Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About ErnstTFD
ErnstTFD
Getting noticed
Member since Aug 26, 2021
Feb 12 2024
Community Record
56
Posts
10
Kudos
2
Solutions
Badges
Nov 2 2022
5:27 AM
Creating the VPN manually without the scripts and the routing, the routing table in windows look like this. (In this case I cannot ping 192.168.1.3 at all). IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 172.17.2.1 172.17.2.95 55 41.138.70.14 255.255.255.255 172.17.2.1 172.17.2.95 56 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 172.17.2.0 255.255.255.0 On-link 172.17.2.95 311 172.17.2.95 255.255.255.255 On-link 172.17.2.95 311 172.17.2.255 255.255.255.255 On-link 172.17.2.95 311 192.168.5.0 255.255.255.0 192.0.2.1 192.168.5.118 46 192.168.5.118 255.255.255.255 On-link 192.168.5.118 301 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 172.17.2.95 311 224.0.0.0 240.0.0.0 On-link 192.168.5.118 301 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 172.17.2.95 311 255.255.255.255 255.255.255.255 On-link 192.168.5.118 301 =========================================================================== Persistent Routes: Network Address Netmask Gateway Address Metric 0.0.0.0 0.0.0.0 192.168.1.1 Default ===========================================================================
... View more
Nov 2 2022
3:37 AM
So I am currently using this tool: https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html It allows you to enter your desired subnets. This adds routes for those subnets. I've added 192.168.1.0/24 and 10.5.5.0/24 subnets. After doing this, I can now ping 192.168.1.3 for the first time. However if I enter \\192.168.1.3 in my file explorer is still fails to connect to the NAS. Also I cannot ping 10.5.5.1 or 10.5.5.5. I need access to both of these as well. The route looks like this when the VPN is connected: IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.17.2.1 172.17.2.95 55
10.5.5.0 255.255.255.0 On-link 192.168.5.118 46
10.5.5.255 255.255.255.255 On-link 192.168.5.118 301
41.138.70.14 255.255.255.255 172.17.2.1 172.17.2.95 56
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
172.17.2.0 255.255.255.0 On-link 172.17.2.95 311
172.17.2.95 255.255.255.255 On-link 172.17.2.95 311
172.17.2.255 255.255.255.255 On-link 172.17.2.95 311
192.168.1.0 255.255.255.0 On-link 192.168.5.118 46
192.168.1.255 255.255.255.255 On-link 192.168.5.118 301
192.168.5.0 255.255.255.0 192.0.2.1 192.168.5.118 46
192.168.5.118 255.255.255.255 On-link 192.168.5.118 301
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 172.17.2.95 311
224.0.0.0 240.0.0.0 On-link 192.168.5.118 301
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 172.17.2.95 311
255.255.255.255 255.255.255.255 On-link 192.168.5.118 301
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.1.1 Default
===========================================================================
... View more
Oct 28 2022
2:43 AM
Hello, I have posted before, but either my question was asked incorrectly or no one know the answer on these forums. I will try to put it a straight forward as possible here. I can successfully log into my Meraki, using client VPN with the vlan 192.168.5.x. In my case the address 192.168.5.118 was assigned to the laptop I'm using to log into the VPN. On the local network there is a NAS drive on IP 192.168.1.3. When I try to ping this IP from the logged in laptop, the ping fails. Ie. I cannot access the local network connected to the Meraki, from the Client VPN login. A secondary issue. I have given one of the local PC's on the network connected to the Meraki an address in the VPN subnet: 192.168.5.42. I cannot ping this IP either from the logged in laptop (192.168.5.118). I've used to different ISP's with two different Public IP's for the VPN connection. In both instances I can connect, but I cannot ping anything. If I go to Clients page and enter Client type VPN, then nothing shows up. There is no records of any VPN connection. If your just going to point me to the Meraki help files, don't bother, I've read them all and did everything contained therein. I need practical step by step assistance at to what I'm ding incorrectly please. Thank you.
... View more
Oct 17 2022
5:46 AM
Here you can see I am connected to the VPN, but I cannot trace the VLAN. Here you can see my IP that was assigned by the Meraki VPN, so the connection is live. Here is my settings for the Client VPN, what do you suggest that I change?
... View more
Oct 17 2022
5:29 AM
This is not true: "Client VPN users may access all subnets within the network by default." If it is show me how. I cannot do it.
... View more
Oct 17 2022
4:00 AM
Hello, How do I allow a VPN client with IP adress 192.168.5.118 to have access to a NAS drive located at 192.168.1.3 on the local VLAN? Note: Meraki does not allow client VPN to use the same subnet/vlan as a local vlan. Thanks.
... View more
Oct 17 2022
3:57 AM
I use MAC addresses to add clients to a Group Policy. The VPN connection does not have a MAC adress. How will I add a policy to it?
... View more
Oct 12 2022
11:59 PM
I've not changed anything in the routing table, it is still on default settings and look like this: I do have several Group policies setup and the laptop in question is configured for one of these policies. But I must add that the Group policies are assigned by MAC adress and as the VPN is not using the MAC address of the LAN port on the laptop, I'm not sure that the Meraki will identify the laptop correctly. That being said I'm not interested in using the internet throught the meraki. The laptop can use it's own local internet as long as I can access the LAN on my office network.
... View more
Oct 12 2022
11:18 PM
So I am simulating a person working from home. That is a windows laptop on a home wifi using VPN to connect to the office MX64. At the office they must, for example, be able to access the local NAS drive, Server1 or 192.168.1.3. Another user must be able to access a SQL server located at 10.5.5.1. The VPN only assigns a subnet that is not the same as the local vlan's subnet and I cannot find a way to add more than one subnet to the VPN. So I don't know what to do to access the local subnet/vlan once looged in as a VPN user. Maybe I'm missing something obvious, as everyone is telling me by default it is all accessible. However the method of accessing it eludes me.
