Meraki

Brash · ‎Apr 24 2024

For stuff like this, other than the documentation release, users are made aware directly in the dashboard with a banner. Administrators may also receive emails about it too. For this one, If the ports change is starting from a certain firmware version, it will also be in the release notes for that upgrade.

Brash · ‎Apr 22 2024

Do you have a screenshot of what you're seeing on the dashboard? According to the installation guide, the ports are as follows (leftmost is the passthrough, and the LAN ports follow after that)

Brash · ‎Apr 22 2024

Alerts from the dashboard aren't customizable. You would need a 3rd party software to receive the alert (via syslog, SNMP or API poling) and send a custom notification.

Brash · ‎Apr 21 2024

That indicates that your DNS is not providing a resolution for that domain name. Check what content filtering you're implementing. If there is a match for that website to a content filtering category that you're filtering, the Meraki MX may be blocking the DNS request. You can see if this is the case from the event logs. Otherwise, check your DNS infrastructure and logging. Other than that, try to resolve the domain name manually with your PC (Eg. nslookup twingate.easysunday.com) and see if it returns the correct IP.

Brash · ‎Apr 20 2024

If you have a syslog set up, I believe you can extract more details in regards to what traffic is passing through the MX. Does the issue correlate with any update cycles for devices? Eg. Windows or office laptops. You could take some captures on the MX WAN port and see if there is a large amount of traffic coming from a single device or going out to a single IP address

Brash · ‎Apr 19 2024

Is your network bound to a template? Requirements, guidelines and limitations Hardware requirements: Port profiles are supported on the MS120, MS125, MS130, MS130R, MS210, MS225, MS250, MS350, MS355, MS410, MS425 and MS450 series switches. Software requirements: While there are no minimum firmware requirements for Port profiles, MS 15.21.1 or later is recommended Port profiles are currently not supported in Configuration Templates or networks bound to them. Support for Configuration Templates and networks bound to configuration templates will be added in the near future. https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Switch_Port_Profiles

Brash · ‎Apr 18 2024

Take a look at the max power limitations and see if any of these apply to your setup https://documentation.meraki.com/MR/Radio_Settings/RF_Profiles#Max_Radio_Power_Limitations

Brash · ‎Apr 18 2024

It's a bit old but as far as I'm aware this guide should still be accurate A Visual Guide to Setting up a Meraki to AWS Site-to-Site VPN – RIT Computing Security Blog (wordpress.com) By default when configuring the non-meraki VPN peer, it applies to all MX's in your org.

Brash · ‎Apr 18 2024

You can use either port 1 or 2 for the SFP, but it will impact which port the RJ-45 cable goes. Using Port 1 for SFP means that you cannot use port 3 for your RJ-45 connection (you'll need to use port 4) Using Port 2 for SFP means that you cannot use port 4 for your RJ-45 connection (you'll need to use port 3)

Brash · ‎Apr 17 2024

As far as I'm aware the MX can only perform outbound NAT when going from LAN to WAN. If I'm understanding correctly, your main issue is network traffic routing across the MPLS towards the new LAN. If there is a default route set already (as the internet exit point is on the MX67), this shouldn't be an issue. If there's no default route towards the MX, you would need to add a route somewhere to send the traffic back.

Brash · ‎Apr 17 2024

CG-NAT (Carrier Grade NAT) is when instead of giving you a true Public IP address, the ISP has given you an 'private IP'. It allows the ISP to NAT multiple customer's onto a single Public IP address. One of the limitations of this is that end customer's cannot perform port-forwarding, as they do not have a dedicated Public IP address for their service. You will need to contact the ISP to request a static public IP be assigned directly to you. (This may require additional costs and will require an outage of some length during the transition). A longer but better explanation of CG-NAT can be found at the following link What is Carrier Grade NAT (draytek.co.uk)

Brash · ‎Apr 17 2024

What is your WAN IP address? Does it look like 100.x.x.x? If so, you might be behind CG-NAT

