Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About DunJer622
DunJer622
Building a reputation
Member since Jan 31, 2018
Apr 15 2021
Community Record
76
Posts
9
Kudos
1
Solution
Badges
Mar 29 2021
7:57 AM
Good morning. I'm expecting any device that I assign one of my 13 user-assignable IP addresses to to broadcast that IP. Currently, we have a Comcast coaxial modem that is connected to a switch for distribution of the IPs. If I put any of those IPs into any of my Meraki equipment, they immediately broadcast that IP. The issue here is that I have a Meraki behind a Meraki. Perhaps the Comcast router (with the fiber) needs to be reconfigured? As it is now, my /28 IPs are useless, as I can't remotely access them, nor ping them. Old Comcast modem (coaxial w/13 IPs) <> switch <> MX250 (core stack) and MX64 (VPN) - Works perfectly, with all assigned IPs responding externally and each unique IP is broadcast. New Comcast router (fiber w/13 IPs) <> MX68 <> switch <> MX250 and MX64 - Fails. Each MX250/MX64 both broadcast the same IP, with is the IP from the /29 assigned to the MX68. The /28 IPs do not respond to pings or web access. Thanks, Jeremy
... View more
Mar 28 2021
8:00 AM
Thanks for the suggestion. I tried it, but I didn't see a change, as it is still broadcasting the /29 IP (instead of the /28) and the public IP is not responding to ping/web calls. Do I need to be in Passthrough mode, perhaps? Actually, 1:1 NAT is not available in that mode. Thanks, Jeremy
... View more
Mar 27 2021
4:09 PM
You are correct about the setup. Comcast Juniper <-> /29 WAN -MX68-/28 LAN If it is that freaking "No NAT" issue again, that is going to suck. Ran into that previously with a VeloCloud-Meraki SD-WAN setup. I do have the MX68 LAN connected to a switch that then connects to my MX250 stack and my MX64 VPN router. Currently running 14.53 across the board for all my MX units.
... View more
Mar 27 2021
2:59 PM
Greetings, I have Comcast fiber in my DC. The account has 2 sets of public IP ranges, one set of 5 for the "gateways" and and a set of 13 of user-assignable. We're currently looking to replace a cable circuit with 13 IPs. Seemed straight forward, until it wasn't. To the Comcast router, I connected an MX68 in routed mode, with one of the 5 IPs as the gateway and then designated a LAN port to handle the 13 user-assignable IPs. I connected another device, assigned the static IP and was done. However, upon inspection, I see that my device is broadcasting the static IP of the gateway, not the static IP of the device. As such, the device static IP is not responding. So, I tried putting the MX68 in passthrough mode. That made circuit fail. I called Comcast and they said I had to apply a routing statement to the Meraki router. I don't see anything within the Meraki (or documentation) regarding doing such a thing. I may be just completely overlooking it, so I'm hoping the community can help me out. This seems like it should be really easy, but so far, I'm failing. Any advice would be greatly appreciated. Thank you, Jeremy
... View more
Aug 20 2020
8:26 AM
Thanks for the reply, ww. So, are you saying to take the MS250 (switch) out of the equation? As such, for example, I'd create the VLAN 22 with a subnet of 10.22.22.0/24 and MX IP of 10.22.22.1 on the corp MX250 and configure a LAN port on the corp MX250 as Trunk/Native VLAN 22/Allowed VLANs All (or limited to Server and Voice) and create the VLAN 22 on the state MX84 with a subnet of 10.22.22.0/24 and MX IP of 10.22.22.2 and a LAN port on the state MX84 as Trunk/Native VLAN 22/Allowed VLANs All. I'd then add a static route (or routes) on the state MX84 that states that the next hop of the corp network(s) is 10.22.22.1, while adding a static route (or routes) on the MX250 stating that the next hop of the state network(s) is 10.22.22.2? Would I perhaps do /30 instead of /24 for the 22 VLANs, avoiding duplicate IPs that way? Thanks, Jeremy
... View more
Aug 20 2020
7:04 AM
GldenJoe, Thanks for the reply. I'm not sure if I'm following on what makes this a bad practice. The point would be to limit the incoming traffic on WAN2 to 2 private networks, if not select IPs. Sure, if one of the internal corp devices got compromised, they'd have full access to the state devices, but they'd already have access to the corp devices and all VPN devices, so I'm pretty screwed at that point anyhow. I'm just looking to avoid having to have the state office need to go over the Internet for a connection to our corp office, as it is simply across a hall. Obviously, incoming traffic is blocked for a reason. I'm not arguing. I'm just trying to understand what makes it a bad practice. As for your workaround, can you help me get a better picture of it? Are you suggesting that I should have an MX behind an MX? Currently, corp has an MX250 connected to an MS250. The MS250 port that is connected to