Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About SimonReach
SimonReach
Building a reputation
Member since Jan 9, 2018
yesterday
Simon Peart
UK
Community Record
79
Posts
16
Kudos
2
Solutions
Badges
Oct 17 2019
1:27 AM
Hi Nash, What we've essentially done lastnight and this morning is change the Meraki filtering to the big things, we've got Kaspersky to restrict stuff like Facebook access, so we're now only blocking Adult & Pornography, Bot Nets, Confirmed SPAM sources, Hacking, Illegal, Keyloggers and Monitoring, Malware Sites, Open HTTP Proxies, Pay to Surf, Peer to Peer, Phishing and Other Frauds, SPAM Urls, Spyware and Adware, and Unconfirmed SPAM sources. Our network is an MX100 > a stack of 2xMS250s (this has all the layer 3 and OSPF stuff on) > stack of 4xMS210s which is where the clients are plugged into. edit: I've had a quick read through of the Client Tracking Options document, the only options i have for Client Tracking under 'Security and SDWAN' > Configure > Addressing & VLANs is MAC Address (what it's set to now) and IP address which is greyed out.
... View more
Oct 16 2019
8:23 AM
Thank you, we've removed some of the tamer categories, we also use Kaspersky Endpoint which does webfiltering as well, so will see how it goes. It does seem to be the first time that someone goes to a certain website, it causes the delay but any further visits to the site are fine. Also, is there a way to trace the 'Content Filtering Blocked URL' back to a particular user or machine rather than just the mac address of a Meraki device?
... View more
Oct 16 2019
7:07 AM
Abortion, Abused Drugs, Adult and Pornography, Alcohol and Tobacco, Bot Nets, Cheating (Academic), Confirmed SPAM sources, Cult and Occult, Dating, Games, Hacking, Hate and Racism, Illegal, Keyloggers and monitoring, Malware Sites, Marijuana, Nudity, Online Greeting Cards, Open HTTP Proxies, Pay to Surf, Peer to Peer, Phishing and Other Frauds, SPAM Urls, Shareware and Freeware, Spyware and Adware, Streaming Media, Swimsuits and Intimate Apparel, Unconfirmed SPAM Sources, Violence and Weapons.
... View more
Oct 16 2019
7:03 AM
Since we replaced our ASA on saturday with an MX100, we've had a lot of issues and complaints about internet connectivity being slow and unreliable. As an example, someone would click a link to an article in the Guardian newspaper, it would spent 5-10 seconds thinking about it, flash up with an error saying the page can not be loaded and then the page would immediately pop up. We can't see anything in the event logs that might be causing it but we do get a lot of urls blocked regarding spotify and something called offers-api-ghostery.net. The event log also doesn't allow us to pinpoint exactly which machine tried to access the blocked content. AMX is enabled, content filtering is turned on and the IDP is enabled as well with the ruleset set to Security.
... View more
Oct 8 2019
3:13 AM
Hello, thank you for the reply. OSPF was all enabled but we got the ISP, who looks after the MPLS router and network, to log in as we were doing some testing. The VPN static route that the MS250s were presenting to the MPLS router through OSPF was being seen as an OSPF External network which was being blocked, so essentially the ISP engineer just had to tick a tickbox to allow external networks and it all started working.
... View more
Oct 7 2019
2:29 AM
Quick and simple question hopefully. We're configuring an MX100+MS250s at our head office, we also have an MPLS connection that's plugged into the MS250 which gives the Meraki network access to all of our other offices the other side of the MPLS router. This has all been tested and works fine so any device plugged into the Meraki network can connect to the internet, through the MX, and to the MPLS network. However, any devices connecting to the client VPN can't see the other side of the MPLS, only vlans within the Meraki network. We've got a client VPN setup on the MX100, we've got a static route setup in OSPF config for the Client VPN on the MS250 that points it at the MX ip address but do we also need the client VPN vlan setting up in OSPF as an interface as well?
