 The next part is to configure a new Relying Party trust on ADFS as following: (only significant settings will be shown ) The Claims should be configured as following: This are the basic settings that should be configured for the authentication to work. All other settings are either default or according to your needs. 🙃 Keep in mind, Meraki does not check any ADFS claim in order to allow or deny access, therefore if one has the need to only allow a set of users based on AD Security Group, this should be configured on ADFS side. Hopefully, Meraki will put up a nicer guide on how to configure the AnyConnect SAML authentication with ADFS 🤞 😈 .

RomanMD · ‎09-14-2022

Because the MXes in China and the one in Azure are in different organizations, you are totally right - Non-Meraki VPN would be the solution. This is working fine, it is just some considerations that you need to have in mind. 1. The non-meraki VPN will use standard VPN ports 500 and 4500. Those might be blocked by Chinese provider or Great Firewall. 2. Using AutoVPN should bypass the Great Firewall, because of the high ports which are usually not blocked. 3. Any of those solutions might break the law.

RomanMD · ‎09-06-2022

Hi, while this make sense as a request, Meraki says not to rely on the Dashboard Speed test, since it is there just for having some idea, not for really getting correct figures. This task has to be accomplished by installing a test-point in the network which will do this.That way you not only test the Internet line itself, but also the devices in between... Cisco has this feature with Thousand Eyes and there are rumours that Thousand Eyes will have a "Meraki" version... On the other hand, read here: https://community.meraki.com/t5/API-Early-Access-Discussions/SpeedTest-Endpoint-not-working-as-expected/m-p/147120#M535

RomanMD · ‎08-13-2022

Most of the time you talk to providers and they say the problem is not on their side. I see the need of more troubleshooting... I would do a trace to see how many providers are involved and would check what MTU is allowed end-to-end... the first step. I would also do a packet capture on both ends and see if I receive the packets from remote device...

RomanMD · ‎08-12-2022

Where would the MX know the user? If the MX is not the one to authenticate the user...

RomanMD · ‎08-11-2022

Now that you said "encryption domain" I recall having a problem, and the problem was the way the subnets were defined in the encryption domain. I had to define the subnets as they were configured, and not supernet them. Maybe you have changed the configuration here...

RomanMD · ‎08-11-2022

https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior

RomanMD · ‎08-10-2022

In the routing, the most specific route takes precedence, so you can have a route: 10.10.10.0/24 next-hop 10.9.9.1 -> route for the subnet 10.10.10.5/32 next-hop 10.9.9.2 -> route for the host

RomanMD · ‎08-10-2022

It is not supported. The first recommendation applies. For instance, if your MX is participating with other MX in AutoVPN and with Fortinet in IPSec, the devices behind IPsec tunnel can't talk to devices behind AutoVPN tunnel. What you report here, is very much similar to what I've described, therefore I would assume this is the reason, but I would open a case to confirm it. This is why I pretty much like to have dedicated hardware for different services....

RomanMD · ‎08-04-2022

The tunnel will stay disconnected until there is traffic on the tunnel. Can you generate some traffic with a ping and see if the tunnel goes up?

RomanMD · ‎07-28-2022

No, not on my side. But observed different behavior with the App. It seems that from time to time they have app updates even the newly downloaded app says it is the same version.

RomanMD · ‎07-14-2022

Meraki Dashboard is meant to manage and monitor Meraki devices not other 3rd party devices, regardless of what kind of information your IoT device will send. I don't expect such integration in the future either, at least not for non Cisco devices.

RomanMD · ‎07-14-2022

Name the networks accordingly and you will find the networks at a glance in dashboard. If you have multiple organizations/networks you need to have a well established naming concept.

RomanMD · ‎07-14-2022

Well, when you go to University it is supposed that you already know the alphabet. This is true also about the Meraki - when you embrace a cloud solution like Meraki, you like the fact that you can click in a nice dashboard but then when you scale, you find out that it does not work and also the old way of making excel templates also don't work, and you can only use APIs. And you must be ready to use the APIs. The script is in Python and uses the meraki library. I am sure if you'll search in the community you'll find some video guides of how to get started with Python, and then Meraki APIs. I've posted a xx$ worth script, if you want to use of it.. feel free.

