Meraki

Brash · ‎Jan 12 2023

I typically don't set new years resolutions but last year I re-certed my CCIE which was a big tick off the list. Certification wise this year I've got ECMS 500-220 in my sights. Stretch goal is either CCNP of a different track or potentially an Azure exam given I've been doing a bit of that these days.

Brash · ‎Jan 12 2023

Just to add to this, I'd probably steer clear of using MFA for wifi auth. It can be a frustrating experience for users, and from what I've heard it can be a pain when roaming or at wifi signal boundaries.

Brash · ‎Jan 12 2023

You make the change in the Meraki dashboard under Wireless -> Access Control. Select the SSID you want to make the change to and look for "Advanced RADIUS settings" One other thing to be aware of is that the RADIUS server also has a timeout of how long to wait for the MFA response. Azure MFA with NPS - 20 seconds timeout extension - Microsoft Q&A

Brash · ‎Jan 12 2023

If you open the left hand menu, you'll find all of the community pages. A lot of what you are looking for can be found under "News & Announcements". Security vulnerabilities are sometimes listed here (https://meraki.cisco.com/blog/cisco-meraki-customer-advisories/) but for the most part are found with the other Cisco advisories

Brash · ‎Jan 6 2023

Verify that the fibers in the pair are the correct way around. Try crossing them on one of the cables and see if the link comes up.

Brash · ‎Jan 6 2023

Best to check with your Meraki rep to confirm 100% but I've only ever seen 2.5gbs on rj45 switchports. Fiber has always been 1/10/40/100gbps. The ms355 documentation seen to support this as well. https://documentation.meraki.com/MS/MS_Overview_and_Specifications/MS355_Overview_and_Specifications Additionally there's no 2.5gbps SFP's supported. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/SFP_and_Stacking_Accessories

Brash · ‎Jan 5 2023

Congratulations everyone 🙂

Brash · ‎Jan 5 2023

From the Meraki side it's relatively simple, you just tell it where to send the logs https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration#Configuring_a_Syslog_Server In terms of setting up a syslog server, there's multiple options out there - paid products and open source. The basic premise is the same for all, they simply ingest logs. The main differentiator is the interface, ease of deployment/use, filtering and alerts etc. Some popular ones include graylog, ELK, nagios, splunk, kiwi.

Brash · ‎Jan 4 2023

The Meraki Dashboard maintains logs for up to 3 months. https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Viewing_Old_Event_Logs I highly recommend having an on-prem syslog server that all devices send logs to as it will include more detail than the standard event logs. In regards to contacting technical support, you can open a case via the dashboard or call the support number.

Brash · ‎Jan 4 2023

There's nothing that is required to be done prior to the power loss. The only thing I would suggest is to ensure that the device configuration is "safe" - meaning there's been at least 30 minutes of stable connectivity to the cloud since last configuration change. Behavior during Connection Loss to Cisco Meraki Cloud - Cisco Meraki

Brash · ‎Jan 4 2023

"Unfortunately, I do not have an option for Clients under Network-Wide so I cannot create an allow list" Are you sure the account you're logged in as is an Administrator for the network you're looking at in the dashboard?

Brash · ‎Jan 4 2023

+1 I believe it's supported/implemented but not documented. That being said, there's at least one instance in the community where a crossover cable was required between and MX WAN port and the ISP device - Solved: MX64 Internet port link drops at 100/full (okay on auto / auto) - The Meraki Community. However, it seems likely that it was the ISP device that didn't support auto MDI.

Brash · ‎Jan 4 2023

You can setup any Meraki device in a LAN as long as the device can pull an IP address and reach the Internet. It doesn't need to be directly plugged into the ISP, it can be behind a NAT gateway/firewall. Once it communicates with the Meraki cloud and is registered in the Dashboard you're good to go.

Brash · ‎Jan 3 2023

There's no way you can really confirm whether the devices are flooding maliciously or not without tracking them down. It could be anything from poorly designed IOT devices to bad drivers, or someone attempting a malicious attack. Do you have any AP's on the same network or broadcasting the same SSID that are not part of this Meraki dashboard? Is it always the same AP that's detecting it? If so, could be worth giving it a reboot. A few threads that provide some more information and other people's experience: Packet floods detected by AirMarshal - The Meraki Community Solved: Mr34 packet flood issues - The Meraki Community Air Marshal - Cisco Meraki

Brash · ‎Jan 2 2023

I personally don't use Solarwinds, but from my understanding Solarwinds NPM has the capability to poll the Meraki Portal API to capture information about Meraki AP's. I'm assuming this is what you found on THWACK. It looks like Meraki MX and MS devices are monitorable from Solarwinds via SNMP: SNMP Polling Meraki Devices (NPM +12.0/11.0.1) - How To - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

Brash · ‎Dec 31 2022

In regards to pinging the WAN interface, what do you have configured under ICMP Ping in Security & SD WAN -> Firewall? https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Denying_Inbound_ICMP_on_the_MX When you encounter the issue, what do you see on the local status page of the MX?

Brash · ‎Dec 24 2022

1. The 3 license keys you received should be separate and shouldn't overwrite each other or anything else. Should you claim it and not want it, you can revert the license claim within 7 days. 2. The MX100 is the old product replaced by VMX-M. According to the migration doc, MX100 licensed can be transferred to VMX-M licensed by support. https://documentation.meraki.com/MX/Deployment_Guides/vMX100_to_vMX_S%2F%2FM%2F%2FL_Transition_FAQ#Will_the_legacy_vMX_licenses_be_transferable.2Fconvertible_to_the_new_medium_vMX_licenses.3F 3. Once you go into a non-compliance license state you have a 30 days grace period to resolve the issue and sort out the licensing. After that 30 day period, your Meraki devices will stop communicating with Meraki cloud and will more or less become unusable. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Co-Termination_Licensing_Overview#The_30-Day_Grace_Period

Brash · ‎Dec 15 2022

I was very eager and ready to start sleuthing. 😀

Brash · ‎Dec 15 2022

I FOUND THE GNOMES! A new beta appliance firmware is now available on Thu, 08 Dec 2022 - The Meraki Community

Brash · ‎Dec 15 2022

Yes the MX would relay DHCP to the DC's

Brash · ‎Dec 14 2022

Utilizing the existing equipment, you would create the new VLAN's with L3 gateway's on the MX100 (under addressing & vlans in the dashboard), then trunk the VLANs down to the switches and AP's.

Brash · ‎Dec 12 2022

Love it! Although 11am ET is a bit too early for me. 😞

Brash · ‎Dec 12 2022

At this point I would start taking some packet captures along the path to track where the DHCP discover gets to.

Brash · ‎Dec 12 2022

What is the native vlan set on the trunk port connecting to the AP? Do you have any firewall rules set on the SSID? Do you have DHCP guard set on the SSID?

Brash · ‎Dec 9 2022

Well done everyone! Great and meaningful work! 🙂

About Brash

Brash

Community Record

Badges