Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About jmorphew
jmorphew
Getting noticed
Member since May 13, 2021
Jul 9 2024
Community Record
47
Posts
8
Kudos
1
Solution
Badges
Jul 9 2024
8:14 AM
It's been a year and a half, and I still get upset thinking about it! I also tell everyone that will listen. Hopefully enough people take notice that Meraki will change their business practices. They could easily disable unlicensed devices without impacting the rest of the network. They could also have the account rep reach out before taking such drastic measures. I really hope they change this policy!
... View more
Apr 10 2024
7:15 AM
I contacted support and it sounds like if we moved our VPN to the MX, the (IDS/IPS) powered by Snort would be able to respond to this sort of attack on our behalf. That seems like a good option for us. Does anyone have high level advice on moving VPN from the Firepower to the MX? Any pros or cons I might be overlooking?
... View more
Apr 9 2024
8:12 AM
Yes, a 1:1 NAT is configured for the FTD. Thanks for that tip, that is not how it was explained to me. Let me reach out to the engineer, that would give us quite a few more options on the FTD.
... View more
Apr 9 2024
7:16 AM
The FTD does not see the source IP because it's behind the MX. That is what I was told my the network engineer helping us anyway.
... View more
Apr 9 2024
6:51 AM
Conditional access on our MFA provider is a good idea, thanks. We can't implement some of the Cisco FTD features because it's behind the MX and doesn't have visibility to the source IP.
... View more
Apr 8 2024
7:01 PM
It wouldn't solve the issue, but it would allow me to block the highest volume of attacks and prevent a denial of service. We originally put in the FTD so we could use AnyConnect, which I understand is now supported by Meraki. I'm interested in how Meraki would different in our ability to respond to the spray attack, but also overall differences between using MX and FTD for VPN.
... View more
Apr 8 2024
1:00 PM
I have the source IP list and it's primarily two countries. The inbound geo-blocking doesn't work because the port forwarding rule supersedes the layer 7 rule. Looking for more general advice on if moving VPN to the Meraki would be a good idea. Yes, we have MFA in place.
... View more
Apr 8 2024
12:47 PM
We have a Cisco FTD 1120 that sits behind our Meraki MX250 firewall. We use the FTD for VPN access and nothing else. We are currently being targeted by a VPN Spray attack, and I would like to manually block the source IP Addresses from attempting to login. I’ve worked with support and with our current setup this doesn’t seem to be possible. We’ve taken several other security measures, but I’d still like the option to GeoBlock or manually block them. I’m looking for general advice on moving our VPN from the FTD to the MX. We currently use AnyConnect VPN with the Umbrella Roaming client. I know we would lose our ACLs if we moved to Meraki. Is there any other consideration? Or pros and cons of one setup over the other?
... View more
Labels:
- Labels:
-
Client VPN
-
Firewall
Jan 28 2023
3:17 PM
1 Kudo
Thanks, yeah we are switching to co-term and getting rid of SAML accounts. I don't love the idea of managing 125 independent licenses, but it's the safe route. Co-term would be my preference, they could easily fix it if they wanted to. This is nothing more than heavy handed DRM meant to maximize profits while putting honest businesses at risk of outages.
... View more
Jan 19 2023
2:59 PM
1 Kudo
Thanks again to everyone that helped me understand the technical failures on this issue. I met with Meraki today. They confirmed everything in this forum. They basically said this is their company policy and they don’t plan on changing it. It’s their way of making sure customers don’t have non licensed hardware. Still seems ridiculously heavy handed towards the small/medium businesses that are honest. It has shaken my faith in a company that I really liked. Large enterprises are exempt because they spend enough money to get Enterprise Agreements with much more associated leniency and customer support. I wish they would do this for all customers. To resolve the issue, we will be moving to per device licensing. I don’t like the idea of managing 125 licenses and renewals, but it’s better than the risk getting shut down again. We will also be moving back to cloud authentication to simplify the alerts and avoid being locked out of the dashboard again.
... View more
Jan 13 2023
6:45 AM
I’ll add something for any small/medium business reading this. We enabled SAML because we thought it made us more secure, especially having duo for two factor auth. After this event, I don’t think any small or medium business should use SAML. It added unnecessary complexity to the notification system (we can’t be the only ones that overlooked that confusing checkbox). But most importantly, when Merkai decided to lock us out of our entire network, they effectively killed SAML auth. So we were no only locked out of our network, but also the Meraki dashboard. I now understand you’re supposed to have break glass Meraki cloud accounts, but for a company with two admins that pretty much defeats the purpose of SAML.
... View more
Jan 12 2023
8:17 PM
And most importantly, if they had just removed access to the two devices with licensing problems I would not be upset. That would be a reasonable response. Removing functionality from completely unrelated devices is not acceptable. I do think this should be escalated, awareness should be spread, and Cisco should respond with why they have this very extreme policy.
... View more
Jan 12 2023
7:22 PM
Yes, mistakes were clearly made on our end I and did not deny that. We are a smaller company, and internal staff cannot be experts in every single product we have. That’s why Meraki is so appealing, because it’s easy to use. I was very impressed with the vendors I worked with on the two switches, but clearly they made a mistake too. And yes, the vendor that helped us setup SAML over overlooked a notification setting. But I strongly disagree that Meraki is blameless. Their policy is horrible and should be changed. If a single human at Meraki had made an effort to reach out to me personally, this would have been avoided. If they had posted a warning in the dashboard, this would have been avoided. There are a ton of ways Meraki could make this a better experience. Over the years, I have had a license or two lapse in coverage. I have never had a company remove my access to hardware that is paid for and under a support contract. I have also never had a company cause a network wide outage because of a minor billing discrepancy. Like many companies, we are not staffed to understand every nuance of the products we use. We rely on solid partners to help us with our infrastructure. In my opinion, Meraki failed as a partner today.
