Meraki

Brash · ‎Aug 9 2023

Congratulations Everyone! Some great posts this month. So good to see rewards for circling back on an issue with later findings/resolutions that help the whole community.

Brash · ‎Aug 9 2023

Corrected a rare issue that could result in excessive device utilization when intrusion detection and prevention was enabled. This is an interesting one. Not sure how rare it was as it's definitely popped up a few times in the forums.

Brash · ‎Aug 8 2023

It looks like the MX 84 has registered (either assigned from its own DHCP pool or other) that the MAC address should match IP address 10.10.1.156. However, the client does not have that IP address and is sending DHCP requests (hence the 169.254.164.225 IP address).

Brash · ‎Aug 7 2023

Congrats mate, that's awesome.

Brash · ‎Aug 3 2023

If all of the ports are being given the same configuration, the change can be easily achieved in the GUI: Switching -> Switch Ports -> Check all of the ports you're making the change on -> Edit. If the ports are being given different configuration, the API is definitely the way to go. You will need your script to import the CSV, parse it and build a JSON file with the appropriate configuration and send that with the API request. You can find a poor but functional powershell script below that you can use as reference. Meraki/Meraki Update Switchports.ps1 at main · Brash92/Meraki (github.com)

Brash · ‎Aug 3 2023

Traffic moving through a Site-to-Site VPN is encrypted regardless of the transport underlay (local LAN, Internet, MPLS etc). Therefore, if you have two Meraki MX devices that can connect to each other via MPLS circuits, you can build a Site-to-Site VPN between the two for encryption.

Brash · ‎Aug 3 2023

VLANs (802.1q) are a standard supported by just about every networking vendor. When you tag a packet with a vlan on one switch, it will be honored by every other switch too

Brash · ‎Aug 2 2023

Can you send a screenshot of the connection error you see from the NPS logs when the client attempts to authenticate from HQ?

Brash · ‎Aug 2 2023

Is the issue only seen with Macbooks? Ie. Do other clients (Windows, Android, IOS) see the same issue when connecting to the same access points? Are other clients being served from that same DHCP pool on the Meraki core? When you say the switch was replaced, was this simply a like-for-like hardware swap with no changes to configuration?

Brash · ‎Aug 2 2023

Do you have overlapping subnets with the VPN and the user's home network? Things to check would be: - What local IP is the user's client? - What VPN IP is the user's client? - What IP is the printer? - What is the output from the client's route table when VPN is connected?

Brash · ‎Aug 2 2023

From what you've described, it sounds like it's definitely not a connectivity or client<-> server trust issue. Are you seeing the HQ clients actually hit the correct policy (ie. matching the conditions)? Assuming you do, what is the error in the event log? It should indicate whether it's a certificate expiration or certificate trust or other issue.

Brash · ‎Aug 2 2023

A few anecdotal comments 1) I've migrated a few sites from existing MPLS connections to DIA SD-WAN. It made sense for that business and their use cases. It was a relatively seamless experience. The tunnels have very high uptimes and has had a positive end user experience. 2) This depends on the client but for anything of a decent size SME business, I look at Advanced Security or better 3) I don't have any sites running HA in routed mode. I have one site running HA VPN concentrators. Failovers between then appears to be relatively quick but haven't tested in a long while

Brash · ‎Aug 2 2023

What do you see in logging on the NPS? Are you seeing an authentication request come in from clients at HQ? And if so, are they hitting the correct policy? Also, do you have the IP addresses of the HQ Meraki AP's/Switches configured as clients in the NPS configuration?

Brash · ‎Jul 30 2023

From the installation guide: "Both 2.4 GHz and 5 GHz client serving radios are diplexed onto each antenna port, so if using multiple antennas it is best practice to aim all in the same coverage area."

Brash · ‎Jul 29 2023

The e6 has 6 connectors, while the e5 has 5 connectors. As @KarstenI alluded to, they're used for MR's with the corresponding amount of connections

Brash · ‎Jul 27 2023

^ This! Definitely this! Pre-stage wherever possible. It can cut down the time considerably.

Brash · ‎Jul 27 2023

Ah, I was under the impression that by filtering "Status: Online" you'll only get currently connected clients, and exclude historical clients. That said I've not tested to confirm.

Brash · ‎Jul 27 2023

Not sure if this is exactly what you're after but it might get you a bit closer: Network-Wide >Monitor > Clients Filter "Status: Online, Connection Type: Wireless" Add "Recent SSID" column via the spanner Sort based on "Recent SSID" column Manually count or download CSV

Brash · ‎Jul 27 2023

Is the ".lan" suffix present regardless of the network that the user is on? Is it happening to only this user or all MacOS users?

Brash · ‎Jul 27 2023

Assuming your ports and VLANs are set up/trunked correctly it should be fine.

Brash · ‎Jul 26 2023

The best solution here is to MDM the devices. You can also apply the group policy on the SSID based on the device type which might be helpful https://documentation.meraki.com/MR/Group_Policies_and_Block_Lists/Applying_Policies_by_Device_Type

Brash · ‎Jul 19 2023

This is correct behaviour - anything that goes across L3 boundaries on the MX (whether over a LAN port or WAN port) will pass through layer 7 firewall rules. The only way to achieve what you're trying to do is alter your topology to have the L3 gateway on the switches rather than the MX. That way traffic between VLAN's doesn't have L7 firewall rules applied to it.

Brash · ‎Jul 19 2023

For anyone looking for some additional free credits, there's a couple of new courses added. Must complete by August 17th. Secure Cloud and Network Analytics Platform: Cisco Learning Network Credits: 16 Implementing and Troubleshooting Networks Using Cisco ThousandEyes Platform: Cisco U (free tier included by the look of it) Credits: 24 Reference: Rev Up to Recert - Bonus (cisco.com)

Brash · ‎Jul 18 2023

As per the following link: The device-specific licenses corresponding to discontinued hardware products will be available for purchase after the EOS Date https://meraki.cisco.com/meraki-support/policies/#product-end-of-life-eol-policy In terms of refund on leftover license time, I don't believe it's possible.

Brash · ‎Jul 18 2023

When you setup MFA via authenticator you get some OTP (One time Passwords) you can use as a backup. If you don't have those, another Administrator should be able to reset it for you. Otherwise you'll need to call support.

About Brash

Brash

Community Record

Badges