Meraki

Dunky · ‎Aug 16 2021

Go to Organization>Firmware Upgrades Click on Release notes for the MX, then scroll backwards till you find the CVE#. fyi CVE-2017-14491 is v 15.2

Dunky · ‎Aug 13 2021

Final query on this... I will need to setup a site-site VPN (Non-Meraki Peer - Azure) this HA site. With a single MX I would normally set the remote IP in Azure as the MX DDNS name. How would I configure the Azure end to re-establish the VPN to the standby MX at site - or is that just not possible?

Dunky · ‎Aug 11 2021

@cmr Ahh yes, I can see what you mean now.

Dunky · ‎Aug 11 2021

Thanks guys. The usefulness of a community is reliant on the quality of its contributing members, and I must say there are some very knowledgeable and helpful members here contributing not only their knowledge but their time to helping others. A big thanks to all of you

Dunky · ‎Aug 9 2021

Appears ok in my Summary Report: MX67's and MX84's running 15.42.1

Dunky · ‎Aug 9 2021

Big thanks to all that contributed, plenty of good ideas and pointers. Based on the feedback I have decided to connect each switch direct to the MX rather than the internal switches and each ISP in a separate VLAN (I had intended to do this but hadn't shown it on the diagram). Its not a 24x7 site, so the switches will sit in the same network - I can accept an outage when we upgrade the switches. Will also put an LACP between the 2 switches and trunk the mgmnt VLAN to ensure both are visible in the event of an MX outage. Thanks again to all that contributed.

Dunky · ‎Aug 6 2021

Looking for some design advice... I have 2 MX's in HA mode and two ISP's Each ISP only provided one physical port. I therefore need to put 2 switches between the MX and the ISP router as below: WAN1 on each MX has a public IP from ISP1, WAN2 on each MX has a public IP from ISP2. I also have a public IP from each ISP for the VIP. If I were to use Meraki, how would I configure these so they are accessible via the dashboard (IP addressing, do I need to link them, what would the gateway be etc etc)? Would the following work... Connect them to the MS switch on the LAN side of the MX and make that an access port in the network mgmnt VLAN - would that make them accessible via the dashboad as shown below: or is there a better way? Or am I better off just using 2 unmanaged switches, and if so can anyone recommend a 8port model, ideally Cisco. The intention would be to have to plug into these direct in order to configure. Preference is to stay with Meraki if Option 2 above will work. TIA Steve

Dunky · ‎Aug 2 2021

Thanks for the Heads Up Philip. Have you logged this with Meraki and if so what was their response? I will report back on my experience when I make this change.

Dunky · ‎Jul 30 2021

Is there a way of telling what authentication method a particular client has used? I have enabled WPA2 and WPA3 as below: but how can I see in the dashboard if the client used WPA2 or WPA3?

Dunky · ‎Jul 29 2021

I enabled the alerts on bad signal quality: and get an email: How do I identify which clients actually have the problem? Thanks

Dunky · ‎Jul 21 2021

Thanks @Bruce Its nice to have confirmation that someone else sees the exact same issue 🙂 This is a bit of a show stopper for us. If the non-Meraki peer (Azure) had a vMX, could I apply L3 outbound rules there to prevent the traffic arriving at the onsite MX in the first place?

Dunky · ‎Jul 21 2021

Hi Alex, Thank you for taking the time to reply. That is not the case - I have a rule that permits the return traffic outbound, followed by a deny any any from the local subnet to the remote subnet but incoming traffic on any port is still reaching the local subnet. Here is what I have (10.223.104.32/27 is the remote (non-Meraki peer) subnet and 10.222.109.9 is a host on a local VLAN): The rules should prevent incoming traffic to port 80 on 10.222.109.9, but they don't - I think its only checking the rules on outbound initiated connections, and not return traffic for already established inbound connections. So, in the above config, how do I permit the inbound traffic I want whilst denying all other inbound?