... View more
Mar 26 2019
3:30 AM
Thank you. I'm hoping the plan is to get some of the smaller MX devices at the branch offices as then it'll give us much more visibility in regards to data traffic between sites and any devices that might be flooding the MPLS links, this is something we don't have now as we do sometimes have issues of "over-utilisation" with a couple of devices at our branches with the more basic WAN connections, we have several that struggle to get 2Mb.
... View more
Mar 26 2019
3:10 AM
Yes, both of the main offices have multiple VLANS, the plan with the Meraki kit is to expand the VLANs a little more. Main Office 2 So currently we have a VLAN for Wireless and IDRAC, a VLAN for Servers and Clients and Printers, a Management VLAN for the switches, a Phone System VLAN and a VOIP VLAN for all of the handsets. Plan is to expand this to lock down the ERP systems to there own heavily locked off VLAN as well. Main Office 1 doesn't have the dedicated Wireless/IDRAC VLAN but is essentially the same. All of the branch offices have 2 VLANs, a Client/Server/Wireless/Printer VLAN and a VOIP Handset VLAN. Our current issue is everything is Cisco kit so network management is a pain and as the kits been upgraded, there's been a lot of left over, old stuff migrated to the new kit so there is a lot of rubbish left over in there as well.
... View more
Mar 25 2019
3:59 AM
Hi everyone, We've got a solutions specialist coming in tomorrow to discuss upgrading our switches to MX/MS devices, currently we're a cisco house. The basic network is we've got 2 main offices on either side of the country (UK) and then 5 smaller branch officers. Main Office A - 100Mb internet connection through fibre and a second fibre connection to the MPLS network which connects to the rest of the offices. There is a layer 3 switch that either pushes traffic to the ASA and then off to the internet and then all internal traffic to the other sites goes through the MPLS router. Main Office B - 100Mb internet connection through fibre and a second fibre connection to the MPLS network which connects to the rest of the offices. There is a layer 3 switch that either pushes traffic to the ASA and then off to the internet and then all internal traffic to the other sites goes through the MPLS router. Branch Office 1 - 5 - between a 2Mb to 10Mb connection through the MPLS and then all external internet traffic goes through Main Office A. My basic knowledge of the Meraki MX setup would be to have 2 MX devices, 1 at each of the Main Offices that'll look after the connections to the internet and keep them secure and then the branch offices will remain with their current config for the time being with them connecting through their existing MPLS router to get internet connectivity from one of the main offices. Talking to the solutions specialist, he's recommending a single MX device at Main Office 2 and then route all internet traffic through that and get rid of the second internet connection, which we're reluctant to do as then we'll lose failover which we really need as the offices are rural so internet connectivity and power tend to be a little unreliably sometimes. Also, my presumption is that there will be no changes hardware wise to the MPLS side of things? So the layer 3 switch will still route internal MPLS traffic through the MPLS router and that wouldn't touch the MX device at all? edit: Just an additional thing as well to add, we do have web servers at Main Office 1.
... View more
Feb 21 2018
6:15 AM
Thank you.
... View more
Feb 21 2018
4:29 AM
Simple question, is there a way to manually edit the Network Topology?
... View more
Feb 13 2018
2:00 AM
1 Kudo
Everything is now working fine with a multimode SFP and a multimode fiber connection. I always thought a fiber cable was a fiber cable and that the only differences were the ends, i'm a bit smarter now so thank you everyone.
... View more
Feb 9 2018
7:59 AM
1 Kudo
Thank you Ordered a Cisco Meraki MA-SFP-1GB-SX 1000Base-SX which is multi-mode and a 1m 62.5/125 LC - ST multimode fiber cable. Hopefully this is correct.
... View more
Feb 9 2018
7:41 AM
The layer 3 switch at the other end, in the server room, is ethernet only i'm afraid otherwise it would have been easy. I haven't seen any Meraki branded SFP connectors at all? Does the wave length matter on the spec of the SFP connector? edit: The TP-Link MC200CM converter at the other end is a Multimode 1000BASE-SX connector. So presumption is that i need an SX 850nm Multi Mode converter.