... View more
Jan 12 2023
4:58 PM
You will not be notified if you use a SAML account. Don't let it expire or they will shut down your entire network.
... View more
Jan 12 2023
4:58 PM
You will not receive a warning if you use a SAML account, something to keep in mind. Yes, they shut your entire account down, even the devices with valid licenses.
... View more
Jan 12 2023
4:52 PM
We just went through this today. They shut down our entire network because our support partner forgot to license two switches added to a remote site. They were fully paid for, he just forgot to add the license to the portal. To add to this, my company did not receive a single notification because we use SAML login, and for whatever reason those accounts are not included in the licensing notifications. I cannot believe anyone is defending this policy. Removing access to specific devices would be understandable. Removing access to an entire network absolutely blows my mind. In our case, we have about 500k worth of equipment, and they deactivated everything over a $2,000 switch that wasn't properly installed. This policy should be changed.
... View more
Jan 12 2023
4:43 PM
I already contacted my account rep. He apologized for the outage and said he does not agree with the policy. What's the next escalation?
... View more
Jan 12 2023
3:00 PM
Thanks Ryan, I do appreciate the technical explanation of how this went wrong and the fast responses from everyone. I now have a good idea of how to prevent this in the future. I would like to hear a company statement on why Meraki has this policy? Meraki sent some automated emails, then shut down our entire network for a minor infringement. This had a significant impact our company for the day and we deserve an explanation of why this is your business practice.
... View more
Jan 12 2023
2:31 PM
Thank you, I will also be switching to per device licensing.
... View more
Jan 12 2023
2:31 PM
1 Kudo
Thanks for the reply, Ryan. We will be getting rid of SAML at the first opportunity. I receive other Meraki notifications all the time with my current account, I don’t see why licensing notifications should be any different. Yes, I had the license from an order confirmation sent from our support partner. I rely on partners for setup and support, and the tech clearly forgot to install the license. I doubt they watch the email alerts very closely either, they probably support hundreds of companies. Mistakes happen, a missing license key on two switches feels like a small mistake to me. It did not need to escalate like this. Frankly, I don’t see how you can legally shut down our entire network for noncompliance of two minor devices. I will really struggle to put any additional Meraki equipment in our data center knowing that it can be disabled so easily. Why is this your policy? Send me an email, give me a call, something! I am not trying to cheat Meraki out of any money here. There is no reason to completely lock us out of a network when 1% of it is missing a license key. I didn’t even realize you were capable of shutting down our local, fully paid for hardware. I would revisit this policy, it is terrible customer service and unlike anything else I’ve experienced with Meraki.
... View more
Jan 12 2023
2:13 PM
Do you know if per device licensing prevents Meraki from shutting everything down when one device is not compliant?
... View more
Jan 12 2023
1:16 PM
I think I see what you are referring to now. We use SAML administrator roles for all internal staff. The privilege assigned to my group is organization admin. The licensing alerts are set to go to all organizational and network admins. But because I'm in a group, Meraki doesn't include me in these alerts? How is anyone expected to know that? This is a failure on Meraki's part anyway I look at it. It was a small oversight from the network tech that Meraki escalated into a networkwide outage. They can't send me a personal email before shutting down several hundred thousand dollars worth of paid for hardware? Very frustrated.
... View more
Jan 12 2023
1:01 PM
Respectfully, there is a huge difference between shutting down 2 non-compliant devices and an entire network. They shut down paid for and supported devices with valid licenses. So if I have a camera or environment monitor go noncompliant next, they’re going to shut down my datacenter? I am an admin, and I really don’t see any email alerts. I see plenty of normal outage alerts from Meraki, but nothing from licensing. Any advice on what those emails looks like would be appreciated. Are you saying that because my account uses SSO with Azure, that they don’t send me the licensing notifications?
... View more
Jan 12 2023
11:53 AM
We have a data center, main office, and remote office. All network equipment is Meraki, around 75 devices in total. We've been customers for 3-4 years and have so far been very happy with the products. Last month I worked with a local company to install two smaller Meraki switches at a remote site warehouse. Adding the license for these two devices was overlooked. Today, without notice, Meraki shut down our entire network. All three sites were taken offline, including our data center. I was not able to login to the portal because we use SSO/Duo, but our local support tech was. He said we were shut down for non payment. All devices had a 5 year agreement, just the two new switches were not added after installation. Meraki support gave us a "grace period" to get the new license added and brought us back online. I was not notified in the dashboard or by email, in advance or at the time of the shutdown. To my knowledge, the only way to see a warning was through the licensing page in the dashboard. Why would Meraki shut down our entire network, without notice, for non compliance of two devices? How is this even legal? They shut down over 75 paid for and supported devices. This had a huge impact on our business for the day. I'm very frustrated and worried about this happening again in the future.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 9817 | Jan 19 2023 2:59 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 1633 | |
| 2 | 13204 | |
| 1 | 7616 | |
| 1 | 9817 | |
| 1 | 10424 |
© 2024 Cisco Systems, Inc.
