About Brash

cmr

That's very interesting, we have the Enterprise license as our SD-WAN is on top of MPLS circuits and Rapid7 works just fine... You can install a scanner at each site and still centrally control them. Might that be an option?

Announcer

Update: Turns out the dns entry for www was pointing to old server. Changed it to new server and access to web is ok. Always dns....

Brash

You can't force a client to connect to a specific AP. It will always choose the best available based on signal strength etc. The only way you can achieve the same outcome would be to place your music streamer on a different SSID and have that broadcast only from the AP's you want it to connect to. That said, it more of a workaround than fixing the underlying issue. You might need to look into interference or tuning radio settings if it's connecting to a sub-optimal AP.

Brash

As ping drops towards 8.8.8.8 can be anywhere on the internet, or even rate limiting of Google's server itself, I find it's more useful to have the ISP's next hop as an IP address to monitor. You'll get more value out of the loss and latency graphs and it becomes clearer when your ISP is encountering an issue

PhilipDAth

I remember now. Go into managed apps. You can delete it from there.

Brash

That's correct, MS resource utilisation is not present in the dashboard. However Meraki Support does have access to this information on their backend if you're encountering/troubleshooting an issue.

Brash

You're correct, there's no way to manually terminate existing VPN sessions other than locating the client and assigning it to blocked. It's a fair feature request and I suggest lodging it as feedback through the dashboard.

joshuathure

MX 68 Advanced Security

PhilipDAth

If you are using RADIUS based authentication, you can also dynamically assign the group policy per client using the Filter-Id attribute. https://documentation.meraki.com/MR/Group_Policies_and_Block_Lists/Using_RADIUS_Attributes_to_Apply_Group_Policies This lets you do more advanced things like having a single SSID but dropping different users into different VLANs, applying different firewall rules, bandwidth limits, etc.

johnny_5

After some more troubleshooting and verifying setup requirements... CC-Device successfully connects to SSID: CC-Device - obtains IP address from controller (VLAN 200). The SSID is setup in Bridge mode. When connecting to the same SSID (CC-Device)using my phone as a test one is able to cast successfully to the TV that the CC is plugged into. Connecting the same phone to the SSID :Guest Wifi (VLAN 900) however this does not work. Guest wifi is setup in L3 roaming mode. I cannot L3 ping from my phone on the Guest wifi to the controller on the CC-Device. Reviewing the FW rules I have 4 DENY statements on the Guest Wifi but nothing that would stop access to the CC-Device wifi.

Brash

Meraki doesn't publish this information about their switches. The MS390 series is essentially a rebrand of Cisco Cat9300's so you could in theory check that data sheet. However it's always possible that Meraki's implementation carves up the buffer space differently, or even doesn't utilise it all so I wouldn't rely on those numbers.

JGill

The release notes don't mention that being fixed. Just new device support. I just posted a similar issue. All MR46 / MR55. MR42's don't seem to be impacted. They do pass traffic, but a true PITA if you have a lot of devices to manage. And its not just comm losses that cause it, but is very much a catalyst if you have a comm issue. Ticket is in Engineering as a NextTunnel issue. We see them drop across the country at the same time, so unless Meraki Cloud is having hiccups, not just a local communication outage causing the issue.

Brash

Cisco 7940 and 7960 phones don't support the PoE standard. They use a Cisco proprietary inline power technology will only work that way with Cisco Catalyst switches. https://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-ip-phone-7900-series/97869-poe-requirement-faq.html#qa3

Brash

Once the device has connected to Meraki cloud, the credentials will change from default to whatever is set under ' Network Wide > Configure > General > Device Configuration'

JinsengIT

Thanks for the thought. Unfortunately deleting everything in that location doesn't work. I even uninstalled Anyconnect, deleted the entire %ProgramData%\Cisco folder, and then reinstalled, and it still remembers the previous login. I don't want to have to revoke all sign-ins from M365 as that'll effect everything else the user is logged into.

Brash

There's no way to make this change to all VLANs with one click. You can edit multiple VLANs on the same page, but if you have a large amount this can still be slow. As you're making the exact same change on multiple VLANs in multiple networks, I suggest utilising the API. It would be far more efficient to iterate through them and update the configuration. https://developer.cisco.com/meraki/api-latest/#!update-network-appliance-vlan

MichaelSchramm

That makes sense! Thank you! I was asking, because I want to connect some hosts with a MLAG, which works only on stacked switches. So MLAG should work in this scenario when I connect the two MS425 with the two 40G-Ports

Brash

" Customers are only required to accept terms and conditions of use on the Meraki dashboard after purchasing an AnyConnect license in order to apply it on the MX. There is no linkage of AnyConnect licenses or Smart Accounts to the Meraki Dashboard or MX Appliance." AnyConnect Licensing on the MX Appliance - Cisco Meraki There is no need to link it to the Meraki appliance or dashboard. You simply need to have the licenses purchased and in your smart account in order to abide by the licensing agreement.

BlakeRichardson

Brandon had some really good suggestions, when the fault occurs can you ping 8.8.8.8 from the affected machine to confirm that its just DNS and not full network access?

AhmedJawad

Thank you ! I will do some testing

MerryAki

@MeredithW @Mods there seems to be some fraud/injection stuff going on in this topic. Could you please check that?

KarstenI

Any Cisco reseller will be happy to sell these licenses to you. I would first ask the reseller that sold the MX to you. Or if you tell us where you are located, here on the community are a couple of resellers that can help you.

Brash

The MX will attempt to dhcp an ip on the WAN port. It will then connect to the Meraki cloud back-end to pull config and firmware updates. https://documentation.meraki.com/MX/MX_Quick_Start

jbright

I have a router running OpenWRT between the Dish and the WAN interface on my MX. The router has a static route in it pointing back to the dish. This allows anything on the LAN side of the MX to reach the IP address of dish (192.168.100.1). Here's what the static route looks like. Since Starlink started enforcing only one IP address per dish, the router also acts a NAT device, allowing multiple devices, including the MX, to all access the Starlink network simultaneously.

JED2021

My NIC Teaming works if I physically unplug the cable from VMNIC0 or VMNIC1. Previously I was disabling the MS410 switch port. I am not sure why the Meraki disable switch port does not act as if link is lost.

Brash

Community Record

Badges