Brash · ‎Apr 17 2024

Take a look at the link Ryan posted - in particular the truth tables. For many MX's, when Port 2 (SFP) is enabled, Port 4 (RJ45) will be disabled. Try using SFP Port 1 instead. Keep in mind that after moving the SFP to port 1, you will need to reboot as SFP detection occurs on bootup

Brash · ‎Apr 17 2024

To do this, you require a RADIUS server which has the ability to verify against the system which stores your staff credentials. For most enterprises, this will be Microsoft Active Directory. Many people deploy Microsoft NPS (a free RADIUS server) which is integrated into their Windows Domain. This RADIUS server will receive authentication requests from the Meraki Access Point and perform the lookup against Active Directory. Although the overall process isn't incredibly difficult, there are a number of changes and configuration steps to reach the end goal. You will have to assess whether it makes sense for your organisation or not.

Brash · ‎Apr 17 2024

If it's for all traffic, the destination should be "Any" If there's specific destinations, you put the IP address (or subnet) of those destinations.

Brash · ‎Apr 17 2024

Navigate to "Security & SD-WAN" -> "SD-WAN & Traffic Shaping" Under there, you can set an SD-WAN policy with a custom expression. Configure it with the source subnet of the VLAN and WAN 2 as the preferred uplink. Note: If you have Enterprise or Advanced Security License, it will be labelled as "Flow Preferences" See below link: https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/SD-WAN_Internet_Policies_(SD-Internet)#Enabling_SD-Internet

Brash · ‎Apr 15 2024

It's very unlikely the MX will support LAG any time soon. As said above, if you add additional links to the MX STP should block all but one. This technically provides redundancy as if the active link goes down, a blocked link should come online. Personally, I'm not a fan of trusting my redundancy to STP as if it gets it wrong, L2 loops are really messy to deal with.

Brash · ‎Apr 15 2024

As advised above, check your routing. Without additional information and testing, it seems like the most logical place for there to be an issue.

Brash · ‎Apr 15 2024

As @ww advised, check the licensing for your MX. You can find it under Organization -> License Info and look for "MX Product Edition"

Brash · ‎Apr 15 2024

Some further information would be crucial here. What does the setup look like? Do you have a network diagram? Do you have rules setup on the Sophos firewall to allow Meraki MX communication to the cloud? Do you see blocking in the Sophos logs?

Brash · ‎Apr 15 2024

1) "many allowed subnets are configured" -> Is this mean there are many subnets in Private subnets?? Yes, it is referring to the number of advertised private subnetes 2) "The Non-Meraki VPN service may fail to properly establish IKEv2 tunnels" -> Is this mean It may unstable Non-Meraki VPN tunnel connection and may occur repeatly many Non-Meraki VPN SA event log (down/up) ? This I'm not sure. If you believe you're hitting this issue, you may be better asking Merkai support as they can check internal bug notes and logs to confirm whether you're hitting this issue or not.

Brash · ‎Apr 15 2024

Did you configure the radio to 6ghz in the applied RF profile when it was connected to the Meraki Dashboard? https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Conducting_Site_Surveys_with_MR_Access_Points#Configuring_6_GHz_Site_Survey

Brash · ‎Apr 11 2024

Port 161 is SNMP. Check if SNMP is enabled externally on the MX. https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration#Polling_from_Outside_the_Network

Brash · ‎Apr 8 2024

Yes, for networks attached to a template you need to make the change on the template thereby affecting all networks. If it's your ISP PE, they will most likely have configuration setup to drop this type of ping traffic it is too much so as not to overwhelm the router from processing actual data plane traffic on the link.

Brash · ‎Apr 4 2024

Agreed with the above comments; go for a C9300-M instead with an 8x 10Gbe Module The MS390 and MS390 and MS425 actually just got an EOL announcement today. EoL announced for MS120 MS125 MS390 MS410 MS425 faimilies! - The Meraki Community

About Brash

Brash

Community Record

Badges