Meraki

Brash · ‎Oct 30 2022

Not sure about that. The page definitely used to be all public accessible. Given it was posted in 2020, perhaps it's become too outdated and is now deprecated.

Brash · ‎Oct 30 2022

There is a self study guide located here. https://community.meraki.com/t5/FAQ-and-other-resources/ECMS-Exam-Self-study-Guide/ba-p/95926#1

Brash · ‎Oct 30 2022

"All Network Admins" are all Full and Read-only administrators of a given network. It does not include Organization Admins Alerts and Notifications - Cisco Meraki Edit: Corrected answer with link to doc.

Brash · ‎Oct 30 2022

I am in the process of doing a deployment where there are existing cloud-based applications that utilize source IP Address lists for security. With the current model, all outbound network traffic goes through a single hub location who's IP address is whitelisted within the application. The plan is to alter this so that each site has direct internet access. I'm not aware of any way to force specific internet bound traffic across the S2S tunnel. Has anyone had to implement a workaround for this kind of scenario in the field?

Brash · ‎Oct 30 2022

This is a really neat tool!

Brash · ‎Oct 30 2022

I'm having no issues on shard n280. What shards are your organizations on?

Brash · ‎Oct 29 2022

As you mentioned, you can block those types of categories with content filter. Yes, the content filter should also apply to NAT mode.

Brash · ‎Oct 29 2022

These are easily achievable with a RADIUS server such as the ones you mentioned. There's a decent guide for configuring Meraki with Microsoft NPS. You can then alter the policies for what best works in your environment https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise

Brash · ‎Oct 29 2022

If you're not using Meraki SM (which it sounds like you're not as you're using Intune), and you don't want to use radius, you have a few options to use local auth. You can do identity PSK or local auth viia certificate authentication or password authentication. https://documentation.meraki.com/MR/Encryption_and_Authentication/Wireless_Encryption_and_Authentication_Overview However there is no way for these authentication options to verify compliance.

Brash · ‎Oct 28 2022

You're correct, Android 12 and 13 deprecated L2TP VPN. Meraki acknowledges this at the top of the client VPN configuration document. https://documentation.meraki.com/MX/Client_VPN/Client_VPN_OS_Configuration The best replacement is to use Anyconnect VPN. It's not exactly a drop in solution as it requires extra licensing but it's a far better product and experience.

Brash · ‎Oct 28 2022

The EAB license SKU is related to having an Enterprise Agreement with Cisco. Beyond that I'm not exactly sure of the exact differences but there's plenty of community members who are partners/distributors who might be able to provide further insight.

Brash · ‎Oct 28 2022

It's quite possible there's a change in Ventura that has broken VPN. As @Ryan_Miles mentioned, the beta had lots of issues with VPN breaking. Additionally a heap of active monitoring security agents and EDR software stopped working too. Worth opening a case with Meraki support. If they're seeing it as a widespread issue there'll be more traction on getting it diagnosed and resolved

Brash · ‎Oct 28 2022

You're correct on both counts - You can't define multiple time ranges in a schedule - The only workaround available is disabling/enabling the SSID (either manually via dashboard or programmatically via API).

Brash · ‎Oct 27 2022

The test proves that the Meraki AP's are successfully able to reach the RADIUS server and (I'm fairly sure) that they are authorized to send RADIUS requests. However it doesn't validate that the client can successfully authenticate. What do your authentication policies look like on the RADIUS server? What are you using to identify and authorize clients? (Eg, computer name, username, certificates)

Brash · ‎Oct 26 2022

What is your current MX Product Edition in Organization -> License Info? Do you know if the licensing in your organisation has been upgraded or downgraded via Meraki Support?

Brash · ‎Oct 24 2022

Looks like Okta had a start to finish guide specific to Meraki https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Cisco-Meraki-Dashboard.html

Brash · ‎Oct 21 2022

So excited to read these! The one which I'll always remember was back when I was working in support. A call came in from a customer with a fairly sizeable network freaking out about a full network outage. Jumping into the network we found all traffic being black holed. Following the routing it seemed like everything was being routed to their VMware cluster. Asking the usual questions, the customer confirmed they weren't using VM's for any type of routing. Logging into the VMware cluster, we identified the VM which all traffic was being directed to. Shutting down the VM resolved the issue and the entire network was restored. After discussing further with the customer, we found that the cause was that they had spun up GNS3 on a VM with a replica of their network. It ended up route poisoning the entire network. The customer was relieved and it became a good story for the pub. Tldr: Customer called in for support with a full network outage. The culprit was a GNS3 VM route poisoning the production network.

Brash · ‎Oct 20 2022

Kudos purely for the title 🤣 It's in the link but figured it's also worth calling out that it's for CVE-2022-20933. Makes it easier to look up later.

Brash · ‎Oct 13 2022

You would implement this using firewall rules. There's different places you can apply them, but the most logical for what you're trying to achieve would be "Site-to-site outbound firewall" rules. These are configured under "Security & SD-WAN -> Site-To-Site VPN". Take a look at the below link for some extra info and examples Site-to-site VPN Firewall Rule Behavior - Cisco Meraki

Brash · ‎Oct 12 2022

Do you have a route on the MX for the 192.168.1.0/24 network? (Security and SD-WAN -> Route table) And similarly, do you have routes in the rest of your network to route back to the 192.168.5.0/24 network via the MX? Do you have any group policies set on the client you're testing from?

Brash · ‎Oct 12 2022

Meraki VPN clients have access to all local subnets within the network by default. Are you seeing an increase of hits on the deny all rule when running the test? What is the local IP (non-vpn) of your test machine? You could try a Meraki packet capture to see if the ping packets are making it across the VPN.

Brash · ‎Oct 12 2022

You can't remove licenses from the dashboard when using co-term (except for within the first 7 days). Is there a reason you're needing to remove old licenses? They shouldn't impact the rest of your valid licenses and timeframe.

Brash · ‎Oct 12 2022

You can restrict VPN clients access to local LAN servers by using L3 firewall rules. See example 2 at the bottom of the following doc https://documentation.meraki.com/MX/Client_VPN/Restricting_Client_VPN_access_using_Layer_3_firewall_rules As for your second question, it's only possible using Meraki group policies. You'll need to create two (or more) group policies with the applicable firewall rules. You'll then need to login to the VPN as the user so the client shows up in the dashboard, and then assign the policy to the client. Not particularly elegant but it will work. Sadly, group policies linked to AD groups isn't supported for users logging in via VPN.

Brash · ‎Oct 10 2022

Assuming you're using Anyconnect with a Meraki MX endpoint, no posturing features aren't supported AnyConnect on ASA vs. MX - Cisco Meraki

Brash · ‎Oct 9 2022

Given there's separate categories for Hotmail, Exchange and Outlook online I'd say most likely yes, but you'd need to test it to be sure.

About Brash

Brash

Community Record

Badges