the WAN2 on the state MX is configured with the server VLAN as native and only the server and voice VLANs are allowed. At this point, the desire is to have the state users be able to access the corp servers and the corp servers see the state printers, while the state phones see the voice controllers and the voice controllers see the state phones. With your suggestion, are you saying for me to create a "state" VLAN, assign it to the MS250 port and have it connect to something other than the state MX WAN2 port? I'm trying to draw it out, but I'm not seeing how it works. Again, I'm not arguing, and appreciate the reply. I'm just not quite understanding it. Fortunately, the state office is not currently live, so I can test any design, as long as it doesn't negatively impact the existing corp network. Thank you, Jeremy
... View more
Aug 20 2020
6:13 AM
Greetings, Here's the scenario... Our office is essentially breaking up into 2 offices (state and corp). The state office is effectively across a hallway from the corp office. The state office has an MX84 and is using 2 WAN ports. WAN1 is a Comcast feed (public ISP), while WAN2 is connected to our corp private switch (using 192.168.1.x). The intention is to allow the state office to have a direct (1GB) connection to the corp server environment (avoiding the need to go over the Internet), while having their own Internet circuit available for streaming and web activities. From the state office, I can fully see the corp network, able to directly connect to servers and phone controllers. The issue is return traffic. I'm not having any luck pinging the state firewall (10.20.x.x) from the corp network. I've created the static routes for the state networks on the corp switches, but have made no progress. The point is to be able to manage the state devices (printers/phones) from the corp network. Can I make this work with the Meraki router? Is this an issue with how Meraki routers handle NAT? Do I need to create a VPN? If I do, can I create a VPN that prefers going over WAN2 (if not exclusively)? Thanks for any assistance. Jeremy
... View more
Jul 2 2019
8:24 AM
Does Meraki realize how dumb it sounds to offer USB for failover connectivity but not actually use it for a best practice??? It is crazy to me that it it seems acceptable to Meraki to need an additional router that can actually use a USB card to perform an Ethernet hand-off to the Meraki. I didn't have to do that with SonicWALL or CradlePoint. Don't offer a USB port, if you can't depend on using it. Of course, I'd never have gone with the product, if they didn't support USB modems. Especially with the significant price jump from the Z1 to the Z3, it is asinine that I can't depend on using the product, as advertised. We have 300+ sites using USB cellular modems, due to cost and versatility. I'm really regretting my commitment to Meraki, as they have underwhelmed in multiple areas now. I keep waiting for their developers to "figure it out", but I can't hold my breath that long. They have way too many things that are controlled on the back end or can't be done in general. Lots of nice features, for sure, but definitely many poor decisions have been made, too.
... View more
Jul 1 2019
9:05 PM
Greetings, Does anyone in the community have a Verizon USB card that they use with the Meraki Z1 or Z3 units that works well (or at all)? We were using the UML290, but support for that ended with 14.x firmware. So we moved to the USB730L, but it apparenetly has 2 USB IDs, but Meraki only supports one, and has now moved even that off of the supported list. I have tried the Connected IO and the Feeney Skyus-DS, but neither work in the Z1s (but work fine in non-Meraki hardware). I'm now stuck with over 200 Z1 units that I can't upgrade from 13.36, as the UML290 cards won't allow the upgrade to complete and I con't simply replace the UML290 cards with anything, as nothing seems to be dependable. I still have to install about 400 more units, but I've put it on hold, as I have zero confidence in Meraki, at the moment. Yes, we can look at embedded, but that is not our preference and that is not what we were sold when we committed to Meraki. I appreciate any insight that you may have. Thank you, Jeremy
... View more
Feb 22 2019
3:13 PM
1 Kudo
The impact to my MX250 environment may be minimal, as I use a separate MX64 to manage all VPNs and I use 1:1 NAT and no port forwarding, so a different IP (upon failover) isn't horrible. For me, its more of a matter that all 13 of my static IPs on each circuit are being utilized. So, I have to look to see what I can do to recoup one. I'd prefer to do the virtual IP approach, but recouping 2 is not going to happen. So, I'll go with the MX uplink option for now, and then likely change to the virtual uplink option when we change our primary ISP later this year. Thanks for the good information, guys.
