Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Atags
Atags
Getting noticed
Member since Mar 30, 2018
Apr 12 2021
Community Record
25
Posts
2
Kudos
1
Solution
Badges
Jan 27 2021
8:28 AM
Hi, Can you setup a HA pair with (2) MX250 Firewalls long distance? We have 2 WAN circuits coming in from different sides of the building. Do they have to be near each other to that? Or doesn't matter? How would I go about this if distance is not an issue for HA? Just have the HA be setup through a network switch? Thank you
... View more
Jan 27 2021
8:14 AM
Hi, I am very familiar with physical stacking and what is does. I have worked with both Meraki and Cisco Catalysts for stacking. I am curious, if 2 MS425-32 Core switches that are separated by long distance inside a building where a physical stack cable won't work, is there a way to stack these over long distance? and if yes, how exactly does it work and what is needed? Would it be the same thing and physical in terms of having that 1 virtual switch for ports and administration if done this way? Thank you
... View more
Jan 22 2021
5:13 AM
@Bruce Ok great thank you very much for all your responses and help! I never worked with APIs before yet and this environment is small so I think I will just keep as is for now. Again thank you!
... View more
Jan 20 2021
9:28 PM
@Bruce Thank you again! So I upgraded to the latest Beta 15 version (Although I think 14 would have worked as well), and I have it working through the Group policy and L3 FW rules. I tested with an VPN account. My only question left is, does this group policy only get applied to the PC he/she logs in from? Or Does this group policy get applied to the username, so that if this username VPNs in from another machine wherever, the same group policy and rules will apply?
... View more
Jan 20 2021
7:37 AM
@Bruce again thank you. Question, so because I have to go to Network-wide -> Clients, does that mean that the user first needs to be created and then actively logged in, in real time in order to apply the policy to them, and see the VPN symbol? And does the policy get applied to only his actual device like a PC? Or his/her user name I create in the Client VPN section? If its just the PC, then if he/she logs in from another device, this would have to be manually re-done again right? If its the username, then it wont matter, meaning they can log in from any device as long as its under that username and credentials right? One other thing, Is the MX15 firmware Beta versions only? The latest one that comes up in my Dashboard for my MX100 is only the MX14.53 version. Thanks!
... View more
Jan 19 2021
10:09 PM
@Bruce Thanks for explanation and time. Not sure if doing this right or docs on this but I tried creating a group policy in the Network Wide tab and then Group Policies. But it looks like there is no option to specify any security usage. Also not sure where to apply that group policy too on the actual VPN user, as this is also not an option either under the Client VPN and users section. Also when you say Client VPN devices, are you referring to their actual PC/WAN IP at home they remote from? I just noticed I am running MX version: 14.42 so not sure if newer versions (15+) have these options you were stating? I attached a photo
... View more
Jan 19 2021
5:35 PM
Thanks Karsten. So I am guessing by your response that the answer to my questions is no then? Thank you
... View more
Jan 19 2021
3:18 PM
Hi, I am trying to achieve the following; I would like certain users of client VPN only certain access to our internal VLANs. So I have a MX acting as my firewall connected to my Cisco CORE switch and Access switches downstream to our internal VLANs (LANs). If I understand correctly, you can only have 1 subnet for client VPN access in right? So based on that, is there a way to limit certain users to access only certain internal subnets only? Example: Bob after using client VPN can only access VLAN #11 and be denied access to all other internal VLANs But Allice using client VPN can access all internal VLANs. If not from above, I don't think FW rules or Cisco ACLs would work because you can only have 1 client VPN Subnet, so restricting 1 VLAN would affect everyone connecting remotely i would believe? If not, how can I achieve this from Meraki MX firewall solution? or with Cisco switches if known as last resort? Thank you,
... View more
Mar 1 2019
8:14 PM
Hi, Ok please see my tests below; Remember they are not piggy backing any PCs off phones. The Phone ports are set up as access and not trunk Before port settings Before a packet capture from a live phone call ... Network policy Subtype (2) Application type [voice] (0x01), Flags [none] Vlan id 4095, L2 priority 5, DSCP value 46 ... After port settings (999 is just a dummy vlan) After change now a packet capture from a live phone call Network policy Subtype (2) Application type [voice] (0x01), Flags [Tagged] Vlan id 118, L2 priority 0, DSCP value 46 Any thoughts on this now and why it changed it looked like? Also why did the L2 priority change also? Does this still look right for QoS? Thanks
... View more
Feb 27 2019
2:25 PM
1 Kudo
You mean put voice VLAN 118 for example in the voice VLAN section in the port edit settings, instead of the data VLAN section and see what happens? Thanks
... View more
Feb 27 2019
1:25 PM
No it's vlans 118-121depending on floor. I saw that as well and was wondering why that is showing up? seems like it's a VLAN number after the standard ones firfCisco 1 thru 409 for if that means something? Thanks
... View more
Feb 27 2019
12:30 PM
This was from the IP phone port itself connected to a active phone call on the Meraki dashboiard ... Network policy Subtype (2) Application type [voice] (0x01), Flags [none] Vlan id 4095, L2 priority 5, DSCP value 46 ... ... Network policy Subtype (2) Application type [voice signaling] (0x02), Flags [none] Vlan id 4095, L2 priority 4, DSCP value 32 ... I tried doing a 10 second port capture on the trunk links but it was so much data that dscp didnt show up in the search. I enable whole ball of wax as I am not sure which would show the dscp values. Low wasn't showing it. Does this seem accurate so far and correct DSCP settings coming into the port for cisco IP Voip?
