Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Mkozicki
Mkozicki
Getting noticed
Member since Jan 31, 2018
Jan 9 2024
Grand Rapids, MI
Kudos from
Community Record
33
Posts
6
Kudos
1
Solution
Badges
Jan 9 2024
1:41 PM
And that is really what I hope for is something simple. People are buying the MX because it's a simple to deploy product. Many of the IT people at these schools that I am dealing with a more Microsoft type IT people and they can find their way around the MX mostly. They don't want to call for every change they need to make. Also if it's a built in solution I would hope that it's kept updated as TikTok makes changes to get around firewalls then Cisco Meraki would also make changes to keep the blocking working.
... View more
Jan 9 2024
1:32 PM
I use Umbrella but not all the schools I work with do. I was looking for a 'simple' built in solution and thats kind of why I posted this message to see if I was missing something or perhaps Cisco Meraki would respond that something is in the works.
... View more
Jan 9 2024
10:15 AM
I have searched and people seem to have asked a few times over the years but is there any chance that Cisco Meraki is going to add a layer 7 rule for TIKTOK blocking? Or has Meraki come up with a simple way to block TIKTOK on the MX? I know this is a hard application to block but I have schools with MX firewalls asking about blocking this and with how many other social sites you have layer 7 options for it would be nice if TIKTOK could be added. Another option would Umbrella integration into the MX be a good way to block this?
... View more
Apr 28 2023
7:44 AM
I forgot to mention that the MX250 at the head end already has 2 x internet connections so is there a work around to be able to still do this solution? Also the 2nd WAN has to use DHCP because they ISP won't supply a static IP. Is there a hidden feature to have a 2nd IP on a WAN interface or a way to make another port also function as a WAN interface? Or a way to run an Auto-VPN on the inside ports?
... View more
Apr 26 2023
8:39 AM
Okay so we don't need to get the NAT turned off. Thanks both of you. The Auto-VPN solution seems simplest. I will place a switch outside of the firewalls and connect all the Point-to-Point connections to that and put them all into a single L3 subnet so they can talk any to any. Then I will make them all hubs for the auto-vpn and that should solve all the issues. I don't know if there is a design guide for this but there should be one posted on the Meraki documentation site if there is not one already. Thanks both of you for your assistance. Mike
... View more
Apr 26 2023
8:19 AM
I forgot about the NAT issue from the above post. For sure we need to not have NAT on the private connections because that would break a bunch of other security running behind the firewalls. Thanks
... View more
Apr 26 2023
8:05 AM
Is there a document on this on the Meraki site? I did find one for using internal ports but this makes more sense. I will see about doing a re-configuration for them once I go on site again in a few weeks. They don't have MPLS they have 4 remote locations each with a point-to-point ethernet link. So it's not a MPLS cloud but a bunch of point-to-point links. I shoudl still be able to make what you are saying work.
... View more
Apr 26 2023
7:36 AM
I guess it could but that is going to become much more complex than if there was just a way to have a backup static route for internet connections. Perhaps there is a hidden option that I need to call support to have turned on. Really what I need is just a way to have a lower priority default route that can point to the point-to-point link for if/when the internet connection is down. I could make what you are showing work but I would have to build another L3 network outside the firewalls and that seems like more work and hardware than they are going to want to invest in.
... View more
Apr 26 2023
6:01 AM
I have a customer that needs to have Auto-VPN backup connections for remote branch locations. Each remote location has a direct 100 mbps connection over a metro ethernet provider. They also want to have local internet at each branch location. We have set this up and working fine putting the internet connection on wan 1 and the point to point connection on an internal port and setting up static routes (it would be nice if we could run routing protocols to do this they have a lot of networks at each branch). In our setup we are using the local Internet connection to access the internet and all the traffic back to the main site is going over the point to point connection. We tested shutdown of the point to point and all traffic fails over to the Auto-VPN connection just fine. Our issue is that we want to set up a failover for the internet as well were if the branch internet should fail the remote branch can get internet from the main location along with the connections to all the other networks. We don't want to use the point to point for internet unless the branch local internet connection is down. Is this something that can be done? I have not found a way to set this up but I may have missed it. Thanks
... View more
Oct 24 2022
10:39 AM
Just an update of what I did to get 5G on my ATT account. I saw they now have the Netgear Nighthawk M6 so I purchased the pro version of that and it works GREAT. https://about.att.com/story/2022/netgear-nighthawk-hotspots-5g.html Its also quite small and can run battery or just off a USB-C power plug. Has a single 2.5 G Ethernet port also.
