Meraki

alemabrahao

This is a good start. https://www.netacad.com/courses/networking-basics

alemabrahao

The most effective way I see to block the application is via the Machine's Firewall. If you have Trellix or any other corporate firewall that users do not have access to, you can block the application without any difficulty. I hope I have helped you.

alemabrahao

Bonjour forwarding only works when, Client IP assignment is Bridge mode, AP is bridging the SSID into VLANs routed elsewhere, DHCP comes from the network (External DHCP).

alemabrahao

The Bonjour Gateway settings in Group Policies apply only to devices that support Bonjour forwarding at the device level, specifically the MX, not MR.

alemabrahao

On Meraki, Bonjour forwarding that helps wireless clients discover wired or other VLAN services is configured on the SSID Wireless › Access control, not inside a Group Policy. A Group Policy can shape/filter traffic, but the Bonjour proxying that makes cross‑VLAN discovery work is an SSID feature on MR, or a Bonjour forwarding rule on MX when the MX is your L3 gateway. If you only set “Bonjour gateway” inside the policy, the iOS app typically still won’t discover the service. Bonjour Forwarding - Cisco Meraki Documentation

alemabrahao

I don't see any reason for it to cause a problem, if I'm not mistaken, I've done migrations this same way running two MX at the same time and didn't have any issues.

alemabrahao

Traffic‑shaping rules are enforced per client flow, not as a single shared cap per destination or per rule. If you set 1 Mbps on a rule, each matching client flow can get up to 1 Mbps. Ten clients each pulling a Dell payload can therefore add up to 10 Mbps, etc. This is explicitly documented: Traffic and Bandwidth Shaping - Cisco Meraki Documentation Even if you found downloads.dell.com, Dell update agents often use CDNs and multiple hostnames (e.g., Akamai, edge servers that don't resolve to the exact FQDN you defined). The Meraki classification engine uses SNI, certificate CN, DNS information, IP/port heuristics, etc, to associate flows with applications/hosts, but if the flows don't have downloads.dell.com as the SNI, or are obtained from different hostnames/IPs learned via DNS, your custom single-host expression won't capture them all. Traffic Analysis and Classification - Cisco Meraki Documentation

alemabrahao

There is no similar command on the Meraki side, but Meraki doesn't have many restrictions; I've needed to use Fortinet SFP before and it worked without major problems.

alemabrahao

Block UDP/443 on MX for Guest VLAN. This is the simplest and most effective method.

alemabrahao

I don't remember, but you can perform a lab, it's very practical.

alemabrahao

Have you checked the documentation?

alemabrahao

When the Duo login prompt appears, do not click Send Me a Push(since your new phone isn't registered yet). Click on Other options or Settings. Select Manage devices.

alemabrahao

You can add a route manually pointing the VPN interface as destination. https://learn.microsoft.com/pt-br/windows-server/administration/windows-commands/route_ws2008

alemabrahao

Is the split tunnel enabled? https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/Configuring_Split_Tunnel_Client_VPN

alemabrahao

Registry Adjustment (for NAT network) If your client or server is behind a router with NAT: Open the Registry Editor (regedit). Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent. Create a DWORD AssumeUDPEncapsulationContextOnSendRule and set the value to 2. Restart the machine.

alemabrahao

I don't speak Spanish, but considering it's similar to Portuguese, it should be listed under the letter M.

alemabrahao

Just one question: are you performing this test on the same network where the MX is installed, or on a remote network (like in your home, for example)? If you're on the local network where the MX is installed, this won't work.

alemabrahao

IKE and AuthIP IPsec keying modules disabled This might occur if third-party VPN software has been installed and disables the IKEEXT service. To reenable the service: On the affected device, press the Windows key and type Control Panel From the search results, click on Control Panel Navigate to Administrative Tools > Services Find the service named "IKE and AuthIP IPsec Keying Modules" and double-click to open Select Automatic from the Startup type drop-down menu If the service automatically reverts to Disabled, or fails to start, remove the third-party VPN software.

alemabrahao

Change the option highlighted in red to not require a cryptography, set as optional.

alemabrahao

You need to check the Windows logs in the Windows Event Viewer. Take a look at the link I sent you. These logs are related to AnyConnect, and from what I see, you're using the native Windows client with L2TP. Therefore, this log doesn't make any sense.

alemabrahao

On Cisco switches, you can run commands to use incompatible GBICs. But in general, as far as I remember, you can use most GBICs on both Meraki and Cisco's Catalyst line. configure terminal service unsupported-transceiver no errdisable detect cause gbic-invalid

alemabrahao

Replace the MX105 optical connector with a Meraki MA-SFP-10G-LR. The 4500X can retain the Cisco optical connector. This is the only reliable and supported way to establish the connection.

alemabrahao

what is the error code? https://documentation.meraki.com/SASE_and_SD-WAN/MX/Troubleshooting_and_Support/Troubleshooting/Troubleshooting_Client_VPN/Unable_to_Connect_to_Client_VPN_from_Some_Devices

alemabrahao

MR doesn’t have per AP tag bandwidth limits for a single SSID. If you must keep a single subnet and apply different per client caps based on AP tag, you’d need a policy engine that can evaluate AP location and apply per client limits accordingly. MR supports per user bandwidth via RADIUS attributes. If your guest flow uses RADIUS, you can return a bandwidth profile per user. That’s not per AP tag, but you could combine AP group logic in the RADIUS policy to assign different caps based on where they associate.

alemabrahao

Unfortunately, it is not possible to change the fields in Meraki's alert emails. Another way I see it is to send these messages to a syslog server, and on that server you can customize the alerts you want to receive.

About alemabrahao

alemabrahao

Alessandro Abrahao

Community Record

Badges