Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About IgorPodgorny
IgorPodgorny
Getting noticed
Member since Jun 17, 2020
Feb 2 2024
Community Record
27
Posts
2
Kudos
0
Solutions
Badges
Feb 2 2024
11:45 AM
I disagree, firmware updates have very little to do with security, maybe security of a device itself, but not the clients behind it. FortiGates will update signatures and bad IP lists and other things every 30min or so with FortiGuard subscription, or you can create custom feeds. Another HUGE security advantage of FortiGate is deep-packet inspection which Meraki can't do at all, given that over 85% of all attacks are encrypted.
... View more
Feb 2 2024
11:17 AM
I don't think that my story is unique, but here is how it went... We got some trial equipment and liked it, then I attended one of the local Meraki workshops where they showcased some of the goodies and I was pretty impressed with it. I was aware of its shortcomings before we commited, but the guy at a presentation assured that they are developing and adding features to a dashboard all the time. I bought into its potential. However, next 3 years felt like a development stagnation without anything new, and the SD-WAN improvements they talked about came years later in form of SD-Internet and additional license. Overall, I can't say that it was a bad experience and we kept Z3s. Switching to something more robust (FortiGate) turned out to be cheaper than renewing MX licensing, but with a bit of a learning curve and much more stuff to configure and screw up:)
... View more
Feb 2 2024
10:06 AM
We shelfed higher end MX (84, 100 and 250s) and only left with 1 MX64 and ~20 Z3 connecting teleworkers to it. For site-to-site and edge in general wasn't very happy with the lack of simple features that any business multi-wan firewall should have. Seems that they are adding some now, but a little too late, not enough and we moved on.
... View more
Feb 2 2024
9:56 AM
Internally VLAN-to-VLAN got 200 mbps (probably the real firewall limit), withing the same VLAN it's close to a gig.
... View more
Feb 2 2024
9:55 AM
A little, like I've said in an original post there is no real question here, just a bit of rant:)
... View more
Feb 1 2024
1:39 PM
IMHO calling z3 an enterprise routing hardware is a stretch. I tend to refer to Cisco ASR as enterprise routing hardware, and some other vendors / devices. As far as higher end MXs, I have 8 MX84 and 2x MX250 sitting on shelf because they are missing much of enterprise features. We just kept ~20 teleworkers, and now thinking about going with something more robust. The biggest compaint is that almost everyone has a much faster Internet connection and about half have 1 gig fiber and generally run faster using VPN client on their computers. Anywhat the whole point of a post is why list something as a highlight when in fact you can't ever use it.
... View more
Feb 1 2024
10:56 AM
We had Meraki for 3 years and switched to FortiNet, and we still have home offices on Meraki. There is a learning curve as those things are 10x more capable and feature rich, but also more complex. They do have cloud mnagement as well, but if a device comes with gig ports, it's pushing gig. I've been pushing ~300 clients through 2x 1gig uplinks with a FortiGate 60F (~$1000) without any problems.
... View more
Jan 31 2024
1:35 PM
If that's the case, why highlight the things I mentioned in an original post. Doesn't matter if has gig ports or 1.3 gig wifi if there is a "hardware limitation" elsewhere. I doubt that it's hardware. Really think about it, how is $50 router from best buy can do a gig, and $350 cisco device can't. I know there are all the extra bells and whistles, but those kinda covered by a subscription. Plus there aren't that many bells and whistles on Z3. There is no web filtering, threat protection, IPS / IDS, no packet inspection whatsoever.
... View more
Jan 31 2024
1:27 PM
1 Kudo
Back to my original point, why do these highlights matter? They don't. It's just sad that a $350 device can't do a gig.
... View more
Jan 31 2024
12:45 PM
It's the other way around, I have 1Gpbs fiber at the house and when connected to Meraki Z3 it's limiting me to 100Mbps.
... View more
Jan 31 2024
12:44 PM
I know that they are different, but one limmits the other so what the point of even mentioning it. Like I said they highlight the WiFi data rate and gigabit ports, but you'll never be able to use that because of Traffic Shaping which you can't set higher than 100Mbps an it limits your overall throughput. Here is speed test on my home WiFi (it's around ~940 Mbps both ways when hardwired): And here is the one while connected to Meraki Z3 (hardwired or wireless):
... View more
Jan 31 2024
11:32 AM
1 Kudo
Here is the snippet from Meraki Z3 Datasheet: The question is why (highlighted ares) if the thing is artificially limmited to 100 Mbps throughput under Traffic Shaping, and that is exactly what you are capped at when doing any Internet speed test or anything for that matter? I understand that they want to "preserve user expirience", blah, blah, blah, basically to sell a higher priced model, but why put those things as a product highlight? So what that radio does 1.3 Gbps, you'll never go past 100Mbps... Sorry, there is no real question here. Just a little rant:)
... View more
Labels:
- Labels:
-
Other
Aug 12 2022
11:24 AM
Cisco has a different definition of SD-WAN. Would be great if that held true across all Cisco products, given that they own Meraki.
