Meraki

DHAnderson · ‎Oct 16 2024

I deployed a vMX in Google Cloud and ran into this same issue: Non Windows devices can get into the VPN without any issue. Windows devices give Error 809 No real information in the Windows Event Log Technically, the vMX is not natted. It is setup as a one-armed concentrator, so the one NIC has a public and private IP address. This is enough to confuse Windows though! So I put the registry key in, and that solved our problem! Thank you @alemabrahao

DHAnderson · ‎Sep 21 2023

I am testing out the capabilities of the vMX in Google Cloud. I have successfully setup a site to site VPN to my office MX, and now I want to see if the vMX can act as just a Client VPN into Google Cloud. This leaves me some questions: Can the vMX provide a Client VPN when the vMX is in passthrough mode? I presume I need to give the vMX a public IP address. From a security point of view, is it safe to give it a public address.

DHAnderson · ‎Jul 7 2023

There are two parts to setting up a Site to Site VPN to a cloud like the AWS cloud. Typically, you would need a VMX in the Azure Cloud and a physical MX The instructions to set up the VMX in the Azure Cloud are here: https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Amazon_Web_Services_(AWS) and here: https://aws.amazon.com/quickstart/architecture/cisco-meraki-vmx/ Once you have set that up, you may need to add routes in the AWS route table so packets can find their way back to the Site to Site tunnel. Once the tunnel is in place and the servers can be pinged from the LAN the physical MX is on, then you should be able to access your server in AWS. You could also configure a Client VPN on the physical MX so remote workers can access the servers.

DHAnderson · ‎Jul 7 2023

@EliseNemeth Are you talking about putting the MX in front of the Sonicwall? If so, you can specify a unique VLAN for the port the Sonicwall is connected to. You cannot disable the MX threat protection features by port though. There should be no drawbacks to having the Meraki Threat protection ahead of the Sonicwall. You can also do port forwarding to the Sonicwall port, if the payment vendor is remotely managing it. PCI compliance has a concept called Scope. Basically anything on the same network as a PCI device (typically a card reader or POS) should be PCI certified. That would not be possible if the PCI devices were on the same VLAN as computers, printers and other devices. So typically I set up a PCI specific VLAN that all PCI devices are on. The other thing I do to secure the PCI VLAN, is that I tighten outgoing rules so the only destination is the IP address or URL of the processing company. Doing this has two benefits: This means any non-PCI device that gets on that VLAN will not work. Any malware or skimming device in or on a PCI device will not be able to talk home. If you do all this, you may not need the Sonicwall. -Dave

DHAnderson · ‎Jan 19 2023

@AnythingHosted Depending on your location, I could pay for shipping. I am looking for another lab system.

DHAnderson · ‎Oct 24 2022

I just installed it on my MX65 and so far so good. Speed test gives me 250 mbps x 10 mbps.

DHAnderson · ‎Aug 31 2022

From a security point of view, a firewall does not matter how good it is, if the firmware is out of date. Meraki has made firmware updating painless. This is especially true if you have more that one of them. Many of the Fortinet firewalls I see at new clients are out of date, because no one knows how to do it, and the previous IT team did not want to go on site during off hours to update them. -Dave that is not up to date, is One issue we had with our Fortinet firewalls was that updating firmware was a complete hassle. The firewall must be off line, so you either have a spare firewall, or do the work off hours. If you have more than one, the you spend time babysitting the firmware updates. Because of this, most of the Fortinet firewalls I come across are out of date. Meraki firmware

DHAnderson · ‎May 17 2022

@JimboinTexas Changing settings for the WAN should be done on the local status page only. Once that is done, you can create a network in the application by clicking on the WiFi button at the bottom of the screen. There you add your subnet. Give the subnet a name and the GX an address ending in .1 with a subnet mask of 24. Disconnect any clients and reconnect them so they get the proper address and DNS information for the network. To setup a reserved address: Go to Settings (the gear) Click on Advanced Settings Click on Local network addressing. Click on you network Click on the small arrow on the right hand side of the screen. Click on the round bubble that says Reserved IP Addresses Click on the + for Reserved IP Ranges and enter a range Click on + for Device Reservations to reserve an address in the above range. -Dave

DHAnderson · ‎May 16 2022

@JimboinTexas No, it is not to correct location. You have to use the GX20's Local Status Page. You can follow the instructions below. They are the same for all the Meraki Go equipiment: https://documentation.meraki.com/Go/Meraki_Go_-_Local_Status_Page -Dave

DHAnderson · ‎Apr 30 2022

@mitcnn, You will have to use the Local Status page for the GX. You can find the instructions on the links in the accepted answer. The specific instructions are about halfway through the page. - Dave

DHAnderson · ‎Apr 9 2022

If anyone is running a comparison between WatchGuard and Meraki, the issue can again come down to trust. According to a Wired article, WatchGuard did not disclose a vulnerability in their web management interface. https://www.wired.com/story/watchguard-didnt-disclose-vulnerability-cyclops-blink/ How can you trust a security company that lied to it's users about a serious vulnerability? - Dave

