Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About jj_inno
jj_inno
Here to help
Member since Dec 30, 2020
Apr 6 2021
Community Record
10
Posts
0
Kudos
1
Solution
Badges
Mar 23 2021
7:36 AM
The issue was that the Deny rule was listed first, and every rule after that was bound to the first rule, so nothing could communicate, because the first rule said to Deny All. Though I recognize that the Deny rule is for VLAN 3, that appears to have been the issue, because everything worked after that, and I moved the rules around to check if that was the issue, and it appears that it was.
... View more
Mar 22 2021
5:13 AM
I'm not sure, though I will look further into that question. Does this mean that the rules that I setup look correct at least?
... View more
Mar 19 2021
7:43 AM
Oh! I missed that part! @ww My apologies They were originally on the same VLAN and could communicate fine. The change to a new VLAN has been a recent change.
... View more
Mar 18 2021
8:53 AM
[ Firewall Rules (found under Configuration) ] [ Policy Rules Applied to VLAN 5 ]
... View more
Mar 18 2021
7:10 AM
I have tried opening Outbound ports within the Policy for the VLAN 5, as well as opening Outbound ports within the Firewall rules, with no success. In fact, I just did a general opening of all ports/protocol types on both ends, but cannot communicate with anything on the VLAN 5 still.
... View more
Mar 18 2021
6:36 AM
[ Greetings! ] I am new to working within the Cisco environment, and though I like to believe I understand the theory of firewalls and ports, I am having trouble putting theory into practice. At the moment I am attempting to get a UniFi set-up on one VLAN to communicate with a UniFi controller on another VLAN. [ Situation ] + Items of Interest + * Meraki MX84 * UniFi set-up (AGP, Gateway, etc) * UniFi controller + Environment + * UniFi set-up behind Meraki MX84 as VLAN 5 * UniFi controller behind Meraki MX84 as VLAN 1 (the "general" default VLAN) * UniFi set-up and UniFi controller do not share the same port + Notes + * VLAN 5 can ping and connect with devices on other VLAN networks * VLAN's other than 5 cannot ping into anything within the VLAN 5 network [ Goal ] If I am correct, I need to open the appropriate ports to allow the UniFi set-up on VLAN 5 to communicate with the UniFi controller on VLAN 1. My troubles are, I don't understand how ports work within the Meraki system. It isn't intuitive and some of it doesn't make sense (such as how all incoming traffic, by default, is blocked, yet all traffic flows into the VLANs?). I'm guessing what I need to do, is create a Group Policy for VLAN 5 with Firewall Outbound rules that allow those specific ports to communicate from VLAN5 to VLAN1, and then create a policy for VLAN 1 to allow those ports to communicate back to VLAN 5. OR Add Port Forwarding rules within 1:1 NAT. Any assistance here would be lovely. Please assume me dumb, as if examples and references need to be made.
... View more
Thank you for answering @PhilipDAth 's question! I apologize I didn't respond any sooner to these; holidays touch my attention away. The Client VPN is turned on in the Meraki, and it can be VPNed to, but we want to be able to VPN to the Meraki, and VPN to the USG, without first having to connect/VPN to the Meraki; We effectively want two separate VPN networks under one Internet IP (we only have one IP assigned/running to us). If I am correct, and this took a bit for me to find, I think I read that that is possible if we turn off the Client VPN on the Meraki and use the 1:MANY NAT rules (I think, but I just came across it and am still attempting to understand it and the rules behind it, and how to set it up). If this is correct, then I think I need to setup a second network behind the Meraki that will act as the substitute for the Client VPN that was turned off (to start using the 1:MANY rules). I hope that makes sense. 🙂
... View more
The USG has a few options for VPN: * Remote User VPN * Site-to-Site VPN * Client VPN Client VPN is not what I need here (I'm pretty sure), and I am not sure which option of the other two I should use. Reading about Site-to-Site I gathered that it allows multiple networks to function/stay connected as one, and I assume I could setup some firewall rules to limit access to the port that the USG is connected to if I decide to use Site-to-Site. Otherwise, I assume Remote User VPN is what I am looking for, with NAT (thank you for informing about that) and some firewall rules. Site-to-Site offers the option for IPsec, but Remote User does not. Currently, the Meraki has it's Client VPN enabled so users can access the network remotely, and if I understand you correctly, you are saying that if I want to have a VPN access to the USG, I will have to turn off Client VPN. If I do turn off Client VPN within the Meraki, I assume I could use another device to create another VPN behind the Meraki, similar to the USG, so that both networks can be accessed via their own VPNs. Does that makes sense? Also, I assume I will be using 1:Many NAT rules for this as well.
... View more
Summary: I am currently working on setting up some new hardware and re-configuring a network that I am responsible for. The objective is to have an individual VPN into the USG network. The USG is on it's own network behind a Meraki MX84. The USG is connected to the MX84 via a VLAN configured port (configured within the Meraki Dashboard). The USG Network can be accessed when connected to the local network that the Meraki is connected to, and can also be accessed when VPNing to the Meraki, but I seek to allow a user to VPN directly to the USG network through the MX84, without having to VPN to the Meraki first (without having to double VPN). Ramblings: I must admit that this is new to me. I have a general understanding of networking, but a lot of this in unfamiliar grounds. On the USG side, there are two settings for a VPN (well, three actually, but one doesn't work with this): Remote VPN and Site-2-site VPN. I have two different thoughts about this, I could setup the USG with a Remote VPN and have those seeking to connect with the USG be pushed/ported through via rules on the Meraki, or I could link the Meraki and USG via a site-2-site VPN connection via a VLAN. My Troubles: I'm not sure which is the best approach. Also, all of the VPN clients I have used ask for an IP or Name Server (DNS, Domain Name, why is there no standard?), yet, from my understanding, we, via our ISP, are only given one IP address, and the Meraki itself can be given a Domain Name that matches that IP address (as it is set in the settings of the Dashboard), so I am not sure how a remote user can actually get to the USG via a VPN client if the USG isn't actually visible on the internet. Another thing, once a remote user connects to the Meraki, how does the Meraki know which data to send to the USG VLAN if all the data is coming from one source without anything distinguishing it from the other data? I recognize that there is a chain in the way data moves through routers and the such, but from my position, how am I to tell my simple VPN client "Go to [IP], and THEN go to [IP]." I assume there are rules that can be set within the Meraki that will sort all of this out. I assume I am thinking too hard about this, and/or don't have enough experience.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 4308 | Mar 23 2021 7:36 AM |
© 2024 Cisco Systems, Inc.
