Meraki

spaladug

Sorry for the delay as we had to spend a little more time on the fix. Engineering will be deploying the fix on Monday.

SenaAK

Looks like this might be the case for us, but we went ahead and opened an issue with Meraki support. We have 15 sites and this is the only spoke that is giving us this warning.

cmr

!00% what @PhilipDAth says. All IoT equipment, such as printers, smart lights, door access control, CCTV (non Meraki) etc. should be placed in separate VLANs and access from those VLANs to other VLANs should be minimised. Access from those VLANs to the internet should also be minimised. It does take a little extra time to set up, but is well worth it in terms of reducing the attack surface of your site(s) and the possibility of data exfiltration by likely unmonitored devices.

Haertie

Sorry about that last sentence. I meant disabled, not enabled. 😉 I've been doing that for months. I also just noticed that since yesterday, the link for cookie settings is at the bottom right and no longer opens. Let's see if it's just another temporary bug.

amabt

Thanks for you reply. Definitely a hassle not not very manageable.

roqe360

Con el software que esta en el dashboard no funciona, te mandan al TAC de Cisco, pero debes contar con licenciamiento anyconnect, para que te atiendan, pues no tengo. Lo que hice es bajar el software de Apple store, es para Ipad, sin embargo funciona bien en MAC. Sin embargo hay clientes que no les gusta la solución encontrada. Espero te funcione y la acepten

PhilipDAth

If you switch to subscription licences, you can choose a specific termination date (as long as it is more than 12 months away if this is the first subscription). https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_Licensing_Overview

alceryes1

I just want to keep this updated to give it more visibility and make sure Meraki MX admins are aware that 1:1 and 1:M NATs completely bypass layer 3 and layer 7 rules, by default. There is an early access feature to enable layer 3 processing with NATs (see above) but no such process exists to enable layer 7 processing with NATs.

AzeemHaider

I had same issue, do what @PhilipDAth saying, that solved my issue.

KennyBlatz

I used a splash page redirect with a simple form and then printed the unique link as a QR code for guests, it worked smoothly and cut down on front desk requests.

JustinMC

Thanks all, really appreciate the input, currently vendor is working through a process with TAC, provided all your advice and we are agreeing what to do.

jimmyt234

I think the last time I looked at this (years ago) we didn't quality for access to the API. I will have another look and see if that has changed. Thank you!

VRB

It's now working.. It just takes longer than the usual. Takes more than a minute to take effect and sometimes it doesn't.

MarcP

Opened a case at the same time and already got the info I need to remove the MS/MR from the network and then add it to the destination network. Of course, some settings will be lost and I need to reconfigure afterwards. Both networks are combined networks. May would have work when this wouldn´t be the case.

RWelch

The MX tags traffic, but does not enforce Adaptive Policy rules for traffic between directly connected clients on its own LAN ports. Enforcement is designed for scenarios where the destination is another network device (such as a Meraki switch) that supports Adaptive Policy.

eager

thank you, i can see that.

PhilipDAth

There is only one way to make this work, and that is to put a reverse proxy at MX site 1. If you have a Windows machine there, you can use the "netsh interface portproxy" command. https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy At site one you then PAT to this machine, and this machine will then forward the request to site 2.

ShaunCro

oh yes. Also, as I discovered yesterday, dynamic ports aren't considered or catered for in rules, so even though traffic is destined for a port and the service typically is available on that port, the MX doesn't pick up that the port could be dynamic from the source, and record the traffic or attempt to do anything because you defined a specific port on both sides. I loathe the use of "Any" in any situation other than a deny. It's just poor management practices.

gregpalmer2

congratulations!!!

dexter_king

Welcome Chris! That might be the most interesting features on a grill that I've ever heard. I dig it.

thomasthomsen

Within the same "topic" would it be possible to always have a specific application (or internal subnet) exit through for example WAN2, and if WAN2 is not available (not link down, but just not working) then NOT to switch all the traffic over to WAN1. This is an actual scenario that I have at a customer, where WAN2 is used for guests, and they do NOT want this traffic to use WAN1, also in case of WAN2 failure. Do anyone know of a solution here ? (regardless of license, it does not matter)

RWelch

PhilipDAth

Now I can add the network object.

PhilipDAth

My test was with a manually scheduled upgrade. I can't simulate Cisco doing the upgrade. I agree that a Cisco upgrade should be logged somewhere (even if in the event log). I'm thinking it should be logged when the firmware upgrade is done, rather than just the scheduling of it - but at least - it should definately log it somewhere. You will need to open a support case if you think this is a bug.

IvanJukic

Nice... Glad you managed to get it resolved @FSaucedo

About RWelch

RWelch

Community Record

Badges