Meraki

PhilipDAth

It doesn't have to be a switch - but it does have to be some kind of layer 3 device. Because you said you are using a dynamic routing protocol - you must already have this.

GreenMan · ‎Dec 6 2023

While OSPF is supported, as per the documentation linked previously by @Badr-eddine, note the phrase 'to advertise remote VPN subnets'. You can't use OSPF to learn the subnets on your local LAN (from a Layer 3 switch, for example) and/or advertise the default route to it. You would need to use static routing for this - perhaps between Virtual IPs, if you want a degree of resilience.

alemabrahao · ‎Oct 13 2023

I agree with him, but the number of clients must also be taken into consideration, and when I talk about the number of clients I am referring to the total number of clients, such as VPN clients, local clients, etc. Don't you think it makes sense? Generally (I think the vast majority of cases) it is the factor that should be taken into consideration the most.

alemabrahao · ‎Oct 3 2023

Probably yes, as the documentation does not mention license lever. https://documentation.meraki.com/CiscoPlusSecureConnect

kima25 · ‎Jul 7 2023

Hi @FabianSchleef , thank you for your response 🙂

alemabrahao · ‎Apr 3 2023

I'm pretty sure that the answer is not, but why don't you try a POC before?

Brash · ‎Jan 5 2023

VMX's aren't sized by number of users, but by the bandwidth and number of VPN tunnels they support. https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Comparison_Datasheet

AlexP · ‎Dec 20 2022

I also agree with Phil here, and want to give a bit more technical context on this response. A DDoS falls under the broader umbrella of what's known as a resource exhaustion attack: https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-015_Denial_of_Service While I've seen varying descriptions, in general, any resource can fall under such an Umbrella, including network bandwidth. If someone's saturating your uplink with garbage downlink traffic, there's very little mitigating it on your network perimeter would really accomplish anyway. In a more traditional sense, we can't mitigate against a DDoS consuming CPU or memory either; processing that many inbound packets through our IPS and inbound firewall is always going to consume both.

AlexP · ‎Dec 20 2022

Just to give fair warning, in its current form, it's a *very* limited support feature, and it's far from being something Meraki Support can recommend using.

GreenMan · ‎Dec 12 2022

As @ww hints, the question here is; what role is the extra non-MX firewall there to perform? Most customers will, at branches, just have a/the routed mode MX. With the right license level, it's usually all the branch firewall you need. Except if you really have to perform https decrypt, in which case, pairing up the MX with Umbrella is probably the most scalable approach Hopefully you found this already but, for your DCs, go with one-armed VPN Concentrator MXs behind your DC firewalls, as per https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide

MerakiDave · ‎Dec 26 2021

@kima25 From duplicate thread, just so this one can be closed out/resolved. For Meraki MR + Umbrella integration, there was the original API integration option, and now also an automated (single-SKU) integration with the “MR Advanced/Upgrade” license. This allows you to assign predefined Umbrella content filtering and security policies to an SSID or Group Policy directly from the dashboard and removes the need to integrate with an existing Umbrella dashboard or Umbrella account. For existing MR customers that do not yet have Umbrella, there is an UPGRADE license to enable the Umbrella functionality. For new MR deployments that also want Umbrella, that’s the ADVANCED license. There are some pros and cons that will prompt you to choose one over the other based on the requirements. The manual integration does require some (simple) manual configuration of API keys, an existing Umbrella account, and you’ll still have 2 Dashboards. The automated single-SKU integration is an all-in-one simple and turn-key solution but cannot create custom policies. It’s definitely not full-blown Umbrella. It provides a broad but generally adequate view of DNS events and everything is managed from the Meraki Dashboard only. If customers really need the finest policy granularity and deepest visibility, then go with the “regular” Umbrella deployment and the API integration option. For customers who simply want to add typical Umbrella protection to their Meraki wireless deployment this Advanced/Upgrade license might be the way to go. Here is a summary slide attached. Hope that helps!

MerakiDave · ‎Dec 23 2021

@kima25 For Meraki MR + Umbrella integration, there was the original API integration option, and now also an automated (single-SKU) integration with the “MR Advanced/Upgrade” license. This allows you to assign predefined Umbrella content filtering and security policies to an SSID or Group Policy directly from the dashboard and removes the need to integrate with an existing Umbrella dashboard or Umbrella account. For existing MR customers that do not yet have Umbrella, there is an UPGRADE license to enable the Umbrella functionality. For new MR deployments that also want Umbrella, that’s the ADVANCED license. There are some pros and cons that will prompt you to choose one over the other based on the requirements. The manual integration does require some (simple) manual configuration of API keys, an existing Umbrella account, and you’ll still have 2 Dashboards. The automated single-SKU integration is an all-in-one simple and turn-key solution but cannot create custom policies. It’s definitely not full-blown Umbrella. It provides a broad but generally adequate view of DNS events and everything is managed from the Meraki Dashboard only. If customers really need the finest policy granularity and deepest visibility, then go with the “regular” Umbrella deployment and the API integration option. For customers who simply want to add typical Umbrella protection to their Meraki wireless deployment this Advanced/Upgrade license might be the way to go. Here is a summary slide attached. Hope that helps!

Inderdeep · ‎Dec 1 2021

@kima25 : select the device depends upon the requirement in the core https://meraki.cisco.com/product-collateral/ms-family-datasheet/?file

Meraki

Community

About kima25

kima25

Community Record

Badges

Re: One-armed without Core Switch

Re: Dynamic routing in the routed mode

Re: SSID tunneling

Re: Cisco+ Secure Connect and MX

Re: Cisco EZ VPN alternative

Re: Meraki and Citrix

Re: number of users in vMX

Re: anti-DDOS & MX

Re: Inspection SSL in SDWAN Meraki + certificates management

Re: routed Mode with Firewall (SDWAN)

Re: DIFFERENCE BETWEEN ADVANCED LICENCE ANDE ENTREPRISE LICENCE FOR ACCES P...

Re: MR Advanced license

Re: can we use MS390 in CORE