... View more
Aug 11 2022
1:47 PM
Even by their parrent company definition SD-WAN is what they are rebranding as SD-Internet. https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/what-is-sd-wan.html My guess is that Cisco is cripling Meraki on purpouse to sell more robust and expencive products.
... View more
Aug 11 2022
1:39 PM
That's what I got from a previous reply. No SD-WAN on MX:) Even SD-Internet, which is SD-WAN by definition:), will only use uplink performance to a handful of IPs and not actual WAN performance to a particular service target. I happened to have 2ms latency to o365 on WAN2 while WAN1 generally performs better for other things (1.1.1.1 and 8.8.8.8, etc.). Meraki sounded so promissing a few years ago, with "getting better over time as long as you maintain a license", which we bought the most expencive at that time (Advanced Security). What a disapointment.
... View more
Aug 11 2022
1:31 PM
Thank you for your reply:) This confirms what I was thinking that they don't do SD-WAN. SD-WAN is a term for what they decided to call SD-Internet. Steering traffic based on uplink performance and not based on service in question, isn't good idea either. I currently have ~8ms latency to 1.1.1.1 on WAN1 and ~12ms on WAN2, so SD-Internet would use WAN1 for Office365 traffic (roughly speaking), but my latency to Office 365 is ~2ms on WAN2 (true metric). Thus 2nd connecion would be a better choice... Doesn't seem to be much diferent from manual flow prefernce, just look at latency statistic for the past month or so and it will match their SD-Internet 99% of the time 🙂 What a joke. Couldn't get SD-WAN right to begin with, renamed it to SD-Internet and can't get that right either:) License expires in 97days, got to start thinking about replacement solution. Really apreciate your promp responce though:) Thank you once again.
... View more
Aug 11 2022
12:41 PM
Another one, which huge and I totally forgot to mention is that it doesn't do SD-WAN at all:) When you go SD-WAN & Traffic shaping > SD-WAN Policies and add a new one, select service (Office 365 for example), make your custom performance class (should have an option "best link right now", or something along those lines), apply it only to find out that it applies to VPN traffic. Who builds VPN tunnels to all the services that you can selcet from? They tried to copy fortigate, where it does allow monitoring WAN link performance to any given services and select a link which meets performance criteria or best performing link, and send traffic out of that WAN link, but failed miserably. Can optimize some site-to-site stuff, but not an SD-WAN in any shape or form:)
... View more
Aug 11 2022
12:28 PM
Another option: Buy web filters separetly (Barracuda, BlueCoat, etc.) Buy Firewalls without subscription (Cisco, Fortigate) or free pfSense / OPNSence Buy SD-WAN from Fortigate or Palo, since MX doesn't do SD-WAN at all:) Pay your admins / engineers more to addminister all this stuff😀
... View more
Aug 11 2022
12:15 PM
Nope. The gateway and the address I got are 100+ IPs appart. Connected a latop to it and it turned out to be /21 subnet.
... View more
Aug 11 2022
12:00 PM
Hello everybody, I have multiple MX appliances at multiple locations (MX100, MX250, MX84, Z3). When navigating to Security & SD-WAN > SD-WAN & Traffic Shaping > SD-WAN policies section I get a bit confused. This section makes no sence whatsoever. I see VPN Traffic section and Add preference. Here is how it doesn't make any sence. Traffic filter gives me all kinds of things, like email, video, VoIP, Blogging, gaming, online backup, etc. Please tell me how any of these apply to VPN Traffic? For example "Productivity > Office 365", I would love to be able to select best uplink for it (based on custom performance class, or better performing link, like a true SD-WAN would do), but what good is this section if it applies to VPN traffic? I don't have a VPN tunnel to Office 365. Or any other services listed there for that matter. How would you do SD-WAN on Meraki. Doesn't seem to be an option at all. Flow preference is manual process designed for something else all together. Traffic shaping section doesn't account for link performance. The only section sutable for it aplies only to VPN traffic.... No SD-WAN with MX? Thank you
... View more
Aug 10 2022
1:21 PM
Hello everybody, I have an MX which is receiving WAN address from DHCP server. It's a public routable IP address. How can I determine a subnet mask of that address? I can only see IP, Gateway and DNS servers, but not a mask. Thanks
... View more
Labels:
- Labels:
-
Other
Nov 27 2020
12:19 PM
That is what we've been finding out is a "Jack of all trades and master of none" solution. - Routing (static only) - Firewall (very rudimentary rules allowed) - Traffic shaping - limited - Client VPN - limited (all or none approach, can't give some clients more/less access than others) - Web filtering - well, you mentioned it. Can't really get user reports...
... View more
Jun 17 2020
9:58 AM
Great, I posted a reply with Meraki shortcomings and they removed it as spam.
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 2294 | |
| 1 | 2333 |
© 2024 Cisco Systems, Inc.