DHAnderson · ‎Apr 7 2022

Cisco Meraki buys M&Ms with Milwaukee Tools! A previous article about Milwaukee tool purchasing M&Ms was only partially correct. The full story is more complex: While Milwaukee Tool purchased M&Ms and eliminated all colors but red, Cisco Meraki partnered with Milwaukee tool and got permission to produce the green M&Ms. The news was given out in a special Meraki Partner webinar. The network company has been hit hard with the chip shortage, so are seeking ways to expand into new markets. They claim that the green M&Ms are a perfect fit as each one has a M on it and is Meraki Green in color! It also fits into their license scheme as the both the licenses and the M&Ms are consumable. The green M&Ms will be offered in Small. Medium, Large and XLarge quantities, and licenses are for 1, 3, 5, 7 or 10 years. Ordering information: You will be able to order Meraki M&Ms on CCW in the coming weeks. SKUs follow the normal pattern: Model is MM Size is XS, S, M, L, XL License is 1YR, 3YR, 5YR, 7YR and 10YR. Example: LIC-MM-L-3YR Please reach out to your Meraki Partner for further information, or ordering limits / ship dates.

DHAnderson · ‎Mar 16 2022

One thing I mention to clients who are considering Ubiquity is compare what the companies say about internal security: Meraki: https://meraki.cisco.com/trust/ Ubiquity: https://www.ui.com/trust: Page Not Found https://www.ui.com/support/security redirects to https://www.ui.com/support/security-rewards/about/ where it talks about its bug bounty program. Add to that their disclosure stance when they suffered a breach due to an insider: https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ So the question is: Do you want to purchase network gear from a company that cares about security, or one that doesn't appear to.

DHAnderson · ‎Feb 8 2022

Check which flags are set in the RA, I recall that there were some issues with Charter during the Beta. Here is a potentially useful discussion of the RA Flags https://blog.ipspace.net/2012/11/ipv6-router-advertisements-deep-dive.html -Dave

DHAnderson · ‎Feb 7 2022

@BHC_RESORTS Did you manually create the /48, or set the VLANS to auto when setting up the VLANS under Security & SD-WAN -> Addressing & VLANs? I have IPV6 under Spectrum consumer, where they give me a /56. I set my VLANs to Auto and IPV6 is working correctly. - Dave

DHAnderson · ‎Nov 8 2021

@Looker44 The MG41 is CAT 18. According to https://www.everythingrf.com/community/what-is-lte-cat-18: LTE Cat 18 is the new technology introduced by 3GPP as part of the LTE Advanced protocol, that supports up to 8 spatial streams, 4x4 MIMO on 3 LTE carriers, 5x20 MHz carrier aggregation and 64/256 QAM. LTE Cat 18 provides a faster and better broadband experience with speeds up to 1200 Mbit/s downlink and 211 Mbit/s uplink. It is compliant with 3GPP Release 13. -Dave

DHAnderson · ‎Nov 7 2021

@ChesterX https://www.t-mobile.com/cfd/internet - Dave

DHAnderson · ‎Oct 26 2021

I second that motion. I would love to see IPV6 supported. -Dave

DHAnderson · ‎Oct 3 2021

I agree with @cmr.. I would go with the MX95 and the MX250. - Dave

DHAnderson · ‎Oct 2 2021

I am not sure how you company capitalizes equipment, but it is probably over 5 years. So, if you are expecting any type of growth over 5 years, it is better to start a bit larger than undersized. Also, while today's internet speed is not reasonably priced Gigabyte in many places now, in 5 years that could be a different story. One additional thought. I don't know how much of your traffic is to cloud based applications and services. Again, 5 years from now, that could change dramatically. - Dave

DHAnderson · ‎Oct 1 2021

When MX IPV6 is released, you will be happy that you made network objects. We all can probably recite our IPV4 subnets from memory, and identify the subnets by IP address in firewall rules. It will be a while before we can do that with IPV6. - Dave

DHAnderson · ‎Sep 28 2021

If you don't need routing in your setup, the 8 port layer 2 switch is a solid switch.

DHAnderson · ‎Sep 26 2021

I don't think you can accomplish what you want with Meraki Authentication. One approach would be to use RADIUS authentication for JumpCloud. You would need to create a RADIUS configuration for each site, assign your guest users to a group and assign the group to the RADIUS sites. JumpCloud can import users from Google Workspace, Microsoft 365 and Active Directory. If you are only using JumpCloud for RADIUS authentication, it can quite inexpensive for the value. PM me if you want to know more about JumpCloud or would like pricing.

DHAnderson · ‎Sep 25 2021

@ranjankumarsgh What version of firmware are your access points using? Also, is that access point on the same VLAN as the others? I ask because fec0::/10 is a deprecated site local address, and there might be a router on that VLAN advertising that subnet. -Dave

DHAnderson · ‎Sep 22 2021

@akehn No, you do not have to plug all switches into the MX. Each switch should have an up-link defined. I typically use port last port on a switch (24 on a 24 port switch, or 28 if using SPF) as the up-link from the previous device in the chain. I use port 23 (or 27 if using SPF) for the up-link to the next device in the chain. On each of those ports, I set them to Trunk Ports and set the Allowed VLANs to what I need. Keep in mind that each port connected to another port via a patch cable need to have the same VLANs definition.

About DHAnderson

DHAnderson

Dave Anderson

Community Record

Badges