... View more
Oct 12 2022
2:57 AM
My laptop is on wifi at the moment to test VPN connectivity, here is the wifi and VPN IP's I have (for now) changed the block rule to allow, for testing.
... View more
Oct 12 2022
2:29 AM
"Client VPN users may access all subnets within the network by default." How does this work? My VPN subnet is 192.168.5.0/24, I'm connected as 192.168.5.118. However I cannot connect to anything in my 192.168.1.0/24 subnet. For example if I ping 192.168.1.3, a NAS server, I get no response. If I put 192.168.1.3 in my file explorer, it fails to access the NAS drive. What can I do to fix this?
... View more
Oct 12 2022
2:17 AM
I don't understand. I don't want to restrict access. I want to allow it. How do I allow it? I am now connected as 192.168.5.118. When I ping 192.168.1.3 I don't get a ping. When I try to access 192.168.1.3 with my file explorer is cannot find that IP. How do I reach it? I have added a rule to the Layer 3 firewall like this: This does not help. I still cannot access 192.168.1.3.
... View more
Oct 12 2022
12:05 AM
Hello, I have only recently succeeded in establishing a VPN connection from a client PC to my Meraki. The specified vlan for the VPN is 192.168.5.0/24. My clients have to access servers in my local vlans. These are 10.5.5.0/24 and 192.168.1.0/24. Do I set this up under port forwarding or under the Firewall? Can you please show an example of how to do it properly? Second question is there a way to give some clients access to one local vlan, but not the other and vice versa?
... View more
Oct 11 2022
11:54 PM
The problem with this connection was with my ISP and not any setting on my Meraki. There are only two things to note: 1) The host-name provided by my Meraki unit, pointed to the public IP. In my case the Public IP is not the same as the WAN1 IP of the Meraki.With the result that I had to specify the VPN Server address as the WAN1 IP and the host-name does not work. 2) I had to allow PAP, CHAP and MS-CHAP v2 on my PC before the connection would establish successfully. Now the VPN connection works.
... View more
Sep 26 2022
6:43 AM
OK, I will ask the ISP to create and Public IP for me and move the Meraki to the new address. Fingers crossed this solves the issue.
... View more
Sep 26 2022
6:31 AM
Yes, this seems to be our issue. Do you think it will solve the issue if I ask the ISP to give me a public IP for the Meraki and move it out of the DMZ? They have given me a /30 IP for another device which does work OK.
... View more
Sep 26 2022
6:19 AM
To confirm the ports that should be forwarded are 500 en 4500? Are there any other ports required?
... View more
Sep 26 2022
4:10 AM
My Meraki sits behind a Mikrotik Router that is managed by the ISP. Accoring to the, all incoming traffic to the Public IP is being forwarded to the Meraki. They sent me their Firewall rules to look at. I'm not an expert in Mikrotik friewalls but it seems in order to me. This is what they have sent: 0 chain=srcnat action=masquerade src-address=!41.138.70.12/30 out-interface=Client_Details log=no log-prefix="" 1 chain=dstnat action=dst-nat to-addresses=192.168.0.91 protocol=tcp dst-address=41.76.33.18 dst-port=!8291,2000,8728 log=no log-prefix="" 2 chain=dstnat action=dst-nat to-addresses=192.168.0.91 protocol=udp dst-address=41.76.33.18 dst-port=!8291,2000,8728 log=no log-prefix="" 3 chain=dstnat action=dst-nat to-addresses=192.168.0.91 protocol=gre log=no log-prefix="" 4 chain=srcnat action=masquerade dst-address=192.168.0.91 log=no log-prefix=""
... View more
Sep 26 2022
3:59 AM
Firmware Up to date Current version: MX 16.16 It says up to date.
... View more
Sep 26 2022
1:29 AM
Update! I have worked with my ISP to ensure that all traffic is forwarded to my Meraki. I've also added two rules to my Firewall (L3) to allow all traffic on ports 500 and 4500. When I do a packet capture on the internet interface, I get a lot of traffic on port 4500 and some traffic on port 500. However when I do a packet capture on the "Client VPN" interface, then no data is captured or recorded in the pcap file. It seems that the connection request does not reach the Client VPN interface. Do you have any suggestions where I can look to check the traffic is allowed to reach the Clinet VPN? Also I get a different error no that before: "The connection was terminated by the remote computer before it could be completed" When I look in the Windows event log I get error code: 628.
... View more
Sep 22 2022
11:57 PM
Hello, I'm back at the office. We can setup a test whenever you are ready.
... View more
Sep 22 2022
11:56 PM
Hi, I used this script tool to create a VPN Profile. The result is the same when I try to connect the VPN. Thanks for the advice though, the script tool is handy. Question: If I run the script by clicking on it an select "Run script" it fails. I opened the script in ISE and tried to run it and got an error "Unable to remove existing instance(s) of TFD Meraki profile: Access denied" I then re-opened ISE in administrator mode and then the script executed fine. Is there a way to run the script as an administrator without opening ISE?
... View more
Sep 22 2022
7:49 AM
For a quick test I can allow that. However it is time for me to go home now and I will only be back in the office tomorrow morning. Can we take this up again tomorrow? I will send a reply when I am back in the office tomorrow. (Thank you very much for your assistance so far, it is very much appreciated).
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 8263 | Oct 11 2022 11:54 PM | |
| 17124 | Sep 10 2021 2:26 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 1317 | |
| 2 | 836 | |
| 1 | 866 | |
| 1 | 882 | |
| 1 | 17124 |
© 2024 Cisco Systems, Inc.
