Meraki

DHAnderson · ‎Apr 20 2020

This is my network at home. MX65, MS220-8P two MR33s and one MR18. Orange cables are primary links, one from the Arris cable modem, and one from the cellular modem. Yellow cables are switches (APs are counted as a type of switch), and blue are data. Future upgrades are to swap out the Netgear cellular modem for a MG21, and the MR18 for a Mr36.

DHAnderson · ‎Apr 20 2020

Nice picture! I use the same color scheme on my network installations.

DHAnderson · ‎Apr 7 2020

How are the users entering their user name? If it is username@domain, you may just username, or domain\username. Also, check out this thread: https://community.meraki.com/t5/Security-SD-WAN/Meraki-VPN-Some-users-get-691-error-when-authenticating-with/td-p/50612

DHAnderson · ‎Apr 7 2020

You can try pinging from the dashboard from anywhere. It caused the MX to ping the device on the local lan. That makes sure the MX can actually see the Windows 10 boxes. This is just a debugging step.

DHAnderson · ‎Apr 7 2020

Are all machines on the on the same subnet? Also, can you ping the windows 10 machines from Dashboard (Security & SD Wan\Appliance Status\Tools) then enter an IP address of a Windows 10 machine and press the ping button.

DHAnderson · ‎Apr 7 2020

As long as the address supports http protocol, you should be able to set it a test for your uplink. For instance, if you want the metrics for your uplink to be tested against Google servers, then create a Web App for google.com. Also, you can change the triggers for any alerts by changing the thresholds in the Web App Health.

DHAnderson · ‎Apr 7 2020

Meraki Insight can do that. The WAN health can give you throughput, loss, average latency, and jitter. The WebApp health can give you similar data for web sites you specify. If anything falls out of spec, you can get an email showing the whether the issue is LAN, WAN , or the site. I can get you a Try and Buy trial for you MX68 if you want.

DHAnderson · ‎Apr 7 2020

Can any clients authenticate through a RODC? Also, do any clients have authentication issues when signing into the site with the primary DC?

DHAnderson · ‎Apr 7 2020

To get the alerts, make sure that under Network-wide/Alerts that both Malware is blocked and Malware is downloaded are checked, and that there is a valid email address in Default recipients

DHAnderson · ‎Apr 6 2020

After changing the Threat Protection settings, did you make sure that the MX had updated it's settings? Sometimes it takes a few minutes for the setting to apply, especially firewall and security rules.

DHAnderson · ‎Apr 6 2020

I just send out a request to that client to schedule more testing time. Earlier I did a packet capture to a different server, and I could see traffic between the client on the VPN and that server on ports 445 and 139, but the Mac was still giving the same error. I will re-run that test on both servers. Thanks for the suggestions.

DHAnderson · ‎Apr 6 2020

You could download Advanced IP Scanner (https://www.advanced-ip-scanner.com/), then run it on a PC connected to the VPN. You would set the range to scan as 192.168.78.0/24. It will then scan that network and you should see all the machines on that subnet.

DHAnderson · ‎Apr 6 2020

It is using Meraki Cloud Authentication. So Macs can get the to shares if they are on the local lan or the site to site VPN. Macs and PC can ping the servers when they are on the client VPN. PCs can use SMB to get the the servers, but the Mac SMB is failing. It almost seems like a timing thing, where the routing through the client's home network to the Meraki firewall, through the subnet routing to the machine takes a bit longer than the Mac likes?

DHAnderson · ‎Apr 6 2020

I have a client with Server 2016, and the VPN setup to use AD authentication. I installed Network Policy Services on the server, and then setup a policy for the VPN. Once that is installed, open up NPS and under NPS\Policies\Connection Request Policies, enable both TS GATEWAY AUTHORIZATION POLICY and Use Windows authentication for all users. Then under NPS\Policies\Connection\Network Policies enable the RDG_CAP_AllUsers policy. I can send you screenshots if you PM me. Also, the may be a simpler method, depending on the number of uses in your AD.