... View more
Feb 27 2019
11:48 AM
Hi, Yes the traffic would be internal to the stack. Capturing on the trunk links and/or core switch would only show traffic going between floors or inter-vlan traffic. That i understand, but my question was specifically for the same switch (same floor) traffic. How to capture all those ports and the impact? Thanks
... View more
Feb 27 2019
11:36 AM
Hi, I have a client that wants to collect internal data on a internal switch stack and mirror that to an security appliance device. The MS 350 switches are L2 only and are in stacks of 8. Is there anyway to capture most of the switch traffic and mirror it to a security device off the switch in a simple way? Or do you just have to simply click on all the ports you want (lets say 300 out of the 384 ports possibly in the stack of 8 switches) and click mirror? Also if doing that, how would the performance/resource CPU impact be on the switch stack as a whole if enabling all of that? Thank you
... View more
Feb 27 2019
11:13 AM
Hi, Is there anyway or logs debugs etc... to see if Meraki is doing QoS? Basically I have MS350 switch stacks on each floor and Cisco IP 8851 phones connected to them. Phone VLANs are 118,119,120,121 per floor respectively. The phones are on its on separate dedicated POE link and vlan meaning PC's do not connect in the back of them. The MS 350 switches are setup in L2 fashion and are not doing any L3. L3 and SVI's are performed on our Cisco Catalyst Core switch. Each stack connects back to the Core Catalyst switch over port-channels using 2 links (20G total). I noticed that maybe once a day or couple times a week some calls are becoming 1 way audio. On the Core, i have auto default QoS service policy's that are on the trunk links between floors. service-policy input AutoQos-4.0-Trust-Cos-Input-Policy service-policy output AutoQos-4.0-Output-Policy But when i look at the command to see if anything is matching, nothing seems to be matching, it all seems to be in the class-default queue. So back to my question, are their any way I can see the QoS is being trusted correctly like in CLI Cisco world to view if stuff is actually working? Is at least the Meraki side look ok? I have attached some photos of the settings i have on the Meraki's. These are the 4 voice vlans. This is a sample phone port. I did not put the vlan under the voice vlan since the PC is not piggy backing off the phones as mentioned above. Thank you.
... View more
Jan 16 2019
6:52 PM
1 Kudo
Hi. I figured out the problem incase this happen again to someone else or another case. The problem was not on the Meraki's. The issue was actually on the Cisco 9500 Core Switch. Someone must have turned off the DHCP service for some reason. After enabling back on, DHCP across VLANs now work. So this look to be resolved as of now. Thank you all again for your time with this!
