Meraki

alemabrahao

Yes, all catalyst 9500 are eligible.

alemabrahao

My understanding, based on the documentation mentioned, is that this does not extend to Catalyst, but I could be mistaken.

alemabrahao

Are there any potentially duplicate IP addresses? Is the management VLAN configured correctly? Is the management interface gateway correct?

alemabrahao

Well, in addition to analyzing the firewall logs, I would also capture packets from the firewall using the cameras as the source IPs to see if anything might be being dropped.

alemabrahao

Hi, actually you can do that today, and even perform a health check. Take a look at the documentation. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-to-site_VPN/Primary_and_Secondary_IPsec_VPN_Tunnels

alemabrahao

Do you perform SSL inspection on your firewall? If so, try disabling it for Meraki's domains.

alemabrahao

From what I remember, the supports aren't standardized across MG models. You could try contacting companies that work with 3D printing and providing the measurements and specifications; they will certainly be able to create a model for you.

alemabrahao

I don't think so, since I don't see any API available for that. https://developer.cisco.com/meraki/api-v1/

alemabrahao

Who hasn't made a mistake in their life, right? 😅

alemabrahao

When a network is bound to a template, most configuration setting, including alert email recipients, are inherited from that template. These template-level alert settings typically take precedence over network-level settings unless explicitly overridden.

alemabrahao

I don't think so. As far as I remember, when you schedule a firmware update at the template level, all networks linked to that template will attempt to be updated at the same time.

alemabrahao

This approach of assigning a group policy by device type, in 98% of cases, doesn't work well if you're only using Meraki; ideally, you should have Cisco ISE.

alemabrahao

I don't see the logic in this scenario. If it were a division of VLANs by floors or buildings on a corporate SSID, it would make sense, but for IoT and Guest networks, the ideal is to keep them on separate SSIDs.

alemabrahao

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Virtual_MX_Appliances/vMX_NAT_Mode_Use_Cases_and_FAQ

alemabrahao

No, the MX just advertise routes, but not learn. You need to add the routes manually. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networks_and_Routing/Border_Gateway_Protocol_(BGP)#Route_Advertisement_Behavior

alemabrahao

Well, since we don't have complete visibility into your needs, the best thing to do is talk to your Cisco Meraki partner so they can help you define the best design for you.

alemabrahao

Based on your screenshot, I understand that the certificate is being presented, but Meraki doesn't trust it. Try uploading the root and intermediate CAs used by SM to SCEP.

alemabrahao

Meraki Trusted Access expects the certificate’s Subject Alternative Name to match the Entra ID UPN. If your SCEP template issues certs with only a generic CN (e.g., “SCEP WiFi Certificate”), authentication fails.

alemabrahao

It won't work; MAX needs an internet connection.

alemabrahao

Ideally, you should be able to install a bracket that is not in the line of sight of light fixtures and beams. https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Design_and_Configure/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/High_Density_Wi-Fi_Deployments#Mounting_Access_Points

alemabrahao

Take a look at the documentation. https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Design_and_Configure/Architectures_and_Best_Practices/Recommended_Topologies/MX_and_MS_Basic_Recommended_Layer_3_Topology

alemabrahao

yep

alemabrahao

Yes, you can. https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Design_and_Configure/Organizations_and_Networks/Managing_Multiple_Networks_with_Configuration_Templates#MR_-_Wireless_Network_Templates Note: When binding an existing network to a template, its current configuration will be lost and it will begin using the template configuration.

alemabrahao

So I'm almost 100% sure you won't be able to do that with Meraki alone. I believe the most viable solution for you would be to use some kind of proxy, such as ZIA.

alemabrahao

Perhaps you can achieve this using Internet Breakout. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-to-site_VPN/VPN_Full-Tunnel_Exclusion_(Application_and_IP%2F%2FURL_Based_Local_Internet_Breakout) Note: Application-based VPN exclusion rules(Smart Breakout) are only supported on MX devices with a Secure SD-WAN Plus

About alemabrahao

alemabrahao

Alessandro Abrahao

Community Record

Badges