Meraki

JessePeden

Are you referring to the SAML auth for SSIDs feature, or the EAP-TLS feature?

Patumusiime · ‎Aug 30 2023

Tadpole86 · ‎Apr 28 2021

Thanks @Inderdeep Meraki Authentication is what I want to use. Having the user database hosted for us in the cloud and a simple username and password has been working great for years. Switching to RADIUS or AD requires alot of heavy lifting to implement, manage and maintain for out small requirement. Trusted Access is not suitable for us yet due to the number of windows devices. If anyone has anything to add on the specifics of getting Meraki Authentication to work with Andriod 11 that would be great.

GIdenJoe · ‎Nov 27 2020

In one armed concentrator mode you only have one uplink, so you can never experience a dual active issue if a VPC peer switch would fail because both up and downlinks would be gone on a single appliance. However VPC is in itself cannot be used in this case because the MX does not support port-channels. Individual links to both MX'es is okay though.

Skinner · ‎Sep 11 2020

All unplugged even at elementary level. Difference is that elementary kids spend less time using a device.

Jim_Liang · ‎Aug 25 2020

Daniyal-Alam · ‎Aug 23 2020

Thanks for sharing, Could you please let me know that, I'm getting the data from meraki cloud with latitude, longitude with an offsets(x,y), How it is getting measured, what is the central point?

Prithiviraj · ‎Aug 23 2020

Thanks @Tadpole86 will look into the document. In my setup, all switches and AP are Meraki.

pdeleuw · ‎Aug 21 2020

Hi @Tadpole86 I am asking, because I am interested in this topic. We are talking about security. I like to know what's going on, that's all. There is no debugging to answer the question. A packet capture on the internet interface just gives some packets to UDP Port 9350. The documentation is very vague. You mentioned, phase one of IKE is obsolete in Auto VPN because there is an encrypted and authenticated session to the dashboard. But the White Paper states, that the Peers have an 16-character PSK. So there is another authentication between the peers. Regards, Peter

Tadpole86 · ‎Aug 21 2020

Yep, that is unique to the Meraki switches and needs a bit of extra thought on deployment.

Tadpole86 · ‎Aug 21 2020

I would go through the blog again with a fresh set of eyes and see if you notice where you have gone wrong. Failing that I would just call into support, its included in the cost of the license and they should be able to work this one through with you. Ive spent way too long looking at a setup that should work and finally when I've swallowed my pride and called support they have picked it up in 2 minutes. Sometimes you get abit blind looking at the same setup for so long.

Tadpole86 · ‎Aug 20 2020

I can see that this is a single device having issues connecting. Have you tried updateding the client NIC driver?

Tadpole86 · ‎Aug 20 2020

This information from the document is key VLAN tags are not maintained across wireless mesh links, any VLAN tags applied by wired infrastructure will be stripped before sent across the air. For the above reason, you need a device that will present all traffic to the mesh AP as untagged. This is achieved by a MX NATing the traffic of potentially multiple VLANs and presenting it as untagged VLAN 1, as shown in the article linked https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Extending_the_LAN_with_a_Wireless_Mesh_Link#Example_Supported_Topology So this presents the problem of managing multiple VLANs in building B. The MS range does not have this NAT capability so the short answer to your question is no, this cannot be achieved. I would speak to your Meraki Sales representative and there Design engineer who will be able to look at workable alternatives.

Tadpole86 · ‎Aug 20 2020

I would consider using the individual pre-shared key feature. Sooner or later you are likely to run into issues with the current proposed solution of NAT mode DHCP. The advantage of Ipsk is that you will have a single SSID with a unique password per tenant. This will give them access to there own bubble of devices. Meaning if someone has a wireless printer, apples TV etc they will be able to access them. At the moment NAT mode DHCP will not allow this. https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_Without_RADIUS

Tadpole86 · ‎Aug 20 2020

What do you actually get when you test this? If you getting 150 Mbps on your speed test because of unique flows then great From the speed tests I have used previously, I would expect either100 or 50 Mbps

Tadpole86 · ‎Aug 20 2020

To achieve this level of granular control you want you will struggle on the Meraki for the reasons previously outlined. You would need a firewall that supports HTTPS inspection, which basically decrypts the traffic to be able to differentiate between facebook messenger and regular Facebook. If you are having issues with blocking mobile apps it will likely be because of the quic protocol. a lot of apps use the new-ish QUIC protocol which uses UDP ports 80 and 443 which does not get picked up by the content filtering rules. Once you have configured the recommended rules the QUIC traffic will get blocked by the Firewall, the app will then fall back to using traditional TLS/SSL which will be blocked by the Meraki content filtering rules. Bedtime reading 🙂 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC#:~:text=Palo%20Alt...

Tadpole86 · ‎Aug 20 2020

What happens if you reboot the 4G internet device instead of the Meraki MX? If the internet comes back online by doing that then it is the device in front of the MX that is likely a problem. I have seen this before with buggy home hubs in front of the MX. Your question and description is not particularly clear so its not that easy to help you

Tadpole86 · ‎Aug 20 2020

I am trying to understand what the Azure virtual WAN offers to customers. From what I understand the vWAN solution from Azure is an alternative to the Meraki VMX100 for connectivity to your IAAS resources. Meraki Documentation -https://documentation.meraki.com/MX/Deployment_Guides/Cisco_Meraki_MX_Branch_to_Azure_Virtual_WAN_Deployment_Guide#Supported_Use_Cases From what I understand vWAN is a connectivity piece that simplifies vNET to vNET routing. (How was this done before vWAN?) One negative thing that I have noticed is that you use the Meraki 3rd party VPN to connect into the VWAN which means that you are only using one VPN tunnel. When connecting to a VMX in Azure from a MX using SDWAN you can utilize both WAN links at the MX site. This question comes from a lack of familiarity with Azure, is vWAN really such a big game changer? Was routing between Vnets really that difficult prior to vWAN. Does vWAN offer anything else I am missing?

Meraki

Community

About Tadpole86

Tadpole86

Community Record

Badges

Re: Azure AD authentication on Meraki WiFi

Re: blocking Youtube completely

Re: Android 11 - Meraki Authentication - certificate for radius.meraki.com ...

Re: Nexus - VPC with Meraki MX100 One Armed Concentrators

Re: Poor WLAN Performance when roaming

Re: MR33 - DNS Misconfigured & Uplink IP Address conflict with another devi...

Re: MR42 - Getting the Real Time location but it's not accurate using BLE T...

Re: Meraki Campus Design with two tier Firewall

Re: VPN: Which algorithms are chosen?

Re: L3 Routing migration from 3560-X

Re: Two SSID's, but some devices need to be seen on the both

Re: MR32: client not associated

Re: Point to Point Bridge Between buildings

Re: MR30H in Adult Living Center

Re: speed test when load balancing is enabled

Re: Block Facebook app but allow Facebook Messenger

Re: connection becomes down every few days i must restart Merak to come ...

Azure VWAN and Meraki (Whats the big deal)

Re: Meraki Campus Design with two tier Firewall

Re: L3 Routing migration from 3560-X

Re: MR42 - Getting the Real Time location but it's not accurate using BLE T...

Re: Azure AD authentication on Meraki WiFi

Re: blocking Youtube completely

Re: VPN: Which algorithms are chosen?

Re: speed test when load balancing is enabled

Re: VPN: Which algorithms are chosen?