... View more
Feb 9 2018
7:31 AM
At the other end of it all in the server room, the fiber connection goes into a TP-Link MC200CM Multi-mode Media converter but fiber cable that plugs into that is grey which isn't any help. The yellow fiber cable is definitely single mode and the SFP states that 'single-mode fiber (SMF) is supported' on it, which presumably means i've got a single mode SFP with a single mode cable one end with a multi mode converter at the other end. So to resolve the issue, i need to get a multi-mode cable and a multi-mode SFP?
... View more
Feb 9 2018
7:03 AM
The yellow Fiber cable is new, it's a different connection into the SFP than into the Fiber converter so the only 2 things i can't test are the new Fiber cable and the SFP. The description of the Fiber cable is 'Fiber Mode Structure - Single-Mode'. Looking at the old fiber cable, that works fine, is there a way to spot if it's singlemode or multimode?
... View more
Feb 9 2018
6:47 AM
Made sure the fibers were the correct way round but i tried it both ways as one of the ways the fibers were; the port didn't light up at all. I don't see any jumper at all on the SFP and the cable is a LC/ST, M/M that's 1m long.
... View more
Feb 9 2018
6:21 AM
Just having a small issue configuring a new Meraki switch that is replacing a very old Cisco switch. The very old Cisco switch connected to our Layer 3 switch through an Ethernet to Fiber converter with another Fiber to Ethernet converter on the other end of the fiber to plug it into the Layer 3 switch. The plan with the new Meraki switch was to make use of 1 of the 4 SFP connections on it but that doesn't seem to work at all. I've plugged a brand new 'ProLabs SFP-LX-10-D-C, 1250 Mbit/s, SFP, LC, LX, Fiber Optic, 1310nm' into one of the SFP connections, configured that connection as a Trunk and then plugged a brand new fiber cable into it and nothing happens apart from a solid green light comes on on the port to say there is a connection on that port but the Meraki switch doesn't connect to the internet and the Fiber to Ethernet converter in the server room says that there is no link. At the moment the switch is running absolutely fine with Ethernet Port 48 configured as a trunk and then have that plugged into the old Ethernet to Fiber converter and done it that way. It would be nice to get the SFP adapter working though so we've got 1 less point of failure over there.
... View more
Jan 15 2018
1:28 AM
Happy to report everything is now running happily. A few issues with a couple of firewalls, both the Windows and the Kaspersky firewalls we have and a couple of static routes needed putting in but everything is now working fine. I tried a VOIP phone from home and it would register but as soon as i tried to log into the VOIP phone, it struggled to do anything but that's something i'll investigate another time. Reading up, it's looking like the best setup for us, with the home users and the small branch office with ADSL is to setup Z1s and Z3s instead of MXs. With about 5 of the Z series that we'll roll out to people, covering between 5-10 clients, is it worth having anything other than an MX64 in our server room here?
... View more
Jan 12 2018
2:05 AM
On the ASA, there is a static route - Inside - 100.100.100.0 255.255.255.0 10.14.130.149 On the Layer3 Core switch, when doing a 'show ip route', i get 100.0.0.0/24 is subnetted, 1 subnets S 100.100.100.0 [1/0] via 10.14.130.149 When doing a tracert from my computer to 100.100.100.1, i get: 10.14.130.250 - Core Switch 10.14.130.149 - Office MX 100.100.100.1 - Home MX When doing a tracert from my computer to 100.100.100.2, i get: 10.14.130.250 10.14.130.149 Times out. When doing a tracert from the Meraki dashboard on the home MX to 10.14.130.1, which is the office DNS. It jumps to 192.168.0.1 as the first hop and then times out. Not sure if that's right or if it should jump straight from 100.100.100.1 to 10.14.130.149 for the first hop? I've checked all security and firewall settings on the home router and everything is turned off, i've also put the meraki switch in a DMZ as well and didn't change anything.
