Meraki

DHAnderson · ‎Nov 12 2019

For me, it is coverage from firewalls through to end user training. I sell a security suite that includes Meraki hardware, email scanning, endpoint protection, computer policy management, Meraki Systems Manager and end user security training. One big advantage of the Meraki Dashboard is that since one signs in with their own credentials, you can see who made what changes. Also, implementing PCI requirements to change passwords is simple with the Dashboard. No more changing passwords manually on hardware scattered through the company. Another big advantage of the Dashboard is that it is easy to push firmware updates out to devices. And if you ever need to know what firmware a device is running, it is easy to find. It is in these simple ways, Meraki Dashboard helps with basic security.

DHAnderson · ‎Nov 8 2019

The client has purchased a Meraki MS120-24P to replace the Netonix. I will be glad to get rid of the Netonix, and the Microtek used to bypass firewall to allow the ISP to manage the switch.

DHAnderson · ‎Sep 30 2019

I am sitting my new deck (took almost all summer to build) on the last 80 degree day of the season in Minnesota. It does not feel like the last day in September, but tomorrow the fall weather resumes. I was hoping for an announcement today, but with a few working hours left, doubts are creeping in. I know that software schedules slip, but some word of forward progress would be greatly appreciated! - Dave

DHAnderson · ‎Sep 5 2019

The Managed Service Provider did not have a Native VLAN specified in the Netronix. Once they put that in to match what I had in the MX84, everything started working. If they had allowed me to look and the configuration of the Netronix, I could have spotted that, rather than playing a guessing game. Thanks, - Dave

DHAnderson · ‎Sep 4 2019

I have a client who is using a Managed Service plan from their ISP. The ISP did not quote a firewall, so I installed a MX84. The Managed Service provider has 3 VLANS, 300, 301, 302. The MX84 has DHCP pools for all three VLANS. Clients attached to a Netronix switch on VLAN 300 and 301 can get IP addresses from the MX84, but clients on VLAN 302 cannot. The port that the Netronix switch is plugged into is configured as a trunk line and all VLANS are allowed. The Managed Service provider has send me images of the NAT table in the Netronix switch, and it shows the MX84 mac address for VLAN 300 and VLAN 301, but nothing listed for VLAN 302. I cannot see the Netronix switch config, but I am told that the Netronix switch port connect to the MX84 is configured for all 3 VLANS. Is there any reason that the MX84 would not be listening for VLAN 302? Any help on this would be greatly appreciated .

DHAnderson · ‎Aug 15 2019

@PhilipDAth When I had a client who had their own servers running an online grocery e-commerce service, they had Fortinet firewalls. I am installing Meraki MX firewalls for my clients that are not running web servers.

DHAnderson · ‎Jul 23 2019

The SSL decryption on my Sonicwall was processor based, not FPGA or custom hardware based. Enabling that feature slowed the network to a crawl.

DHAnderson · ‎Jul 23 2019

@ccnewmeraki; Fortinet firewalls have FPGAs or custom chips to do the heavy lifting in their SSL inspection.

DHAnderson · ‎Jul 18 2019

I have a client that is getting a Win.Trojan.NetWiredRC variant registration message when they try to access their web development site at googleusercontent.com. They are being denied access to that site because of the message (and I have Security in the MX set to Prevention). I appears the MySQL requests are causing the message. I have whitelisted the site in both AMP and content filtering, but that does not solve the issue. Besides whitelisting the IDS rule, is there another way to allow traffic to and from googleusercontent.com? Thanks, - Dave Anderson

DHAnderson · ‎Jun 26 2019

I updated my avatar. Big ears, bald head and all! - Dave

DHAnderson · ‎Jun 2 2019

I just tested this on my MX65 and got the same result. Group policies are being applied, but in addition to the display problems listed by others, if you look at Network Wide -> Group Policies, the policy will show zero devices in that policy.

