Meraki

MacuserJim · ‎Oct 30 2018

I am not sure about that one... The best answer I have (at least right now) is to track down which IPs your office is using for Office 365 and add those and then submit a make a wish to be able to add the FQDN.

MacuserJim · ‎Oct 30 2018

It's an add on for Advanced Security. https://meraki.cisco.com/blog/2017/06/introducing-threat-grid-for-meraki-mx/

MacuserJim · ‎Oct 30 2018

This isn't what you are looking for, but what if you had it apply a group policy to move them to another "guest" VLAN that has internet access, but not access to company resources? That would at least allow legitimate users to do basic work, like email, log into SaaS applications, etc.

MacuserJim · ‎Oct 30 2018

As far as the API goes you can retrieve the clients connected to a device, which returns the MAC, you can then use those MACs to return the group policy. So if you are good with the API (it sounds like you are) you can have that all in one script. I'm not sure of good way to send notifications to you though.

MacuserJim · ‎Oct 30 2018

In another thread from about 2 weeks ago @NolanHerring mentioned you can have support change WAN 2 to act as the failover which allows you to set the "Cellular failover" firewall rules to apply when the MX fails over to WAN 2. That would allow you to deny everything, but Office 365 when on your WAN 2. https://community.meraki.com/t5/Security-SD-WAN/Block-access-to-the-guest-network-when-the-LTE-circuit-is-active/m-p/30265#M7356

MacuserJim · ‎Oct 30 2018

I use it in a few locations and it has worked pretty well for my needs. I have VoIP phones and found that during calls it would sometimes change the WAN it was using and cause issues for the call, so I set up the flow preference to keep that traffic going out the same WAN and keeping the same public IP as not to screw up the call.

MacuserJim · ‎Oct 29 2018

If you go to "Wireless > Configure > Radio settings > RF Profiles" you can either edit or create a profile and either set the radio power, or set it to auto and let it automatically adjust based on neighboring APs.

MacuserJim · ‎Oct 29 2018

Here is Meraki's documentation or setting up SAML. https://documentation.meraki.com/zGeneral_Administration/Managing_Dashboard_Access/Configuring_SAML_Single_Sign-on_for_Dashboard

MacuserJim · ‎Oct 29 2018

Likely yes. It would be integrating with another system which would almost certainly have emails tied to them.

MacuserJim · ‎Oct 29 2018

The only two ways to give access to the dashboard are user accounts with an email address or SAML integration. You could technically create a fake email and set up an account so they are signing in with the email you created as their username and a password. They would then be able to reset the password from what you set it as after they log into the dashboard.

MacuserJim · ‎Oct 29 2018

Are "Auto channel" and "Client balancing" enabled? Also @dlowery mentioned how does the channel utilization in the area look?

MacuserJim · ‎Oct 29 2018

I agree with @NolanHerring. Also have you reviewed the VPN status page under "Security appliance > Monitor > VPN status"? I would be curious to how the usage graph on that page may compare to your observations.

MacuserJim · ‎Oct 27 2018

802.11r can cause issues for some android devices. I would suggest turning it off to see if it helps.

MacuserJim · ‎Oct 26 2018

Ah. I would recommend playing around with templates. They are awesome for managing a lot of networks. Also if you are setting up a device to deploy to another site (ie a retail store you manage) I would suggest assign it to the site where it will eventually be set up. Then if you'd like you can plug it in on your network so it checks in with the dashboard and downloads configuration settings or updates the firmware, if needed, then when it arrives at the site it is good to go. Otherwise you can ship a brand new device to the site and when they plug it in it will just take a few minutes for it to download configs and updates.

MacuserJim · ‎Oct 26 2018

Those are network specific settings so it makes sense that when you move them it would inherit the new network settings (which is likely default). Are these settings the same (or mostly the same) across all the sites? You can build a switch template and bind the networks to the template. That would allow you keep those settings. If you do have some one off settings you can over ride portions of the switch template. ie change LAN 1 from VLAN 1 trunked to default of VLAN 2 as an access port. Also why don't you bind the switch to the destination network from the beginning?

MacuserJim · ‎Oct 26 2018

No, you can't use the wireless radio for the device uplink.

MacuserJim · ‎Oct 26 2018

I feel ya. Past experience with Meraki's beta firmware has been pretty good so hopefully you don't have any issues with testing out this beta.

MacuserJim · ‎Oct 26 2018

It may be worth trying the MX 14.34 beta firmware on one of your sites and see if that helps with the AMP issues. I know a lot has been done to address AMP in the 14.x firmware revisions, specifically around the whitelisting issues for AMP.

MacuserJim · ‎Oct 26 2018

I don't think there is away to disable content filtering for Site-to-site VPN traffic, you would need to make content filtering tweaks for all traffic. For the shop floor instead of using content filtering to block all URL patterns I would recommend using the Layer 3 firewall settings to deny any traffic, and then have L3 firewall rules to allow traffic to either internal subnets, or specific IPs/FQDNs. I do something similar on a bunch of networks I manage and it works quite well. As for your AMP issues, Meraki has mad a lot of improvements in the more recent firmware releases. What firmware version are you running on your MX appliances?

MacuserJim · ‎Oct 26 2018

@BlakeRichardson @Julian96 (Sorry Blake, i posted this then saw that you did clarify for another brand of AP. I haven't had my Mtn Dew yet today 😉) It is possible. If you have one AP wired to the network it can act as a gateway for repeater APs within range. I just set this up with some test hardware. I had one MR set up and wired to the network and then up a second one wired as well to download the config and update firmware (it was in storage for a bit). Then I removed the LAN cable and just had it running off the power cord. After a few minutes it found the other AP wired to the network and formed a mesh with it and is repeating the wireless signal.

MacuserJim · ‎Oct 26 2018

I don't see how Meraki would be able to limit users from logging into O365 if Systems Manager is not installed on a device. It would need to be a feature within O365 to force a certain type of authentication, ie Meraki.

MacuserJim · ‎Oct 25 2018

@NolanHerring That's right, in the Meraki documentation for that it specifies uplink. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Using_Packet_Prioritization_on_a_Traffic_Shaping_Rule And yeah, you would need to specify that bandwidth limit for the download.

MacuserJim · ‎Oct 25 2018

Is the other AP a Meraki AP? If it is here is a good article to explain how that all works. https://documentation.meraki.com/MR/Deployment_Guides/Mesh_Deployment_Guide_(CVD)

MacuserJim · ‎Oct 25 2018

Ok. The way the "High, Normal, and Low" traffic shaping settings work is by giving a fraction of the flows to a specific application. High: 4/7 flows Normal: 2/7 flows Low: 1/7 flows I'm not sure how much traffic is on your network, so is it possible the proportion of OneDrive traffic was considerably higher than other traffic? Also I wonder if the OneDrive app initiates multiple flows of traffic when syncing. So in theory it 4 simultaneous traffic flows vs a single traffic flow that the browser might do. So when traffic shaping rules see that traffic it ends up giving the OneDrive app four times as much network flow.

MacuserJim · ‎Oct 25 2018

I would say get a packet capture of the One Drive app uploading and adding the IP(s) that is it communicating with. I wonder if the app is not getting categorized the same way as the browser upload. Also what is the menu path you went through to get "Sharepoint"? I am able to specifically select OneDrive.

About MacuserJim

MacuserJim

Community Record

Badges