About SLR

BryceTrapier

@CarolineS I finally got that Meraki Yacht Club swag out on a boat! 😁 ⛵ S/V Azzurra, a Jeanneau Sun Odyssey 479, out of Marina Scarlino in Italy.

NolanHerring · ‎09-12-2019

Looks good to me, although I think you can (maybe should?) turn off the radius override stuff for this test. Also assuming there are not any other access points involved, should be fine leaving the 'all other APs' to 1 as well.

MZimb · ‎09-10-2019

So I am on shard n180. When I was on the phone with support yesterday it took 25 minutes per change. We tried several networks to confirm it wasn't specific to a site. We have the same firewall's everywhere and normally these changes take less than a minute. Support concluded that there is definitely something wrong in the back end and she kicked the ticket up. I will keep you guys informed.

SLR · ‎09-03-2019

Did anyone have to create policies in the Meraki Dashboard? We are not doing policy based...

nuo · ‎09-01-2019

Nice GIF!

cmr · ‎08-29-2019

@NFL0NRfirmware stays in beta until I think ~10% of users install it, with 15.x incrementing rapidly this will take some time! We run 15.x on our production SDWAN but even with fairly regular updating we have some devices on 15.14, some on 15.15 and some on 15.16 so we aren't contributing much to the % of any of them...

Ryans · ‎08-27-2019

Anything! for the love of god anything other than this 15 second Hell Loop

JohnT · ‎08-26-2019

@SLR If you are connecting with WPA-PSK this does not apply. This is only relevant if you want to add your phone/handheld devices to the corporate wifi that uses Radius with domain authentication. Hope this helps.

JeremyC · ‎08-20-2019

Our Meraki pricing, as of last week anyway, hasn't increased.

PhilipDAth · ‎08-16-2019

We tend to do a lot of experimenting. We have both Google Authenticator setup (easy), and SAML against Azure AD (difficult to setup) - and we have MFA enabled for Azure AD, so that uses the Microsoft Authenticator. NPS+Azure AD MFA is a pain because of the lack of logs and diagnostics when things go wrong. If you want MFA for client VPN use a third party solution, like the Duo RADIUS server. If you want to enable "global" MFA for the Dashboard use a third party SAML provider like DUO. You can also use AzureAD if you don't mind doing a bit of extra setup work and Googling. We use AzureAD because we already use Office 365, and it was more convenient to have the one system for everything.

Seshu · ‎08-08-2019

@dhutton That is correct. This is added to prevent admins from changing the uplink IP of an MX by mistake from the dashboard.

nikiwaibel · ‎08-07-2019

5 points 🙂

RumorConsumer · ‎08-06-2019

Right again guys. Configured NTP on each of the switches and they bounce a monster 1k around now on the client list 😉 . Great idea.

PhilipDAth · ‎08-01-2019

Search for the word "firewall" at this url. It has a couple of suitable scripts that you would start with. https://developer.cisco.com/codeexchange/github/repo/meraki/automation-scripts/

CptnCrnch · ‎07-31-2019

I never had luck with such things but I have to admit I‘m eagerly waiting for the results. 😇

Colwelltn · ‎07-30-2019

This has been a neat feature and a good way to fail a site to WAN2 if the site is having problems with WAN1, but not severe enough for SD-WAN to fail the site to WAN2, or in instances where SD-WAN is disabled. This is great when the site is having problems with VoIP and cannot call in, or if the equipment is in a tough location. It is also very helpful as it basically disableds the use of the port, so the uplink graphs still display the connection quality so you know when to enable the port again without having to call the site, reconnet a cable, then find out it is not ready to be used, and disconnect it again.

jdsilva · ‎07-30-2019

@SoCalRacer wrote: Many times it goes back to company policy. If company policy says no social media or youtube, then we just alert managers about it and they coach the employees. This! OMG all freaking day this! Employees misusing company resources, especially to the determent of others, is an HR problem, _not_ an IT problem.

Nash · ‎07-26-2019

Oh please don't do that. You're talking RDPing in from the outside world (Internet) into your test network? IP addresses can be spoofed fairly easily. Using a non-standard port means nothing in these days of port scanners. I know devs demand RDP access all the time, but I strongly believe that requiring use of a client VPN is a reasonable security stance to take. It's not that hard to setup, and it's pretty simple to use.

LudwigD · ‎07-25-2019

Congratulations! At first I taught, where is this in Ghent? But then I read the text Nicely done ! LD

BrechtSchamp · ‎07-24-2019

@MeredithW and @CarolineS , I forgot to thank you for the swag. But since I found it violated yesterday I was reminded of that. Thanks!

Nick · ‎07-23-2019

Attached to that trial info is your local rep who should be able to help

SLR · ‎07-17-2019

remote traveler. I love it! My favorite part of my job is the travel and Meraki equipment!

kYutobi · ‎07-17-2019

That sounds like fun. Hopefully an invite can come our way.

SGenin · ‎07-09-2019

The app uses DNS port to create a tunnel and channel all traffic inside it. It seems that Meraki is allowing DNS traffic to any IP in the background, even if our SSID settings are configured to block all traffic than the one listed in the walled garden. Now the good news, pending further tests, is that we were able to block the app by creating layer 3 firewall rules preventing to use any DNS other than the DHCP provided ones but at MX level. Unfortunately when creating the same set of rules with the MR layer 3 firewall, it doesn't work and the tunnel can still be established over DNS. So 2 problems: 1. Meraki allows DNS traffic to any server during the pre-auth phase. This makes it vulnerable to these apps creating tunnels over DNS. 2. The MR layer 3 firewall is not blocking DNS traffic for the SSID as opposed to the MX firewall. This makes it difficult to scale up a patch as our LAN clients are not using the same DNS servers (it's typically upstreamed to the ISP DNS).

MarcP · ‎07-09-2019

Yes, they work as normal as if you would have something else from meraki there.

SLR

Community Record

Badges

Re: [SURVEY ENDED] Time for a survey — and another chance to snag swag!

Re: 2 VLAN for Same SSID Meraki AP with Radius Authentication

Re: Meraki Dashboard Extrememly Slow

Re: Meraki AP & Radius Integration

Re: 🎁 🍰 🎈 Happy 2nd Birthday, Meraki Community! 🎈 🍰 🎁

Re: AnyConnect VPN support for MX devices

Re: Music on hold preferences and recommendations?

Re: iOS and WPA2 with Radius Authentication

Re: tariffs and increase in pricing (Cisco Products)

Re: Enable MFA for logging into Dashboard only

Re: Updating WAN configuration

Re: [CONTEST CLOSED] The Points Contest is BACK!

Re: Netgear managed switch disappears from client list

Re: Export firewall rules into excel spreadsheet

Re: Points Contest: Week 4 Roundup (Part 2)

Re: Disable wan port

Re: Blocking or Traffic Shaping

Re: Client VPN to 2 organizations

Re: [CONTEST CLOSED]: Community Challenge: MV Motion Recap

Re: Congrats to our June 2019 MOTM winners!

Re: Trying to reach support but cannot because I do not have 8 digit code t...

Re: All-Star Profiles: ww & PhilipDAth

Re: ECMS2

Re: Bypass Meraki Splash pages in 10 secs to gain unrestricted Internet acc...

Re: Use MR33 without Meraki Appliance

Re: tariffs and increase in pricing (Cisco Products)

Re: 🎁 🍰 🎈 Happy 2nd Birthday, Meraki Community! 🎈 🍰 🎁

AnyConnect VPN support for MX devices

Re: This contest is ON POINT.

Re: Update your avatar, win Meraki swag!

Re: Congrats to our June 2019 MOTM winners!