Dunky · ‎Jul 20 2021

I have a site-site VPN established with a non-Meraki peer. I need to be able to only permit specific traffic into the MX site from the remote end. I cannot see a way to achieve this is it bypasses the L3 rules and the rules applied on the site-site VPN are only outbound. Example: Remote subnet 10.1.1.0/24 Local (on MX) device 10.2.2.2/32 I want to permit incoming traffic from 10.1.1.0/24 to 10.2.2.2/32 on port 80 and deny all other traffic. How do I achieve this?

Dunky · ‎Jul 14 2021

Update - looks like this may do the tick - will give it a go as soon as I get the chance and report back. SITE-TO-SITE VPN FROM CISCO MERAKI TO AZURE AND VEEAM BACKUP COPY TO AZURE – PART 1 #AZURE #MVPHOUR #CISCO #MERAKI #VEEAM | CheckYourLogs.Net

Dunky · ‎Jul 14 2021

Thanks ww - will give that a whirl

Dunky · ‎Jul 14 2021

Yes, doesn't work. Give the error I mentioned when try to same it - no Hubs.

Dunky · ‎Jul 14 2021

Is anyone able to point me to some documentation that is current? The Azure end is configured we think. If I go to Security & SD-WAN>Site-Site VPN and set type to Spoke, I can then enter the Non-Meraki VPN peers under the Organization-wide settings. When I click on Save at the end though it wont allow me to save as there is no hub. All we are trying to do is create a site-site VPN to allow specific subnets in Azure to access onsite resources behind the MX subject to L3 rules on the MX. Is there an Idiots Guide to configuring this? TIA

Dunky · ‎Jul 8 2021

Yeah, a separate network per VMX is what I was leaning towards. If we cant create a security appliance network and put a dozen VMX's in it then I guess a network per VMX it will have to be - just would have been nice to create one network with them all in to aid in navigation and keep the number of networks to a minimum. Cheers

Dunky · ‎Jul 8 2021

I am seeking some advice on Best Practice in setting up multiple VMX's. I have a need to create a number of vMX's in Azure. Each will have VPN's to different sites (1 combined network/site in the dashboard) What is the best way to add these to the dashboard? - A single network for the vMX's and put them all in there - Add the VMX to an existing dashboard network (network is a combined network for a location) - Create multiple networks for the Azure locations and put the relevant VMX's in these TIA

Dunky · ‎Jul 7 2021

Thank you for the reply. I can see on the MR36 datasheet: 20 and 40 MHz channels (802.11n); 20, 40, and 80 MHz channels (802.11ac Wave 2); 20, 40 and 80 MHz channels (802.11ax) So I guess it like people say, the graph is very misleading.

Dunky · ‎Jul 5 2021

I appreciate this is an old post, but it has had some recent replies. You are aware that the Cisco AnyConnect VPN client is now supported? Not used it myself (have an MX64 at the one site we have client VPN and the MX64 has to the use the native MS client).

Dunky · ‎Jul 5 2021

So if I have a client showing this: with a channel width of 160MHz: is the low Data Rate that that s being shown something I should be concerned about, or is the information in the dashboard wrong?

Dunky · ‎Jul 5 2021

Thanks for the reply Philip. I will change that as soon as I get the chance. Would that then allow the clients to operate at Data Rates >50% of the client max? I'm interested to understand how changing the minimum support would cause the others to run at a higher rate?

Dunky · ‎Jul 2 2021

"We use GPO to set the right DSCP values on teams traffic and we are also setting the DSCP bits when teams traffic enters the access switch or any WIFI AP." I would be very interested in knowing how you identify the Teams traffic on the AP and switches, as this is something I will need to do shortly. Does Teams not set the DSCP so all you have to do is trust it?

Dunky · ‎Jul 2 2021

All our clients connected to the MR36's show a low Data Rate as % of client max: The above is for one client I selected at random. I have never seen any above 50% In Wireless>Access Control, I have the following settings: All the clients are Windows 10. Is this normal? I am curious as to why this is not closer to 100% of the client max. Thanks in advance Steve

About Dunky

Dunky

Community Record

Badges