Meraki

Brash · ‎Dec 8 2022

Yes, you can use a flow preference for this. However, you cannot use FQDN's for the destination. It needs to be either an IP or subnet in CIDR notation. Also, in your example, the source port is unlikely to be 25. It will most likely be an ephemeral port number and therefore you're better off leaving it as Any. More info at link below. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences#Flow_Preferences

Brash · ‎Dec 7 2022

Use Network Default means that it will use the settings configured in the VLAN, SSID or security appliance policies rather than overriding them.

Brash · ‎Dec 7 2022

It looks like the webpage is either doing a redirect or loading an iframe which is blocked - itfbodn.com

Brash · ‎Dec 7 2022

Can you provide some more information (and/or screenshots) about the URL, what you've placed in the URL allow list, and the block page that you're seeing?

Brash · ‎Dec 7 2022

I believe the AP reports the SNR value from between the AP and the client (so from the AP's perspective)

Brash · ‎Dec 7 2022

"Over the next month, we will be evaluating your contributions to determine the 2021 cohort of All-Stars" I didn't realise my contributions would be backdated to 2021! 😛 Jokes aside, exciting news. 🙂

Brash · ‎Dec 7 2022

Congratulations everyone

Brash · ‎Dec 7 2022

Channel utilization is an indicator or interference and is unrelated to the number of associated users. In your scenario, your AP is broadcasting on channel 6 and is indicating that there are other devices within range broadcasting at that same frequency, thereby causing interference.

Brash · ‎Dec 7 2022

Meraki brought in a requirement for all accounts to also require an OTP. Where MFA isn't setup this is on the form of an email. There is no way to disable this security feature. Further info at the below link https://documentation.meraki.com/General_Administration/Other_Topics/Authentication_Enhancements_and_New_Dashboard_Security_Features

Brash · ‎Dec 6 2022

Getting over 1Gbps throughput with stateful inspection is an expensive endeavour in comparison to free kit. That said, if you're willing to spend, the sizing guide below will show you the different models and applicable specs. https://meraki.cisco.com/product-collateral/mx-sizing-guide

Brash · ‎Dec 5 2022

What shard are you on? I'm not seeing any issues on shard 280.

Brash · ‎Dec 5 2022

How does the solution work? Where does it send the WoL packet from?

Brash · ‎Dec 5 2022

When a group policy is applied to a vlan, it is assigned to all clients within that vlan. So in a packet from host 1 to host 2 (in two different vlans and with group policies applied to those vlans), host 1's group policy is taken into consideration. Then the reverse for the reply packet.

Brash · ‎Dec 4 2022

Have never received an email like that. What address is the email from? What is the suggested "Action Required"?

Brash · ‎Dec 1 2022

Sounds like you're seeing this in action: https://community.meraki.com/t5/Security-SD-WAN/Flow-Preferences-ICMP/m-p/11354 Flow preferences do not honour ICMP (or rules that are "Any" instead of TCP or UDP.)

Brash · ‎Nov 30 2022

For the IP Access List that you have configured on the 3750, it's all IP traffic, not specific ports. So for the Port, you would use "Any" In regards to source and destination, it depends where your IP access list is applied in the 3750. You'll have to identify which interface/SVI it's applied to and whether it's applied inbound or outbound. Once you have that knowledge, you can then map the individual rules across to the Meraki ACL.

Brash · ‎Nov 30 2022

Is there any correlation between the computers with the issue vs those that work,? Eg. Model, OS, wifi adapter and driver

Brash · ‎Nov 29 2022

Intel Wifi drivers have historically been pretty buggy. Here is a post raised for issues on Intel adapters last month. https://community.meraki.com/t5/Wireless-LAN/Intel-Wireless-Adapter-Client-loses-internet-connectivity-after/m-p/139936 See if your issue correlates to a specific driver version, check the release notes etc.

Brash · ‎Nov 28 2022

Have you verified that the ISP side is set to autonegotiate? When testing, did you try manually setting the speed on the port on both sides? I've heard of some issues with 10GB autonegotiating between mx250's and ISP equipment.

Brash · ‎Nov 28 2022

Not sure how well it would work but in theory you could create a group policy that blocks all traffic, then manually add the client with the Mac address and assign it the group policy.

Brash · ‎Nov 28 2022

Yes, you can use any standard c13-c14 cable. The Meraki power cables are c15 (they have the notch at the bottom of the plug) but the devices don't explicitly require this.

Brash · ‎Nov 26 2022

It seems like a device on the wifi is flooding the AP with broadcast traffic. More info can be seen in the air marshal docs https://documentation.meraki.com/MR/Monitoring_and_Reporting/Common_Wireless_Event_Log_Messages#Air_Marshal_Event_Log_Messages Typically flooding will cause problems when buffers are overloaded or specific devices (DHCP servers, gateways etc) are overwhelmed by requests. It's difficult to say exactly whether this would cause a major impact in your environment but I would think most enterprise equipment should be able to deal with 1000 packets in a 10 second interval.

Brash · ‎Nov 24 2022

There may be a battlecard or comparison in the Meraki Partner Portal or in Cisco Salesconnect. If not, check with your Cisco rep to see if there's some internal material they can share.

Brash · ‎Nov 23 2022

You can't apply IP addresses directly to the ports on Meraki. You will need to use Vlans and SVI's.

Brash · ‎Nov 23 2022

Both are acceptable options. It mainly comes down to design preference. One thing to be aware of with option 2 is that you'll have an SVI for each network on the MS, and therefore the ability to route between the networks. If you want to prevent this, you'll need to use Meraki ACL's which (in my opinion) will probably be harder to manage than Forti's stateful firewall rules and zones. Assuming the Forti can do SVI's, a 3rd option you could consider is having a single link between the MS and the Forti with all applicable VLAN's trunked up.

About Brash

Brash

Community Record

Badges