About AjitKumar

AjitKumar

Hi Stephen, Hope you have gone through the following blogs. It seems these users were successful in connecting MX to BT Internet. https://docs.nzsystems.com/?p=322 https://community.bt.com/t5/Home-setup-Wi-Fi-network/BT-Infinity-with-Cisco-Meraki/td-p/1750476

AjitKumar

Hi Razoe, @MacuserJimredirects us to a perfect Url depicting the HA functionality in Meraki. However allow me summarize this for you. Your understanding is correct. For HA to work properly VRRP heartbeat shall reach either side ideally via L2 / L3 Core. Also (expcerpt from the Url) *There should be no more than one additional hop between them, and they must be able to communicate on all VLANs. Your queries. 1. Does the WAN1 in Building A and WAN1 in Building be have to be of the same subnet (minimum a /29)? Can they be two /30 IP Addresses (meaning they’re not of the same WAN Subnet). We can have WAN Interfaces of MXes on the different sub nets. However ideally we shall have a vIP based configuration. I guess this may not be possible in your case as the MXes are placed in two different buildings. */30 When using this option, the current Active MX will use its distinct uplink IP or IPs when sending traffic out to the Internet. This option does not require additional public IPs for Internet-facing MXes, but also results in more disruptive failover because the source IP of outbound flows will change. */29: When using this option, both MXes will use a shared virtual IP (vIP) when sending traffic out to the Internet. This option requires an additional public IP per uplink but allows for seamless failover because the IP address the network is using to communicate with the Internet will be consistent. The vIP for each uplink must be in the same subnet as the IPs of the MXes themselves for that uplink, and the vIP must be different from both MX uplink IPs. 2. I’ve seen images/diagrams where the MX1 needs to be connected to MX2 as well as MX1 Needs to be connected directly to SW2, and MX2 needs to be connected directly to SW1. Is this all necessary? Or it’s just additional redundancy? MX1 shall not be directly connected be MX2. This is an old configuration which is not recommended any more as there were Dual Master Issue cropping up. I have also updated your diagram with few comments. Hope this help you.

AjitKumar

Hi, Your message suggests Client VPN Configuration is fine as you are able to PING once you disable the Windows Firewall on the PC/ Resource. (You query is more inclined towards Windows not Meraki anyhow...) As @PhilipDAth suggests you need to list down the services / ports to be allowed on the client and shall be allowed on Windows Firewall. For ICMP (Ping) the following Url may help you to configure Windows 10. https://tunecomp.net/allow-incoming-ping-echo-request-without-disabling-windows-10-firewall/ Hope this helps you.

AjitKumar · ‎10-23-2018

Hi Check the screenshot. Hope this helps you.

AjitKumar · ‎10-23-2018

Hi This seems strange to me. Can we have a test environment? Connect the same pc to non meraki wifi ? Connect the pc to any other internet? Connect the pc via wire? Lets observe the results. I believe this may not be a issue with Meraki.

AjitKumar · ‎10-22-2018

Hi This seems Like DNS related alert. Following are the few troubleshooting steps I shall recommend. Are you able to browse in Incongnito Mode? Are you able to Ping Google? Are the APs Live on the Dashboard? Who is assigning IPs to the Client Devices ? Are you able to resolve websites? nslookup Verify DNS entries for a PC. Try to assign Google DNS? Verify Firewall Rules.

AjitKumar · ‎10-22-2018

Hi I believe the port speed is negotiated and is working at lower speed than the desired. For more information please refer the following Url https://documentation.meraki.com/MS/Installation_Guides/MS210_Series_Installation_Guide#Ports_and_Status_Indicators

AjitKumar · ‎10-20-2018

Congratulations Adam. We shall miss your presence. Hope your contributions to the community continues.

AjitKumar · ‎10-18-2018

Hi Rohit, Greetings. Your questions are not stupid at all perhaps they are helping me to learn new things. Let me try answering them. Again my answers can be wrong. For Question 2 I understand the Traffic Routing is more or less similar to the process you described with Meraki too. However if you establish a FULL Tunnel between the Branch and DC all of the traffic including internet will reach to DC. Hence No Local Break out. In case you establish a SPLIT Tunnel all the internet traffic will breakout locally. I believe it will be challenging to select L7 traffic and redirect rest all other traffic to DC. For Question 3 The Link terminated on Interface 1 and Interface 2 shall be treated as Internet Links and will be used for Meraki Cloud Management Traffic. I do not see an option of selecting 3rd Link (LTE) for Meraki Management Traffic unless Link 1 and 2 fail. Your queries are pointing towards SD WAN feature of Meraki. Hence very quickly (We have Dussehra going on) I could search the following documentation. I am not sure if they are relevant. Also you may watch "Fady Sharobeem" Youtube videos on MX Deep Dive. https://documentation.meraki.com/MX/Deployment_Guides/SD-WAN_Deployment_Guide_(CVD) https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences I hope you are an existing Meraki User. If not you may try a demo. https://meraki.cisco.com/lp/free-demo Have a nice day.

