Meraki

xaviervalette · ‎Oct 27 2022

Hi @suneq, I know that the topic is pretty old, but I anyone still need to show the Dynamic Path Selection in action, you can use NetEm (Network Emulation), It is basically a tool (on Linux) that emulate real WAN link on a simple local link, by adding delays, loss, jitter. If you want a very effective and inexpensive dedicated solution, you can use a Raspberry PI, where you bridge two interfaces together (the Raspberry becomes transparent from a networking perspective), and then you tune the parameters to emulate the WAN failure/issue. Hope it helps! 🙂

shaunchivers · ‎Mar 28 2022

Upgrading to MX 16.16 resolved the issue

Beambox · ‎Dec 8 2021

Regarding not making it accessible on the internet, I wonder if you could use some Cloudflare rules to handle this at the DNS level? One unique aspect of the Meraki captive portal is that it passes in a selection of URL parameters with information such as the device MAC/IP. You could filter based on this, concealing the splash page unless these URL params are present.

suneq · ‎Dec 4 2021

Thanks all for your sharing.

Ryan_Miles · ‎Nov 4 2021

@suneq We're rolling out a new feature to retain configs on template unbind. Most orgs should already have this enabled now.

PaulMcG · ‎Oct 25 2021

I've only deployed captive portal on MR (not Ucopia) so can't say how it would work on an MX, but this is the Meraki documenation for both devices. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Splash_Page#Splash_Page_Customization

Bruce · ‎Oct 25 2021

This article has the failover times in it, https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_SD-WAN. It mentions that tunnel performance is tested every second, but nothing more than that. I’m not sure if Meraki AutoVPN uses IPsec Dead Peer Detection, or a version of it (I expect it does) - there is plenty of information on the internet about that, but not sure what parameters Meraki use.

suneq · ‎Sep 29 2021

Thanks for your replies. I've noticed recently that I was mistaken from the beginning, my MX67 did not work with the same IP on WAN 1 and WAN 2, the WAN 2 status was failed. I had a Meraki engineer on the phone and he confirmed that we can configure WAN 1 and WAN2 in the same subnet but they cannot share the same IP. Sorry for the wrong information.

PhilipDAth · ‎Jul 29 2021

I have had a client do that. Each country is a separate management domain with their own IT people. The different countries networks are not connected. If you wanted to create connectivity between the different organisations you would create a a transit site (or make each DC a transit site). You put an MX in each org next to each other, with static routes pointing to the sites in the other org, and then redistribute those routes back into each others AutoVPN. There is no "merge" option for organisations. You have to take everything out of one and create it in the other, including all of the configuration.

suneq · ‎Jul 18 2021

Hi @GIdenJoe , Thanks for your explanation. I will ask the client to add a back-to-back link and iBGP between 2 Cores. I wanted to be sure that I undertood the logic before asking the client to change their design. Thanks again.

suneq · ‎Jul 7 2021

Hi @cmr , hi @KarstenI You are totally right, the WAN configuration is visible as soon as the ISP fixes their connectivity issue. I did not have physical access to the device so it took a while to have someone to test. Thanks for your great help.

GreenMan · ‎Jun 14 2021

Licences are neither co-term, nor PDL, in themselves; a license can be added to either type of Organization. Typically, for rollouts into co-term Orgs, which happen over a period of time, any delays between order and usage can be accounted for within the solution pricing; that's why it's important to plan migrations effectively and communicate these with the Cisco Meraki team, prior to placing orders. Remember that Meraki Zero Touch Provisioning, maybe coupled with Templates or API-based automation, can also make your rollouts extremely rapid!

suneq · ‎Jun 11 2021

Thanks all for your great help. It's nice to hear feedback from the field.

KRobert · ‎Jun 1 2021

Here is a good article on MX Sizing and how to choose the best option for your setup. https://www.willette.works/meraki-mx-sizing/ We have 2 DCs and we utilize two sets of MX250s for our environment with about 40 spoke networks. In each DC we have an HA pair running on 1-arm mode on the LAN. This is for all Site-to-Site VPN traffic. Then we have an HQ pair of MX250s acting as a our edge firewall routers, separate from our site-to-site VPN. This way your firewall wall is independent from your VPN traffic.

Meraki

Community

About suneq

suneq

Community Record

Badges

Re: How to test the Dynamic Path Selection

Re: MX VPN Concentrator VRRP bug in 15.43 & 15.44

Re: Guest Wifi with "internal" captive portal

Re: L7 firewall rules for Internet traffic only?

Re: Template drawback ?

Re: MX67W / Guest Wifi with Ucopia captive portal

Re: Soft failure test / Internet traffic failover much slower than VPN traf...

Re: Same IP addresses on WAN ports

Re: Design question: Multi-organization

Re: DC redundancy with BGP

Re: Warm Spare / Add secondary uplink

Re: Licensing "issue"

Re: Public vs private IP

Re: VPN Concentrator design choice

Re: Public vs private IP