DHAnderson · ‎Apr 6 2020

The client sent me this picture. It looks like the server cannot be found, but it can be successfully pinged. Another interesting item is that PCs have not problem accessing the file shares on that server, so it shouldn't be that SMB is not being routed properly through the VPN subnet to the server subnet. In the MX event log, I can see the client VPN Connect event, but there are no other events until the client VPN Disconnect event. Does anyone have a similar issues with Mac computers accessing a Windows file server over the VPN?

DHAnderson · ‎Apr 5 2020

I entered notepad.pw in Chrome on my phone. The website popped up and my security log on my MX shows that a suspicious .pw query was blocked. If the DNS query was blocked, why could I get to the site?

DHAnderson · ‎Apr 3 2020

Before I replaced my Sonicwall firewall with a MX65, I had it setup to get an IPV6 /60 subnet from Charter. My MS220-8P and MR33 picked up the correct subnet and IPV6 addresses. They also passed on Router Announcements to clients who also got IPV6 addresses on the correct subnet. So while there may be more work on the complete product line, the big push is most likely re-architecting the MX to support a new more complex IP protocol, and the work they have done making sure the Meraki site, dashboard and backend support IPV6.

DHAnderson · ‎Apr 1 2020

micah-cmedics The main strength of Meraki is that they are cloud managed from the start. They did not take a local managed device, slap a dongle on it and make a the same dated interface in the cloud. The second strength of Meraki is the Dashboard. All devices, all clients. The Dashboard benefits goes on and on. The third strength of Meraki is zero touch deployment. Configure the device once you get Claim key. The device lands is some distance city, or state, or country and gets mounted and powered up and is working in minutes. And there it is, in the Dashboard. The 4th strength of Meraki is the extras, the API, Insight and Systems Manager. So while an individual piece of Meraki hardware may be missing a feature, the overall benefit is still tremendous compared to competitors.

DHAnderson · ‎Apr 1 2020

smccloud1, No. In the IPv6 @ Meraki they did not mention what the exciting news was, just that there would be some, if schedules go as planned. Given the shift to working at home due to Covid19, I would be surprised if schedules don't slip. They also stated there could be beta testing over the next couple of months, so the news could be a formal announcement of a beta plan. We have 30 days to find out

DHAnderson · ‎Apr 1 2020

In their February IPV6 update, Meraki said that if they stay on schedule, there will be "exiting" news in April. Let's hope they are staying on schedule!

DHAnderson · ‎Apr 1 2020

micah-cmedics, This board is for Community based support for Meraki, not a general product board. Please refrain from trying to sell competing products here.

DHAnderson · ‎Apr 1 2020

smccloud1, Please keep in mind that the specs for a MX64 is a maximum of 50 concurrent VPN users and a total of 100mbps VPN throughput. - Dave

DHAnderson · ‎Mar 29 2020

Moving the files up to G Suite or One Drive is not an short term option, and the files are part of a production process.

DHAnderson · ‎Mar 29 2020

Philip, Yes, the Macs can successfully ping both servers. In the packet capture I can see traffic over Ports 445 and 137 when a Mac is trying smb, but Macs fail to connect.

DHAnderson · ‎Mar 28 2020

I have a client who have Mac Os devices who access Windows file shares while at work. They use SMB://ipaddress to access the shares. There are two servers which have the shares. One is an old Server 2003 (not domain managed) using SMB1.0 (I know the security risk!), and the other is a Server 2016 Domain Controller using the newer file sharing protocol. Mac and PCs in the offices can get at shared folders on both servers. When the clients took their laptops home and connect to the VPN, Mac OS users cannot get to the file shares. Windows users can get to them. In the Client VPN settings I have the DNS set to the IP of the domain controller, and WINS set for both the domain controller and the Server 2003. I have done a packet capture when a Mac was trying to access share and I could see the SMB request and responses going back and forth. I did not understand the packet data though. I do not know what could be causing the Macs to fail while accessing those shares over VPN. Any insight would be appreciated.

About DHAnderson

DHAnderson

Dave Anderson

Community Record

Badges