RomanMD · ‎07-14-2022

Because I thought that it might be useful for me in the future. I might have some misses here and there, or not very efficient, but if you're like me and have 40 organizations.. then... dashboard = meraki.DashboardAPI(x_cisco_meraki_api_key, suppress_logging=True) organizations = dashboard.organizations.getOrganizations() SWITCH = True # Set to True if you want to display the vlans from MX APPLIANCE = True # set to True if you want to display the vlans from MS print("Organization,Network,Type,Subnet,Vlan name,Vlan ID") for org in organizations: networks = dashboard.organizations.getOrganizationNetworks(organizationId=org["id"]) devices = dashboard.organizations.getOrganizationDevices(organizationId=org["id"], productTypes=["appliance", "switch"]) for network in networks: if "appliance" in network["productTypes"] and APPLIANCE is True: networkSettings = dashboard.networks.getNetworkSettings(networkId=network["id"]) try: singleVlan = dashboard.appliance.getNetworkApplianceSingleLan(networkId=network["id"]) print(f"{org['name']},{network['name']},MX,{singleVlan['subnet']},,1") except Exception as e: pass try: vlans = dashboard.appliance.getNetworkApplianceVlans(networkId=network["id"]) for vlan in vlans: print(f"{org['name']},{network['name']},MX,{vlan['subnet']},{vlan['name']},{vlan['id']}") except Exception as e: pass if "switch" in network["productTypes"] and SWITCH is True: switchStacks = dashboard.switch.getNetworkSwitchStacks(networkId=network["id"]) switches = [switch for switch in devices if switch["productType"] == "switch" and switch["networkId"] == network["id"]] for stack in switchStacks: for serial in stack['serials']: for index, switch in enumerate(switches): switches.pop(index) stackVlans = dashboard.switch.getNetworkSwitchStackRoutingInterfaces(networkId=network["id"], switchStackId=stack["id"]) for stackVlan in stackVlans: print(f"{org['name']},{network['name']},MS-stack,{stackVlan['subnet']},{stackVlan['name']},{stackVlan['vlanId']}") for switch in switches: switchVlans = dashboard.switch.getDeviceSwitchRoutingInterfaces(serial=switch["serial"]) for switchVlan in switchVlans: print(f"{org['name']},{network['name']},MS-nonstack,{switchVlan['subnet']},{switchVlan['name']},{switchVlan['vlanId']}")

RomanMD · ‎07-12-2022

IP band? Or IP subnet? Are you looking for the IP subnet on the WAN interface or the IP subnets configured as L3 on the MXes (Addresses and VLANs) or maybe on L3 switches? If is one of the above, the information can be easily extracted by leveraging APIs.

RomanMD · ‎07-01-2022

Any static routes configured on the switch which might send the traffic to other destination instead to the ISP? Maybe the traffic is going via your internal network where you have an inline proxy/fw that decrypts the traffic? On the other hand, I can confirm that there was a problem with MX250 which could not connect to the dashboard. This could be solved only after updating the MX to the latest version using copper SFP instead of 1GB FO SFP.

RomanMD · ‎07-01-2022

Meraki switches are meant to be managed from the cloud. What you are referring to, most probably is the meraki-cli python module that is emulated kind of CLI interface. But that module is making use of Meraki API - and there is no api endpoint for your request. However, your request is easily done with a script and you will not have to copy/paste anything.

RomanMD · ‎06-30-2022

Hi @UCcert. Of course I have, but wanted to cross-check him! 🤣

RomanMD · ‎06-30-2022

Hi, we all know about the new AP models released by Cisco/Meraki which supports dual persona, so we can choose to have them WLC managed or Meraki Cloud managed. But those are new models and more expensive. Does somebody have any information - is there any plan to support Meraki Cloud Management on old Cisco 9k APs? C9115, C9120, C9130? Thanks

RomanMD

Community Record

Badges