... View more
Jan 11 2018
12:00 PM
Already done that a couple of days back i'm afraid :). I added it back into the asa as well which resolved the internet dns issue and i was able to rdp from the home laptop to my work computer via ip, still can't ping any hostnames on the 10.14.130.0 network but am able to ping hostnames on the 10.13.130 and 10.16.130 network so definitely a routing issue somewhere in the core switch. That is the final thing to get working, oh and i still can't connect or ping from the office network to anything on the home network apart from the home mx. The voip handset as well is really struggling presumably because QOS isn't turned on.
... View more
Jan 11 2018
5:27 AM
On the Office MX - Site to Site VPN Type - Hub Local Networks - 10.0.0.0/8 (this will cover all off our offices and their subnets) NAT Traversal - Automatic Remote VPN participants - Hemswell (this is the home MX) with a subnet of 100.100.100.0/24 Under Route Table, there is 1 subnet of 100.100.100.0/24 via VPN peer: Hemswell On the home MX- Site to Site VPN Type - Spoke Hubs - Office - appliance and Default Route is ticked. Local networks - 100.100.100.0/24 and use VPN is yes NAT Traversal - Automatic Remote VPN participants - Office - appliciance with subnet of 10.0.0.0/8 Under route table - 100.100.100.0/24 via local LAN, 0.0.0.0/0 via 2 routes, 10.0.0.0/8 via vpn peer: office - appliance. edit: Just a quick edit to say that under route table, everything has a green status.
... View more
Jan 11 2018
3:54 AM
Doesn't show up when i did show config but just done a show ip route and the below came up. OP-CORE-SW-01-CO#show ip route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + - replicated route, % - next hop override Gateway of last resort is 10.14.130.253 to network 0.0.0.0 S* 0.0.0.0/0 [1/0] via 10.14.130.253 10.0.0.0/8 is variably subnetted, 18 subnets, 3 masks S 10.0.0.0/8 [1/0] via 10.14.130.244 C 10.13.130.0/24 is directly connected, Vlan13 L 10.13.130.249/32 is directly connected, Vlan13 C 10.14.100.0/24 is directly connected, Vlan303 L 10.14.100.254/32 is directly connected, Vlan303 C 10.14.130.0/24 is directly connected, Vlan14 L 10.14.130.249/32 is directly connected, Vlan14 L 10.14.130.250/32 is directly connected, Vlan14 C 10.14.140.0/24 is directly connected, Vlan140 --More-- L 10.14.140.1/32 is directly connected, Vlan140 C 10.15.130.0/24 is directly connected, Vlan15 L 10.15.130.1/32 is directly connected, Vlan15 C 10.16.130.0/24 is directly connected, Vlan300 L 10.16.130.254/32 is directly connected, Vlan300 C 10.17.130.0/24 is directly connected, Vlan302 L 10.17.130.254/32 is directly connected, Vlan302 S 10.250.130.0/24 [1/0] via 10.14.130.253 S 10.251.130.0/24 [1/0] via 10.14.130.253 100.0.0.0/24 is subnetted, 1 subnets S 100.100.100.0 [1/0] via 10.14.130.149 147.152.0.0/24 is subnetted, 2 subnets S 147.152.20.0 [1/0] via 10.14.130.244 S 147.152.22.0 [1/0] via 10.14.130.244 S 192.168.0.0/16 [1/0] via 10.14.130.244 Just a quick update, having a static route back into the ASA, as well as the Core switch, and i can now ping the internet from the home MX which is another step forward. I still can't connect to the home laptop though that is connected. The thing i find strange is that when i go into the Tools part of Appliance Status for the home MX, i can't ping the laptop which is 100.100.100.2. If i click on the laptop in clients and ping from there, it pigns fine with a latency of 1ms
... View more
Jan 11 2018
2:53 AM