AjitKumar · ‎10-18-2018

Hi Rohit, Let me try replying you. However my answers can be wrong. 1. Number of Supported signatures for Application Recognition The Layer 7 Application database is constantly updated. Following is the excerpt from Meraki website. "The Cisco Meraki cloud-based application signature database is constantly updated to identify new and changing applications, without requiring the administrator to download and install software updates. The Cisco Meraki cloud-based architecture continually learns based on activity from Cisco Meraki's thousands of customers and millions of users, increasing the accuracy and precision of application fingerprints." 2. Does Meraki support DIA for SaaS based traffic(O365, Salesforce) from local exit standpoint while rest of internet traffic should exit from DC I understand this shall be challenging. Perhaps there is a similar conversation going on with @PhilipDAth. Check the following Link https://community.meraki.com/t5/Security-SD-WAN/Meraki-local-break-out-for-office-365/m-p/30010 3. Can LTE interface alone can be used for Signalling to Meraki Cloud while we operate Two MPLS WAN Links simultaneously I understand LTE comes in use when your Internet 1 and Internet 2 Interface links are down. 4.Is full mesh topology a default feature for VPN tunnels or needs to be configured manually I believe you need to define this for on your sites.

AjitKumar · ‎10-17-2018

Hi, Agreed, I shall recommend using the Cisco Router for cell connectivity. This offers us Load Balancing and Traffic Flow Preference feature between the links.

AjitKumar · ‎10-17-2018

Hi, I missed to understand the question? Even though MX WAN2 has a private IP (with Internet Access) there shall not be a challenge in functionality unless you wish to use Port Forwarding , Site to Site VPN (with Non Meraki), Client VPN etc. kind of configuration. Failover and Load balancing between both the links shall work perfectly fine.

AjitKumar · ‎10-17-2018

Hi, Agree with @PhilipDAth. Dashboard will not accept this configuration.

AjitKumar · ‎10-16-2018

Hi I understand "Yes". Kindly check the following Url for more Information. https://documentation.meraki.com/MX/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z1_Teleworker_Gateway

AjitKumar · ‎10-16-2018

Hi, Port Channel on MX WAN Interfaces? I believe shall not be possible. Port Aggregation feature is available on switches. WAN interfaces can offer us Load balancing and Load sharing features. Check the following Url for more information https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Link_Aggregation_and_Load_Balancing#Link_Bonding_(a.k.a._teaming.2C_bundling.2C_etc.)

AjitKumar · ‎10-11-2018

Hi Mehdi This is my understanding. Either of the methods used for testing the throughput is wired. (93 and 87 Mbps). 20 Mbps is when you do the test via Wifi. Can you verify the following. 1. Laptop Wireless Lan card. Is it b/g/n/ac? 2. Connected band. 2.4 / 5 Ghz. 3. Distance from the AP 4. Do the same test on few more devices. 5. I hope you have not created any group policy capping the speed. Also I understand achieving Wired Throughput on Wireless seems to be difficult.

AjitKumar · ‎10-09-2018

That seems to be the best way. Remove and Unclaim the device from Org 1. Claim and Add the same in Org 2. For Licenses reach Support.

AjitKumar · ‎10-04-2018

Hi Aman, This shall not be possible with MX64. You may achieve this with help of Cisco ISE / Radius Server integration.

AjitKumar · ‎10-03-2018

Hi Nick Meraki Go GR10? I do not know the answer. Will you be interested in posting this to a dedicated community of "Meraki Go". That is available at https://community.meraki.com/t5/Meraki-Go-Community/ct-p/go.

AjitKumar · ‎10-03-2018

Hi Chris I may be completely wrong. 4G connectivity is ideal for Cloud Management I do not see them as an alternate for MPLS. However if we can have public static ip and desired ports open on 4G service we may configure site to site vpn with a Non Meraki peer. Note : I have never tried this configuration though. Lets wait for more inputs from community members.

AjitKumar · ‎10-02-2018

Hi I am afraid that shall not be possible. We need to remove and unclaim the device from existing owner.

AjitKumar · ‎10-02-2018

Hi, On boarding 2 ISPs on MX 250 shall not be a challenge. All models of Meraki MXes support 2 WANs. This can be configured from Local Status Page of the Hardware ( Connecting a PC to Management Port). I am sure you know about this. Now segregating WANs each for 2 different organization. One idea shall be to take the advantage of “Traffic Shaping” Feature [Security Appliance->Traffic Shaping]. You may create 2 different subnets on MX250 and with the help of Internet Flow Preferences can route the Traffic to desired WAN. You may configure L3 Firewall rule to deny any communication between the subnets [Security Appliance->Firewall]. However I believe if one the Link fails all the traffic shall move on to the active link.

AjitKumar · ‎09-24-2018

Hi I believe as of now only possibility is to have unlimited or single login. Is there a way to limit number of logins on AD? May be of some help here.

AjitKumar · ‎09-24-2018

Hi I believe as of now only URL logging is possible. https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration

AjitKumar · ‎09-24-2018

Hi, I believe as of now "Hostname" is not supported. We need to configure IP Address in the Radius Server field. However I suggest an input from @PhilipDAth I could be wrong too.

AjitKumar

Community Record

Badges