... View more
Feb 22 2019
2:24 PM
Good video. That said, I'm still a bit unclear about the public IP needs. In the documentation, it states that the "Use MX uplink IPs" option does not require additional public IPs for the Internet-facing MXes, but a few sentences further it state, "regardless of which option is selected, both MX devices will need their own uplink IP addresses for Dashboard connectivity". So, this seems to suggest that I need 2 IP addresses per circuit with this option and 3 public IPs with the "Virtual uplink IPs" option. Am I understanding that correctly? Thanks, Jeremy
... View more
Feb 22 2019
2:01 PM
Greetings, I recently implemented an MX250 as my core firewall at my HQ. As it has been doing well for a month, the plan was then to add a warm spare this month for redundancy. However, the documentation seems to do a poor job of explaining Virtual IP configuration. I have 2 circuits that I am currently using in my primary MX and the 2 WAN ports are each configured with a public static IP. I would expect my spare to be configured with the same IPs. However, the documentation seems to suggest that I would need 3 assignable public IPs per circuit? Is that correct? I'm really not understanding the design. It is definitely WAY different than the HA setup for my previous SonicWALL hardware, as it simply used a crossover cable and a unique private IP for each firewall. Any assistance with this matter would be greatly appreciated. Thank you, Jeremy
... View more
Feb 18 2019
9:25 AM
They do and they are all enabled.
... View more
Feb 15 2019
3:36 PM
Yes. I have all my Meraki endpoints (MX65) creating a VPN back to an MX64 hub at my DC. Not ideal, as it masks the traffic across the VeloCloud network, but it is working. Jeremy
... View more
Feb 15 2019
3:33 PM
1 Kudo
Greetings, I have several MX64-Non-Meraki (SonicWALL TZ205w and TZ300) VPNs. Generally, all of them work without issue. However, for no apparent reason, some of them will stop passing traffic. If I look at the SonicWALL, it says the tunnel is online, but it isn't. Once I renegotiate the tunnel, the VPN starts passing traffic again within seconds. The other weird thing is that it doesn't drop all the tunnels between the devices. I thought we were getting false positives, as I could ping the site from my workstation VLAN, but I then found that I couldn't do so from my server VLAN. Any ideas on what is causing this? Thanks, Jeremy
... View more
Feb 5 2019
9:22 AM
I tested it, and it worked, but it would be an administrative nightmare, as I have several VLANs and moving the management to the VCE would really suck (even with Orchestrator). Creating a VPN with the MX has generally worked fine and then you have full control of the endpoint networks through the Meraki. My understanding is that a beta version of the MX firmware addresses the "No NAT" issue, but I haven't seen it, yet. I'll be doing more testing in Q2 2019.
... View more
Feb 5 2019
9:11 AM
Now that I have the primary MX250 and Primary MS250 working correctly in my environment, I'll be moving forward with redundancy in later Feb. While I understand that you can't build an LACP channel across the two switches, I would be able to duplicate it with a couple more SFP+ modules. My concern with a stack is IP conflicts and possible looping. I've already experienced issues with my MS120 switches having looping issues. I've been testing loop guard configs, but haven't implemented anything, as I didn't want to risk any loss of connectivity to my remote sites. That said, there have been a couple firmware releases since then, too.
... View more
Feb 5 2019
8:56 AM
It was a matter of an incorrect default route and the requirement for LACP. As for my original question, Meraki doesn't appear to use reflexive policies, as the one that I created for testing has never had a hit, and it is our Exchange Server. Everything is now working, but some things are more transparent than others.
... View more
Jan 29 2019
10:14 AM
Greetings, I've just moved over to an MX250 as our core firewall. I'm looking to see if there is a better way to block incoming IP addresses aside from individual L7 rules denying IP/32? I get a lot of attempts against our Exchange Server, as it is public facing. I'd like to take the daily list of IPs and enter them all together, versus separate line items. With my SonicWALL, I simply created a group called Risk Address and added IPs to it. Since incoming from Risk Address was blocked, any added to that group was automatically blocked. Within Threat Protection, I do have Intrusion Detection at Detection and Balanced, as I wanted to get a feel for how it was working. I did see one topic in the community, but it appeared that the answer actually was blocking outgoing to the IPs, not incoming. Any assistance would be greatly appreciated. Thank you, Jeremy
... View more
Jan 27 2019
12:22 PM
1 Kudo
Was an issue with ISP. I'm assuming caching. Upon router power-cycle, everything began responding.
... View more
Jan 27 2019
10:40 AM
Internet appears to be working fine. NATing appears to be an issue, though. It is odd, though. My Exchange email appears to be flowing correctly, but Nothing else relying on NAT is connecting. Researching that now.
... View more
Jan 27 2019
9:53 AM
1 Kudo
Heh. Just got your message. You got me looking at the right place. Going to do more testing now.
... View more
Jan 27 2019
9:52 AM
Found an issue... Had 0.0.0.0 point to 192.168.1.1. Changed it to 192.168.1.2.
... View more
Jan 27 2019
9:36 AM
MS250 is 192.168.1.1, MX250 is 192.168.1.2
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2699 | Feb 5 2019 8:56 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 3 | 9630 | |
| 1 | 6869 | |
| 1 | 5849 | |
| 1 | 8244 | |
| 1 | 8262 |
© 2024 Cisco Systems, Inc.
