About Brash

Brash

It seems like the easiest option for what you're trying to achieve is simply WPA2 Personal with PSK. That way your only needing to pick the SSID and type in the password on the device.

Brash

Meraki switches will accept 3rd party transceivers. However be aware that your mileage may vary based on the 3rd party vendor, and for link specific issues, Meraki support may not assist further until you validate the issue occurs with their transceiver.

Brash

The URL filtering should work as intended. As per the below doc, the example provided matches what you're trying to achieve Content Filtering - Cisco Meraki I just performed a quick test of the URL filtering with a group policy and it seemed to work correctly. It took a few minutes to apply but once applied it worked as intended. Potentially existing flows through the MX won't be blocked so you might have to reboot the device for that. As you indicated, the other way to do it is to create an L3 firewall rule to allow access only to the known public IP and deny all other traffic. This requires the public IP being relatively static but will end up being a 'stricter' policy than just URL filtering.

Brash

You're spot on. In fact, the below doc desribes exactly what you've said and shows an example of what the "firewall info" page should have (source being dashboard IP's, destination being public IP of RADIUS server) RADIUS Proxy for WPA2-Enterprise SSIDs - Cisco Meraki

Brash

Correct. All access points (MR's) use the same license SKU's. Switches (MS) and Security Gateways (MX) have license SKU's that differ depending on the model.

Brash

Happy IT professionals day ( a few days late). One of the best people I've worked with is Mark (he's not in the community and he'll hate me if I use his full name 😂 ). He would always push me to learn more and dig deeper. In the community, shout-out to @ww, possibly the hardest person to tag. Often I'll post a topic or a reply and out of nowhere, ww posts a suggestion that I would never have thought of. Keeps me on my toes and reminds me to look at a problem from all angles.

Brash

What is the IP of the external DNS resolver you're pointing to? Is it an IP provided by ISP1? What happens if you change it to something ISP independent (eg 8.8.8.8 or 1.1.1.1)?

Brash

Definitely start by limiting the vlans allowed in the trunk. If building A only uses vlan 10, trunk only that vlan to the building. If you add more clans later, you simply just add them to the allow list. Not only is it good from a design perspective but it also means the switches won't see dhcp requests from other buildings.

Brash

This is best managed with tighter application controls on the windows side. Eg. Preventing user accounts from installing privileged access applications (or applications in general) via GPO and AD security groups. Additionally, some security software can detect and prevent remote control applications from being installed.

Brash

With that type of fibre run, you're somewhat limited. You can use 3rd party optics in Meraki switches but your mileage may vary and support is very limited. Similarly, the LRM modules will probably work past the specified max distance but the reliability will drop dramatically the further you push them. If it's an important link, I'd look at other options such as repeaters, or possibly rolling out SM fibre.

Brash

Are you using any bandwidth shaping (global or per client)? What models of Meraki devices are you using and what firmware are they running?

Brash

Good point, seems to be a static entry in the table rather than dynamically appearing when in use. Probably worth submitting feedback as I can't imagine most customers would be using SNMP traps alongside email alerts and other monitoring.

Brash

From memory the name is automatically populated based on SSDP and the workgroup configuration. It's then stored in the registry under the network profile. I'm not sure whether you can explicitly set this from the network stack alone. Potentially using the " Domain Name" DHCP option code (15) will set this, but it will also have other effects, such as setting the default domain for name lookups etc. Setting Custom DHCP Options - Cisco Meraki

Brash

The SNMP traps rule is for inbound traffic from the Meraki cloud to your premises. SNMP traps are sent from Meraki cloud to an SNMP server behind a public IP. https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration#SNMP_Traps To allow this traffic through an MX, you would configure port forwarding or inbound NAT under the Firewall configuration.

Brash

As said above, they're purchasable SKU's. Also good to be aware that with co-terming (the dashboard default), the license usage starts ticking from date of purchase, not date of activation.

Brash

It's not automated but you might find this beneficial for analyzing the ASA rules and bulk adding the equivalents to Meraki. https://www.ifm.net.nz/cookbooks/mfw.html

Brash

CPU and Memory utilization don't show in the dashboard. Arguably it's not a bad thing given it's less of an issue these days and some switches are designed to run at a consistent 60-70% memory utilization. If you're troubleshooting a specific issue however, Meraki support can pull the CPU and memory utilization for you from the backend.

Brash

That's correct. 1 port would be active, any others would be STP disabled unless the active one fails. I may we'll be wrong but I would guess a 7 switch stack with Meraki is a bit of an edge case. That would be a lot of east-west traffic.

Brash

The email is real. The IP's/ports need to be open on any firewall and ACL that sits between the Meraki devices and the internet. The firewall rules guide in the dashboard help menu will indicate if there are any rules that are only applicable to certain devices.

Brash

Connecting a PC directly to the fibre CPE and testing speeds to verify is a good start. A couple of other things: - What version is your MX running? - Do you have advanced security features enabled (IPS, content filtering etc.)? - Do you have any traffic/bandwidth shaping set on SSID, group policy or subnet?

Brash

Looks like Anyconnect and its licensing has had a bit of a rebranding. For Meraki MX with Anyconnect, it's trusted that the customer has purchased Anyconnect licenses. There's no validation performed in the dashboard. The license required is one of the following types: AnyConnect Plus license - L-AC-PLS-LIC= Apex license L-AC-APX-LIC= VPN Only license L-AC-VPNO- AnyConnect Licensing on the MX Appliance - Cisco Meraki Based on the type of license you're looking at, you can then purchase them in bands depending on the number of users and length of time. The following link details all of the available SKU's for each license type. Products - Cisco Secure Client Ordering Guide - Cisco

Brash

Scheduling the port to disable should definitely kill PoE. What does the schedule look like?

Brash

Don't have a heap of experience with Umbrella but to answer a few of the questions: 1. I believe rather than offload, Umbrella is another layer on top of Meraki's content filtering, IPS and other security features. 2. An Advanced Security license is required for umbrella integration feature with the MX.

Brash

Are you logged in with an account that has Organization admin permissions?

Brash

The main thing you need to know for your rack is the width between the front rails and the available depth. With that in hand, you can then check the product source sheet. For example, the ms450 is 4.37 × 48.46 × 47.88cm. https://documentation.meraki.com/MS/MS_Overview_and_Specifications/MS450_Overview_and_Specifications

Brash

Community Record

Badges