... View more
Jan 16 2019
5:14 PM
I ran Wireshark. So if its on the same VLAN as the server it works. But if the PC is not on the same VLAN, I don't see any DHCP coming in to the server and a 169.254 is giving after the timeout. Inter-VLAN routing works and I have the ip-helper on that PC SVI VLAN. The server VLAN SVI doesn't have ip-helper. What else is missing? or needed? Is there a setting in meraki MS for this? These are L2 switches with no routing enabled as again why I have these L2 trunked PO to my Core switch. Thank you
... View more
Jan 16 2019
10:45 AM
Hi so I was able to shutdown the WAP ports for now to test quickly and the good news is that the PC doesn't get a DHCP address anymore from the 10.X.X.X ranges. The bad news is that DHCP is still not reaching the server and giving out the DHCP addresses properly. I have a VLAN 21 which is user VLAN I have a VLAN 3 which my DHCP sits on. The meraki switches have a L2 trunk PO to my Cisco core. On my Cisco 9K core I have the IP-Helper command in the SVI on the VLAN 21 pointing to the correct DHCP server in VLAN 3. VLAN 3 doesn't have a helper under the SVI as I think this is not needed. Inter-VLAN Routing works bc if I give my PC a static address in VLAN 21, I can PING the server DHCP IP address. Here is a packet capture of the DHCP request from PC, you can see it get a 169 address afterwards. Please help. Is Meraki MS not passing the DHCP over correctly etc...? START Capture 17:17:31.104213 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 28:d2:44:bf:56:01, length 300 17:17:35.077127 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 28:d2:44:bf:56:01, length 300 17:17:39.670113 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 28:d2:44:bf:56:01, length 300 17:17:48.139213 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 28:d2:44:bf:56:01, length 300 17:17:48.575824 IP 169.254.226.129.5353 > 224.0.0.251.5353: 0 AAAA (QM)? nycapps02.local. (33) 17:17:48.576343 IP 169.254.226.129.137 > 169.254.255.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 17:17:48.576398 IP6 fe80::99ca:51cd:e1b2:e281.5353 > ff02::fb.5353: 0 AAAA (QM)? nycapps02.local. (33) 17:17:48.576439 IP6 fe80::99ca:51cd:e1b2:e281.61736 > ff02::1:3.5355: UDP, length 27 17:17:48.576479 IP 169.254.226.129.61736 > 224.0.0.252.5355: UDP, length 27 17:17:48.576517 IP6 fe80::99ca:51cd:e1b2:e281.64892 > ff02::1:3.5355: UDP, length 27 17:17:48.576558 IP 169.254.226.129.64892 > 224.0.0.252.5355: UDP, length 27 17:17:48.943792 IP6 fe80::99ca:51cd:e1b2:e281.61736 > ff02::1:3.5355: UDP, length 27 17:17:48.944330 IP6 fe80::99ca:51cd:e1b2:e281.64892 > ff02::1:3.5355: UDP, length 27 17:17:48.944387 IP 169.254.226.129.61736 > 224.0.0.252.5355: UDP, length 27 17:17:48.944430 IP 169.254.226.129.64892 > 224.0.0.252.5355: UDP, length 27 17:17:49.283919 IP 169.254.226.129.137 > 169.254.255.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 17:17:50.042073 IP 169.254.226.129.137 > 169.254.255.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 17:17:56.575813 IP 169.254.226.129 > 239.255.255.250: igmp v2 report 239.255.255.250 17:18:01.042116 IP 169.254.226.129 > 224.0.0.251: igmp v2 report 224.0.0.251 17:18:01.042331 IP 169.254.226.129 > 224.0.0.252: igmp v2 report 224.0.0.252 END Thank you
... View more
Jan 15 2019
11:30 PM
Thank you for your responses! I will see if I can get these WAPs online soon and connected and report back if it solves. Ty
... View more
Jan 15 2019
10:24 PM
Thank you. I checked this (DHCP/ARP section) and I see multiple MAC addresses that when I click on one of the 30 there, it says, MR53 and never connected to cloud. Our wireless guy has not configured these yet. I also saw the actually DHCP server on its server vlan these as well. I cannot see the IP I got in there or the MAC of my PC either so I don't know which of the actual 30 gave the IP but I think you are on to something here. Is there anyway to specially see which WAP is giving the IP out to the PC? Also, So are you saying that just having a MR 53 WAP(s) out of the box fresh and just plugged in, can dish out DHCP by default? How do I stop the WAPs from giving DHCP to wired devices, and just give DHCP to wireless only? Thank you.
... View more
Jan 15 2019
9:43 PM
Hi, I have a switch stack of 8 MS350 switches, that are configured as L2 access type switches. L2 meaning that I have no L3 SVIs on them except the required MGMT IP per switch. I have this MS stack with L2 trunks going up to my Cisco Catalyst 9K Switch which is configured as an L3 Core with SVI's. We have a separate windows DHCP server on our server VLAN. The problem I am seeing is that on the Meraki MS350 switch ports, if a PC is plugged into a user VLAN for example, it keeps getting a 10.X.X.X address with the 10.128.128.128 as its GW and DNS. Sort of like this article https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP which looks like the private addressing that Meraki gives out. If we try static addressing on the PC in the user VLAN its plugged into, all network communication works as expected all over and to the internet. Yes the Cisco 9k Core, has the correct ip-helper in the user vlan SVI to the DHCP servers IP. So why is it doing this behavior and how to resolve this, so that DHCP broadcast requests, go over the L2 trunks to the correct SVI on my Cisco core 9K instead? Seems like Meraki MS is intercepting this and giving out its private IP instead? I saw something on enabling routing etc..., but I want these MS switches to be L2 with no VLAN IPs on them, that why I have the Cisco core for. Also just to mention, we will also have Meraki MR-53 APs also plugged in, which will need this Meraki private IP addressing (10.X.X.X) for its clients to give out for internet. This will sit on the same VLAN as user vlan. Thank you.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 8542 | Feb 27 2019 12:31 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 3723 | |
| 1 | 6548 |
© 2024 Cisco Systems, Inc.