... View more
Oct 5 2022
7:32 AM
I keep waiting for them to get 5G version also for AT&T. I have an unlimited 5G SIM from AT&T but i currently use it in the huge router they sent me with the service and I would love something smaller that I can travel with. You are asking about allowing the Z3 or MG to access a WIFI network. Are you talking for the uplink to the internet?
... View more
May 27 2022
5:23 AM
2 Kudos
We are going to get a cell modem for the travel solution with the Zx units but just because I don't like to give up I also found a solution to connect the Zx to I think any WIFI network. We found the TP-Link AC750 Wireless Portable Nano Travel Router on Amazon and it looked like it would allow us to do what I wanted. https://www.amazon.com/gp/product/B01N5RCZQH/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&th=1 So what I found works is setting this up with the option switch set to the middle setting (share hotspot). Then we can connect wireless to the unit using the built in wireless and do a quick setup to have it connect to the WIFI network we want. Then when we try and access the internet we can log in to the splash page that the hotel puts up and the unit is not connected to the internet. Next we can plug the Zx device in to the ethernet port on the AC750 and when it boots up it gets an IP address from the AC750 and can get out to the internet and bring up the auto VPN. We then have our own wired and wireless network running over the hotel WIFI including VPN back to the home office. I know this is a strange solution but once I got it in my head I just wanted to make it work and we tested it out this week when I was traveling and it works great. Mike
... View more
Apr 28 2022
1:46 PM
So I tried another option to block countries on a web server we have running here with a 1:1 NAT. I made a group policy that blocks USA (I am in USA) and then tried to get to our server with that policy applied to the web server. I was not able to connect to the web server. Once I changed back to the normal policy I could again connect. So it seems that if we want to GEO block a 1:1 NAT we need to make a policy and then apply that policy to the server.
... View more
Apr 28 2022
9:00 AM
We have some GEO blocks on the general firewalling but our customer is saying that on a server that has a 1:1 NAT configured they are getting traffic from one of the blocked countries. Now I don't know for sure if the 1:1 will bypass the layer 3 and 7 rules or not and I don't know 100% if the address that they say is getting to the server is in the countries they are blocking. So kind of a quick thought was if they had a tool to check IP addresses vs the database where I could put in an IP and it would spit out the country then I would know for sure.
... View more
Apr 28 2022
6:27 AM
Is there a tool or place that hosts the database for the Meraki Layer 7 GEO database so that we can look up IP addresses VS the database to see what country they match in Meraki's mind?
... View more
Labels:
- Labels:
-
ACLs
Apr 27 2022
5:22 AM
Does the shirt come in a size that will fit our gnome? 😂
... View more
Mar 3 2022
11:51 AM
Okay this may seem a strange question but I am wondering if anyone has found any sort of adapter out there that would allow the use of a Z3 or MX device to convert the Ethernet uplink port to connect to a guest WIFI connection. My need is so that traveling workers could take a Meraki security device with them and set up a remote workstation in a hotel with only WIFI access in the room. I know this is a long shot but figured it would not hurt to ask. It would also need to have some way that the user could connected to the walled garden of the hotel to put in the name and room number or whatever they ask in order to be granted access. I have found a few Ethernet to WIFI adapters out there for sale but I don't know if they would work or not because most want to use the WPS button on your router and there is not going to be such a thing at a hotel.