Hi DCooper, Thought i had managed to sort it but still struggling a bit and i'm sure it's a simple routing issue somewhere. Below is an email i sent over to Meraki support this morning. --- How it’s setup currently Office: MX65W gets ip through DHCP, a gateway of 10.14.130.250 and the DNS servers from DHCP which is 10.14.130.1 and 10.100.0.3 (this is in the other main office) Office: MX65W (10.14.130.149) > Access Switch > Core Switch (Layer 3) 10.14.130.250 > ASA 10.14.130.253 > Internet Home: MX65W (100.100.100.1) > Virgin Router > Internet There is a static route in the core switch which is 100.100.100.0 255.255.255.0 10.14.130.149, so any traffic going to that subnet is routed through the Meraki MX device in the office. The Site to Site VPN is reporting to by fine, the office MX65 can ping the internet and can ping 100.100.100.1 (Home MX) but not a laptop connected to the home MX which is 100.100.100.2. The home MX can not ping the internet, client computers on the 10.14.130 range, any subnets outside of the main office so the 10.100.0.0 subnet, but can ping the servers on the 10.14.130 range, all devices on 10.13.130, all the VOIP handsets on the 10.17.130 range. DNS is also not working at all so can’t ping host names from home. From a home laptop connected to the home MX, I was able to use things like Citrix and connect to servers in the office but again through IP and not hostname. The DNS servers that are configured in DHCP on the home MX are 10.14.130.1, 10.100.0.3, and 8.8.8.8. These DNS servers do show up in IPCONFIG on my home laptop. --- End of email. Since the email, i've made both MXs static and hard coded the ips and dns in, same settings on both, no difference at all. Office MX ip: 10.14.130.149 subnet: 255.255.255.0 gateway: 10.14.130.250 dns 1: 10.14.130.1 (DNS in the office) dns 2: 8.8.8.8 Home MX ip: 192.168.0.5 subnet: 255.255.255.0 gateway: 192.168.0.1 dns 1: 10.14.130.1 (DNS in the office) dns 2: 8.8.8.8 The static routes in the Core switch at the office (Layer3) is ip route 0.0.0.0 0.0.0.0 10.14.130.253 ip route 10.0.0.0 255.0.0.0 10.14.130.244 ip route 10.250.130.0 255.255.255.0 10.14.130.253 ip route 10.251.130.0 255.255.255.0 10.14.130.253 ip route 10.255.236.0 255.255.252.0 5.20.87.176 ip route 147.152.20.0 255.255.255.0 10.14.130.244 ip route 147.152.22.0 255.255.255.0 10.14.130.244 ip route 192.168.0.0 255.255.0.0 10.14.130.244 10.14.130.244 is the MPLS to our WAN. 10.14.130.253 is the ASA to the internet. The main network for clients in the office is 10.14.130.0 which is VLAN14, the ip for vlan14 is 10.14.130.250 and when you telnet to that you get the core switch. One of the things i tried lastnight was to put the Virgin Router into Modem mode, no difference at all.
... View more
Jan 10 2018
1:54 AM
Think i'm getting there, i'm in the process of learning the cisco side of it and we've got some old static routes from a previous network that were brought over. I understand our network a lot better this morning than i did yesterday but what was essentially happening yesterday was, as i understand it now, Client > Access Switch > Core Switch(Layer3) > ASA > Internet I put the route in the ASA but it was getting stuck in the Core Switch so the ASA route wasn't doing anything. I've put the static route in the Core Switch now and removed it from the ASA, so anything connecting to 100.100.100.0 network now goes Client > Access Switch > Core Switch(Layer3) > Meraki (Office) > Meraki (Home - 100.100.100.0). As it stands now, i can ping the Meraki (Home) from my work client but can't ping the laptop plugged into it. I also can't ping the laptop at home either from the Meraki device at home so will look tonight when i'm back at home. Thank you for your patience but think we're there.
... View more
- « Previous
- Next »
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 255 | a month ago | |
| 516 | Oct 22 2024 2:51 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 416 | |
| 2 | 391 | |
| 2 | 634 | |
| 2 | 646 | |
| 1 | 1283 |
© 2025 Cisco Systems, Inc.
