Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Erik_R
Community Record
10
Posts
2
Kudos
0
Solutions
Badges
Aug 24 2023
8:59 AM
This is exactly what I am looking for. If I am understanding this correctly, the Group Policy (the group created) on the Meraki side does not correlate to a group in AD, correct? This just applies to a specific Network Policy on the RADIUS server. I would have to create another Network Policy on the RADIUS server in order to assign different network access "rights" via another Group Policy on the MX. In other words, lets say a user group and an admin group where the admin group should have full network access.
... View more
Aug 24 2023
8:02 AM
Hello. Is there any way to limit a user's access to specific VLANs when they connect using the AnyConnect VPN client? In other words, I'd prefer they only have access to a few specific VLANs. Thanks!
... View more
Jul 6 2022
8:29 AM
So, native VLAN of 1 and then set the VLAN on the IP address tab of the AP to the correct management VLAN of 511? VLAN 1 does not really exist, meaning there is no subnet defined, so where would it grab an IP address from?
... View more
Jul 6 2022
6:55 AM
Hello. I will be using VLAN tagging on a couple of SSIDs. I created a VLAN of 511 (Management) on my switch stack as well as the respective static route on the MX. The VLANs for the SSIDs will be 501 and 502. Regarding the port that the MR access point will connect to on the switch, it will be configured as a trunk port. Scenario 1 - set the native VLAN on this switch port to 511 (Management VLAN) and allow 501, 502, 511? OR Scenario 2 - set the native VLAN to 1, allow (1, 501, 502, 511) and then set the VLAN ID on the MR access point's IP configuration tab to 511?
... View more
Labels:
- Labels:
-
Layer 3
So in their example, you would use their uplink VLAN of 20 for the switch management IP address information as well with a gateway of 192.168.128.254? Would the management VLAN in switch settings then be set changed to 20? Lastly, on the MX and MS ports that connect together: Trunk, native VLAN 1, allowed VLANs 1, 20 or Trunk, native VLAN 20, allowed VLANs 1, 20 or Trunk, native VLAN 20, allowed VLANs all or Other
... View more
Oct 7 2021
9:22 AM
Hello. Per one of Meraki's best practices guides (linked below) regarding defining "uplink" VLANs, I have a few questions. https://documentation.meraki.com/MS/Layer_3_Switching/Layer_3_Switch_Example On the MX, a VLAN of 20 named "Uplink" is defined using 192.168.128.0/24 using an MX IP address of 192.168.128.254. On the MS, a VLAN of 20 named "Uplink" is defined using 192.168.128.0/24 with an interface IP address of 192.168.128.1. Does the size of the subnet matter for this uplink VLAN? The example uses /24, but should it be much smaller or is the size completely irrelevant. For example, use 192.168.128.0/30 and then use 192.168.128.2 for the MX IP address instead of 192.168.128.254. You could keep the interface IP address of 192.168.128.1 on the MS. On this uplink VLAN defined on the MX, does DHCP need to be enabled for any reason? I don't see why it would, but I'm unsure. On the MX, how would you define the uplink port to the MS? Trunk port, native VLAN 1 and allowed VLANs 20? The answer to this would dictate how the matching uplink port on the MS would be defined.
... View more
Labels:
- Labels:
-
Layer 3
Sep 13 2021
5:51 PM
2 Kudos
So, I can tag a switchport with a VLAN number that is not defined as an L3 routing interface? In other words, if I created a VLAN of 3010 on paper only, I can still tag a port on the switch with a VLAN number of 3010 without it actually existing (defined) anywhere?
... View more
Sep 13 2021
3:30 PM
I have a stack of two MS425 switches that I may use for top of rack purposes. I wanted to create two separate VLANs for iSCSI traffic. They will not be routed out of this stack, but I would still need to define VLANs for them.
... View more
Sep 13 2021
2:20 PM
Let's say a virtual stack is currently setup with L3 routing enabled and several defined VLANs. One of those VLANs is 104. Now, you connect a new flexible stack to the existing virtual stack. You are a glutten for punishment and need to enable L3 routing on the new flexible stack. Do you have to create the same VLAN (say 2500 for this example) on each stack (with different interface IPs) as a transit link between the two stacks? Existing virtual stack: VLAN 2500, 192.168.10.0/24, interface 192.168.10.1 New flexible stack: VLAN 2500, 192.168.10.0/24, interface 192.168.10.2, (what would the default gateway be for the first time L3 routing setup? VLAN 104 was already setup on the existing virtual stack. Do you need to "recreate" it on the new stack if you will be using it on the new flexible stack or no?
... View more
Labels:
- Labels:
-
Interfaces
-
Layer 3
Hello, I have several MS320 switches all connected to an MS420 core switch. The firewall is a WatchGuard with an IP address of 10.10.4.1. L3 routing is enabled on the MS420 switch with several VLANs defined. The gateway that was entered when enabling L3 routing on this switch was that of the WatchGuard firewall (10.10.4.1). There is no "UPLINK" VLAN defined. I only bring this up because Meraki states that defining an UPLINK VLAN is a best practice. This started as a flat network over five years ago with the WatchGuard firewall already in place. The WatchGuard firewall IP address was originally 10.10.5.1. There were a lot of statically defined IPs in use for servers, copiers, etc. The choice was made to define a VLAN of 10.10.4.0/23 with an interface IP address of 10.10.5.1. This allowed me to keep the default gateway of 10.10.5.1 which was defined on all of my statically defined devices. The WatchGuard firewall IP address was then changed from 10.10.5.1 to 10.10.4.1. I just added two "top of rack" switches which are MS425 models in a flexible stack. They will be used to connect my three HP rack servers acting as ESXi hosts to my Nimble SAN. Now, I want to define two iSCSI VLANs on this top of rack switch stack. They should not route outside of this stack since it's only internal iSCSI traffic. I can accomplish this by not allowing these VLANs through the trunk port connecting this stack to the existing MS420 stack. When I enable L3 routing on this (new) stack, I am asked to define a default gateway during the first VLAN creation. Would this be the IP address of the WatchGuard firewall? Also, is there any benefit to defining the VLANs for this top of rack switch deployment on this stack as opposed to just defining them on my original MS420 core switch that already handles L3 routing? In my head it sounds better to define these VLANs on the top of rack switch. I have been overthinking this so much that I am confusing myself. Thank you.
... View more
Labels:
- Labels:
-
Interfaces
-
Layer 3
© 2025 Cisco Systems, Inc.