... View more
May 21 2021
6:58 PM
This is great news! I may sign up for a beta kit so I can set this up as a demo for some customers. thanks for testing this. Mike
... View more
May 17 2021
2:07 PM
So your post brings up another testing option. 1). One mx on starlink and one with a public ip 2). Both mx on starlink with private addresses I hope number 1 will work and I am guessing number 2 will not work unless Meraki works with starlink to make a special option to make it work with both on starlink. Mike
... View more
May 17 2021
12:07 PM
1 Kudo
I don't know if you work with a reseller or if you are a reseller but whoever you are ordering from should be able to supply you with lead time estimates. We as a reseller have been getting weekly updates on expected ship dates because of how far out things are on some of the products. Look at the list I have there are some items out as far as August now. <ouch>
... View more
May 17 2021
10:32 AM
2 Kudos
Hello all, I am wondering if anyone has set up a site-to-site VPN between 2 MX devices where one end only has a Starlink internet connection. I don't have Starlink yet but I can see where this may be a good option for some work from home people with Z3 or small MX devices. But with Starlink using CGNAT I am unsure if this will work or not. So just wanted to know if anyone has tested this or has this in production. I am tempted to buy a Starlink kit to try it out myself but they are mid to late 2021 so I thought this may be a faster way to find out if it will work. Thanks
... View more
Dec 21 2020
6:16 AM
When you pick single LAN I don't think it asks for a VLAN. I may have to play with my lab box because my customer set this up and then asked me why he was getting the error message. I did mess with my lab box and it does not seem to ask for a VLAN when you change it to single LAN.
... View more
Dec 18 2020
2:35 PM
So I have never seen anything like this and I know I can fix this by changing the Z3 to VLANs rather than Single LAN but I would rather just have it work right and I can't figure out why this is happening. I am getting this error message on the MR36 that is plugged into the Z3. This device is using a DHCP IP address from VLAN 0 instead of using configured VLAN 1. Now this seems strange in the 1st place because of the VLAN 0 but I did try a few things. 1st on the AP I tried to change the LAN IP DHCP address option to VLAN 0 but as expected it will only let me pick from 1 to 4094 as I would expect. So I went on Z3 under Appliance status then under DHCP and I see this. DHCP subnets Subnet VLAN 192.168.2.0/24 192.168.2.0/24 - VLAN 0 Like I said under Addressing & VLANs this is set to Single LAN and the 192.168.2.0/24 is set up but I don't know how it's saying that it's on VLAN 0. So question is how to I get the MR36 on VLAN 0 or the Z3 on VLAN 1 with the single LAN setup? I know I can change this to VLANs but I would rather figure this out. Or is this a BUG. Thanks
... View more
Jun 12 2019
5:31 AM
A VLAN is like having a virtual switch inside of a real (hardware) switch. The same as a virtual machine inside a bare metal host.
... View more
May 30 2018
1:07 PM
I am wondering if anyone has a H.323 video conferencing unit behind a Meraki firewall. I have a customer that we put a pair of MX250 in and everything is great other than the H.323 Cisco C20 codec they have is no longer able to make or receive calls. We did open a case with Meraki and they were saying that they did not see any traffic from the codec at the MX but other than changing out the firewall we never made any changes to the codec. In order to make sure the codec is working correctly we put it on a public network with a public IP and it works just fine. Also we can get to the web interface from the internet so it is talking out to the internet just not for video calls. I also have an InFocus Mondopad here at our office that can do SIP or H.323 and it has no issues doing SIP calls but when I tested H.323 I am sending video but not receiving video. We have the C20 codec with all inbound protocols allowed and also whitelisted it. I am wondering if the MX supports H.323 or not so that is why I am asking here 1st before I spend hours on another TAC call. Thanks much! Mike
... View more
Kudos from
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2056 | May 27 2022 5:23 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 2056 | |
| 2 | 35599 | |
| 1 | 8487 | |
| 1 | 53108 |
© 2024 Cisco Systems, Inc.
