Meraki

RaphaelL

Do you have AI-RRM enabled ? Also MR 32.1.4 is beta. I would run MR 31.1.8 instead.

jimmyt234

Found the problem - our Orgs are classed as MSP because we have data in the MSP Identification field under Org>Settings, if we remove this value then the EoS/EoL columns become visible. Does anyone know if this data is surfaced in the API?

VRB

It's now working.. It just takes longer than the usual. Takes more than a minute to take effect and sometimes it doesn't.

MarcP

Opened a case at the same time and already got the info I need to remove the MS/MR from the network and then add it to the destination network. Of course, some settings will be lost and I need to reconfigure afterwards. Both networks are combined networks. May would have work when this wouldn´t be the case.

RWelch

The MX tags traffic, but does not enforce Adaptive Policy rules for traffic between directly connected clients on its own LAN ports. Enforcement is designed for scenarios where the destination is another network device (such as a Meraki switch) that supports Adaptive Policy.

eager

thank you, i can see that.

TyShawn

Oooffff I've fought this fight for years. I've escalated to a few of the upper management and even talked about this on calls and C-Live. Nothing was done about this. It got so bad we had to move off Meraki at our HQ. This was a true deal breaker for my org.

PhilipDAth

There is only one way to make this work, and that is to put a reverse proxy at MX site 1. If you have a Windows machine there, you can use the "netsh interface portproxy" command. https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy At site one you then PAT to this machine, and this machine will then forward the request to site 2.

ShaunCro

oh yes. Also, as I discovered yesterday, dynamic ports aren't considered or catered for in rules, so even though traffic is destined for a port and the service typically is available on that port, the MX doesn't pick up that the port could be dynamic from the source, and record the traffic or attempt to do anything because you defined a specific port on both sides. I loathe the use of "Any" in any situation other than a deny. It's just poor management practices.

gregpalmer2

congratulations!!!

dexter_king

Welcome Chris! That might be the most interesting features on a grill that I've ever heard. I dig it.

thomasthomsen

Within the same "topic" would it be possible to always have a specific application (or internal subnet) exit through for example WAN2, and if WAN2 is not available (not link down, but just not working) then NOT to switch all the traffic over to WAN1. This is an actual scenario that I have at a customer, where WAN2 is used for guests, and they do NOT want this traffic to use WAN1, also in case of WAN2 failure. Do anyone know of a solution here ? (regardless of license, it does not matter)

spaladug

Engineering is going to deploy the fix in the next few days. I'll update this thread once it is deployed.

RWelch

AlanGarcia4

Hola, Tengo el mismo problema, encontraste alguna solución?

PhilipDAth

Now I can add the network object.

PhilipDAth

My test was with a manually scheduled upgrade. I can't simulate Cisco doing the upgrade. I agree that a Cisco upgrade should be logged somewhere (even if in the event log). I'm thinking it should be logged when the firmware upgrade is done, rather than just the scheduling of it - but at least - it should definately log it somewhere. You will need to open a support case if you think this is a bug.

IvanJukic

Nice... Glad you managed to get it resolved @FSaucedo

jimmyt234

They are channelling their inner Apple

RWelch

Hi @Jobsp Thanks for that clarification. The link provided to you has the ability to narrow down your SFP module and specify which models of switches work with the specific model. Unfortunately your post didn't specify the full module (just 10Gig and LR type). ENTER THE TRANSCEIVER PRODUCT ID and all compatible models will be displayed. If you are looking for a LR type module that works with Meraki MS switches, the MA-SFP-10GB-LR is listed for your consideration, however the MS210 series isn't listed likely because it's not 10Gig compatible.

DarrenOC

Hi @chrisautomates - might even be worth holding off from the 9300’s and look at the 9350’s. Newer to the market so more longevity. https://www.cisco.com/site/us/en/products/collateral/networking/switches/c9350-series-smart-switches/c9350-series-smart-switches-ds.html

RWelch

Hi @NishP there are two VPN status. Option 1: Organization > VPN Status which isn't as detailed as option 2. Option 2: Security & SD-WAN > Monitor > VPN Status which allows you to see IPSec peers which I am assuming you are using with Fortinet in the equation. Give option 2 a try to see if it shows an IPSec Peer tab (as seen in @alemabrahao picture shared). VPN Status Page

Bemidex

Had a similar delay with alerts recently. The messages finally came through much later than the actual event, which messed with timing. Using text messaging for quick updates is great, but these lags can throw things off. Ended up adding a small log to track the actual switch times so I could compare with when the SMS arrived—helps to spot if it’s a system delay or network issue.

Adoos

It turned out to be a bug in the Cisco OS, we reloaded the Cisco switch and traffic is passed again. Looks to be a layer 2 issue. Version 17.09.04a

PhilipDAth

If you click on a client, on the right-hand side, it shows all the firewall rules and policies that are being applied to the user.

About RWelch

RWelch

Community Record

Badges