Meraki

DHAnderson · ‎Oct 16 2024

I deployed a vMX in Google Cloud and ran into this same issue: Non Windows devices can get into the VPN without any issue. Windows devices give Error 809 No real information in the Windows Event Log Technically, the vMX is not natted. It is setup as a one-armed concentrator, so the one NIC has a public and private IP address. This is enough to confuse Windows though! So I put the registry key in, and that solved our problem! Thank you @alemabrahao

DHAnderson · ‎Sep 21 2023

I am testing out the capabilities of the vMX in Google Cloud. I have successfully setup a site to site VPN to my office MX, and now I want to see if the vMX can act as just a Client VPN into Google Cloud. This leaves me some questions: Can the vMX provide a Client VPN when the vMX is in passthrough mode? I presume I need to give the vMX a public IP address. From a security point of view, is it safe to give it a public address.

DHAnderson · ‎Jul 7 2023

There are two parts to setting up a Site to Site VPN to a cloud like the AWS cloud. Typically, you would need a VMX in the Azure Cloud and a physical MX The instructions to set up the VMX in the Azure Cloud are here: https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Amazon_Web_Services_(AWS) and here: https://aws.amazon.com/quickstart/architecture/cisco-meraki-vmx/ Once you have set that up, you may need to add routes in the AWS route table so packets can find their way back to the Site to Site tunnel. Once the tunnel is in place and the servers can be pinged from the LAN the physical MX is on, then you should be able to access your server in AWS. You could also configure a Client VPN on the physical MX so remote workers can access the servers.

DHAnderson · ‎Jul 7 2023

@EliseNemeth Are you talking about putting the MX in front of the Sonicwall? If so, you can specify a unique VLAN for the port the Sonicwall is connected to. You cannot disable the MX threat protection features by port though. There should be no drawbacks to having the Meraki Threat protection ahead of the Sonicwall. You can also do port forwarding to the Sonicwall port, if the payment vendor is remotely managing it. PCI compliance has a concept called Scope. Basically anything on the same network as a PCI device (typically a card reader or POS) should be PCI certified. That would not be possible if the PCI devices were on the same VLAN as computers, printers and other devices. So typically I set up a PCI specific VLAN that all PCI devices are on. The other thing I do to secure the PCI VLAN, is that I tighten outgoing rules so the only destination is the IP address or URL of the processing company. Doing this has two benefits: This means any non-PCI device that gets on that VLAN will not work. Any malware or skimming device in or on a PCI device will not be able to talk home. If you do all this, you may not need the Sonicwall. -Dave

DHAnderson · ‎Aug 31 2022

From a security point of view, a firewall does not matter how good it is, if the firmware is out of date. Meraki has made firmware updating painless. This is especially true if you have more that one of them. Many of the Fortinet firewalls I see at new clients are out of date, because no one knows how to do it, and the previous IT team did not want to go on site during off hours to update them. -Dave that is not up to date, is One issue we had with our Fortinet firewalls was that updating firmware was a complete hassle. The firewall must be off line, so you either have a spare firewall, or do the work off hours. If you have more than one, the you spend time babysitting the firmware updates. Because of this, most of the Fortinet firewalls I come across are out of date. Meraki firmware

DHAnderson · ‎May 17 2022

@JimboinTexas Changing settings for the WAN should be done on the local status page only. Once that is done, you can create a network in the application by clicking on the WiFi button at the bottom of the screen. There you add your subnet. Give the subnet a name and the GX an address ending in .1 with a subnet mask of 24. Disconnect any clients and reconnect them so they get the proper address and DNS information for the network. To setup a reserved address: Go to Settings (the gear) Click on Advanced Settings Click on Local network addressing. Click on you network Click on the small arrow on the right hand side of the screen. Click on the round bubble that says Reserved IP Addresses Click on the + for Reserved IP Ranges and enter a range Click on + for Device Reservations to reserve an address in the above range. -Dave

DHAnderson · ‎May 16 2022

@JimboinTexas No, it is not to correct location. You have to use the GX20's Local Status Page. You can follow the instructions below. They are the same for all the Meraki Go equipiment: https://documentation.meraki.com/Go/Meraki_Go_-_Local_Status_Page -Dave

DHAnderson · ‎Apr 30 2022

@mitcnn, You will have to use the Local Status page for the GX. You can find the instructions on the links in the accepted answer. The specific instructions are about halfway through the page. - Dave

DHAnderson · ‎Apr 9 2022

If anyone is running a comparison between WatchGuard and Meraki, the issue can again come down to trust. According to a Wired article, WatchGuard did not disclose a vulnerability in their web management interface. https://www.wired.com/story/watchguard-didnt-disclose-vulnerability-cyclops-blink/ How can you trust a security company that lied to it's users about a serious vulnerability? - Dave

DHAnderson · ‎Mar 16 2022

One thing I mention to clients who are considering Ubiquity is compare what the companies say about internal security: Meraki: https://meraki.cisco.com/trust/ Ubiquity: https://www.ui.com/trust: Page Not Found https://www.ui.com/support/security redirects to https://www.ui.com/support/security-rewards/about/ where it talks about its bug bounty program. Add to that their disclosure stance when they suffered a breach due to an insider: https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ So the question is: Do you want to purchase network gear from a company that cares about security, or one that doesn't appear to.