DHAnderson · ‎Apr 26 2019

More information I had been prototyping a network layout where there is no "Trusted Lan" (See Google's BeyondCorp). I enabled port isolation on my switches, and then Layer 2 Isolation on the RADIUS lan. So the Layer 2 isolation is breaking the ability of a client on a Meshed Access Point to connect to the internet.

DHAnderson · ‎Apr 26 2019

@LegoGeek you can pm me at dave.anderson@essential-consulting.com

DHAnderson · ‎Apr 26 2019

Does anyone know why Layer 3 Mode Roaming works, and Bridge Mode does not, for a meshed MR18?

DHAnderson · ‎Apr 26 2019

I use JumpCloud at my company and a couple of clients. It is basically a Cloud base Active Directory, and the RADIUS is a breeze to setup. I am a JumpCloud reseller, so I am a bit biased, but if you have any questions about it, let me know.

DHAnderson · ‎Apr 24 2019

@PhilipDAth The last firmware change was last October, but I did change the Client IP assignment from Layer 3 Roaming to Bridge Mode recently. I just did some more testing. If the RADIUS network is in Layer 3 Roaming, Clients can connect successfully to the Meshed MR18. If I change the Client IP Assignment to Bridge Mode, clients cannot successfully connect.

DHAnderson · ‎Apr 24 2019

@JessieGomez The Mesh route is showing 78.8 Mbps, Avg Metric of 1179, and usage of 100% to the correct wired MR33.

DHAnderson · ‎Apr 24 2019

I can't see the RADIUS logs, as the RADIUS is managed by JumpCloud. As I mentioned, RADIUS clients can connect to the wired MR33s, but not the Meshed MR18.

DHAnderson · ‎Apr 24 2019

Thanks for response. The RADIUS Server managed by JumpCloud, a cloud based replacement for Active Directory. Clients have no issues connecting to the RADIUS network from either of the wired MR33. As I said before, all 3 AP test fine from the Meraki Web page. It is just the Meshed MR18 that is the problem child.

DHAnderson · ‎Apr 23 2019

I have two MR33 access points that are hard wired and one MR18 access point that is setup in Mesh mode. There are two SSIDs, One uses RADIUS authentication, and the other uses the Meraki Guest network. This setup has been working flawlessly for over a year. But in the last two weeks, clients can connect to the Guest network, but not the one using RADIUS. If I go to the Meraki website and check RADIUS connectivity, all three Access Points pass the test. The clients on the RADIUS network will either get in a continuous 802.11 association and 802.11 disassociation loop, or when they can associate, they cannot get out to the internet. I have factory reset the MR18, but that did not make any difference. All access points are running 25.13 which was applied last October. If I drag a network cable to the access point and temporarily wire it, RADIUS clients have no problem connecting or accessing the internet. Any insights to what might be going on, or what other steps I could take to debug or fix this, would be welcome.

DHAnderson · ‎Apr 20 2019

I had Chrome changing the SSID password if I ever opened the Wireless / Access Control page. The edit box must have been labeled "password" in the HTML code, because it kept putting in my Meraki password. I raised a support ticket to have then change the name of the edit box, and the problem has stopped occuring sometime after that. When the problem was occuring, the site warned me that I had changes that needed to be saved every time I opened the page.

DHAnderson · ‎Apr 20 2019

I have setup VPNs on several firewalls and find that most cannot connect to the VPN from the LAN side. I also have setup Routing and Remote Access on different Windows severs. With that config, users could connect to the VPN from the LAN. A different way to accomplish a Guest Network that has managed access to the LAN, would be to setup an Employee Guest SSID that uses RADIUS to your server for authentication.

DHAnderson · ‎Apr 20 2019

This advice may be too late, but 1 use a password manager. 2 Grant access to a backup admin. I follow these two rules for everything that is of critical importance.

DHAnderson · ‎Apr 13 2019

I do not see any way to see the actual GET. I agree that information would be interesting.

DHAnderson · ‎Apr 13 2019

Is the fixed IP Address stored in the printer configuration, or is the printer getting a fixed address from a DHCP server?

About DHAnderson

DHAnderson

Dave Anderson

Community Record

Badges