DHAnderson · ‎Nov 8 2021

@Looker44 The MG41 is CAT 18. According to https://www.everythingrf.com/community/what-is-lte-cat-18: LTE Cat 18 is the new technology introduced by 3GPP as part of the LTE Advanced protocol, that supports up to 8 spatial streams, 4x4 MIMO on 3 LTE carriers, 5x20 MHz carrier aggregation and 64/256 QAM. LTE Cat 18 provides a faster and better broadband experience with speeds up to 1200 Mbit/s downlink and 211 Mbit/s uplink. It is compliant with 3GPP Release 13. -Dave

DHAnderson · ‎Sep 22 2021

@akehn No, you do not have to plug all switches into the MX. Each switch should have an up-link defined. I typically use port last port on a switch (24 on a 24 port switch, or 28 if using SPF) as the up-link from the previous device in the chain. I use port 23 (or 27 if using SPF) for the up-link to the next device in the chain. On each of those ports, I set them to Trunk Ports and set the Allowed VLANs to what I need. Keep in mind that each port connected to another port via a patch cable need to have the same VLANs definition.

DHAnderson · ‎Sep 22 2021

@akehn Any connection from MX to MS, or MS to MS or MS to MR is considered an uplink. The switch port settings on the MX are on Security & SD-WAN -> Addressing & VLANs -> Per-port VLAN Settings Both connections for an uplink should have the same VLAN IDs. -Dave

DHAnderson · ‎Sep 22 2021

Doe the VLAN IDs on the MX ports match what the switch uplink ports are set to?

DHAnderson · ‎Sep 17 2021

@Bruce Thank you. I just opened a support case for that!. -Dave

DHAnderson · ‎Sep 17 2021

I have a MG21 connected to Wan2 and fail over works a little too well! I would like to setup firewall rules to block either certain networks or certain web applications when running on Wan2 to cut down on cellular charges. I have cellular firewall rules enabled, but they don't take effect for Wan2. Is there anyway to accomplish what I am trying to do? Thanks, -Dave

DHAnderson · ‎Sep 1 2021

It has come back up for me now. It must be transient issues and it has happened a couple of times now.

DHAnderson · ‎Sep 1 2021

The Dashboard seems to be down again. I am able to sign in, select a customer, but the page hangs or takes an extremely long time to display.

DHAnderson · ‎Aug 10 2021

@zball8888 Meraki has announced that they are working on it, so it is on the way. - Dave

DHAnderson · ‎Jun 11 2021

Has anyone taken a look at the Meraki.com page today? https://meraki.cisco.com/product-category/security-sd-wan/

DHAnderson · ‎May 20 2021

I probably shouldn't include the time I had to write a driver in 11 bit PP code so a Control Data Cyber could talk to a PDP 1123. With no debug capability, I was reduced to run until Cyber crash. The look at a memory dump. More recently there have been countless times when I have walked into a new client, and no one knows the passwords for the firewall, switches or access points. A factory reset and rebuilding things from scratch was the work around. I have also been locked out of HP switches, when the Cert expires and the only access was via HTTPS. So far I have sold 3 Meraki switches because no one could remember the password for the original switch. I have also had a SonicWall that every firmware upgrade corrupted the config so the device so it wouldn't load. Finally, Meraki has allowed me to grow my business! I can manage all my clients networks from anywhere, and with one account. This makes part of my business model scalable!

DHAnderson · ‎May 18 2021

The dashboard just came back for me! Unfortunately, my client is still down. -Dave

DHAnderson · ‎May 18 2021

@BrandonS A local college is building a new dorm. At 9:30 AM the power went out at the college. My client is about 5 blocks away. I am betting that someone dug up a power line and fiber conduit. I did not know that Meraki, or your client was on that same fiber 😉

DHAnderson · ‎May 18 2021

@Inderdeep The are on a small campus where buildings are across the street from each other.

DHAnderson · ‎May 18 2021

My cell phone had the Meraki dashboard page open from earlier today, and I can refresh the page and see live data. I had a client go down (4 sites) at the same time. It look like a fiber got dug up in their area. -Dave

About DHAnderson

DHAnderson

Dave Anderson

Community Record

Badges