Meraki

MilesMeraki · ‎Mar 4 2022

I agree with Phillip's post. There's really nothing you can do to fully prevent this from happening. Mitigating the risk by using content filtering/DNS blocking would be the best bet which sounds like you are already doing. Another thing that could be used is some form of sign-up/validation via email/SMS via the splash page to attempt to verify users. Again this can be spoofed via burner email/phone number so doesn't fully protect you. The Importance really is in the T&Cs that you get users to accept before logging on. This would somewhat cover you for the liability of someone doing something bad.

MilesMeraki · ‎Mar 3 2022

As far as I'm aware the License can not be RMA'd. Again if the Hardware (Ap) was to fail outside it's warranty period, you would only need to buy a new AP and could re-assign that license to your new AP. I can't find any documentation/certain terms that cover what the Warranty covers you for but usually, if a device is dead and no longer working, after troubleshooting with Meraki support they will determine if the device is under warranty and can be RMA'd. I've had numerous RMA's over my years and never had an issue with any device which is under warranty. I wouldn't read into it too much.

MilesMeraki · ‎Mar 3 2022

As bruce has suggested above, the only way I could see this possible to overcome Geolocation blocking issues is to route all traffic down the AutoVPN to the PAK MX which acts as the Internet gateway for the Dubai user traffic.

MilesMeraki · ‎Mar 2 2022

If i'm correct, your attempting to use the AutoVPN connection to allow users from Dubai (behind the MX) to access websites that are hosted behind the Pak MX device is that correct? If this is correct, then yes this would be possible with the correct routing configured.

MilesMeraki · ‎Mar 2 2022

Have a read of this KB article which states the warranty periods for Meraki devices (https://documentation.meraki.com/General_Administration/Other_Topics/Returns_(RMAs)%2C_Warranties_and_End-of-Life_Information) In regards to your questions r.e the outdoor AP failing after 2 years with it having a 1-year warranty, no it would not be replaced via RMA due to the hardware being out of it's 1 year warranty period. If this situation were to happen I'd assume you would work with your Meraki sales rep who could assist in a new unit and would help with discounts to accommodate. Regarding the question of not replacing the hardware. The license will remain in your org. In this scenario, you could maybe look at buying a newer hardware model. As the MR licenses aren't hardware specific you could assign the license to any model of MR device.

MilesMeraki · ‎Feb 2 2022

Does the configuration status of the MX show up to date? If not it'll be because the configuration hasn't yet been applied. If not try and stop the session and try again once the configuration status shows up to date.

MilesMeraki · ‎Jan 31 2022

The option to use Umbrella DNS servers natively without an Umbrella or Advanced Security Subscription (MR) just gives you the ability to use Umbrella DNS servers as recursive DNS service for your DHCP clients. If you were to buy an Umbrella /Advanced Security Subscription (MR) subscription you could have the ability to create enforcement policies/reporting to block or report on certain domains etc. The benefit over the traditional Meraki MX content filtering is that Umbrella can protect your network clients regardless of the network they are connecting to (Not just behind the MX - There's a roaming client ability to be deployed on user machines.). In addition, it provides much more detailed reporting and also sets up an easy roadmap to migrate to a full SASE architecture.

MilesMeraki · ‎Jan 18 2022

Can you connect your laptop to the ONT and setup the PPOE settings and test the speeds your getting? This way rules out any hardware..

MilesMeraki · ‎Dec 21 2021

Boundless digital have some impressive automation capabilities - https://apps.meraki.io/details/boundless-automation

MilesMeraki · ‎Dec 21 2021

If you have specific instances of cloud providers and their ranges that you would like to get classified I'd recommend logging a "make a wish" feature in the dashboard. In regards to blocking ranges outside of the NBAR classifications have you maybe thought about using the Geolocation (Countries) option of layer7 rules for blocking suspect countries where these cloud providers operate?

MilesMeraki · ‎Dec 9 2021

I'd also add that next time this happens (If it does). Access the local status page of the MX450 (If possible) and download the support data. Pass this info to the Meraki support team. It'll help diagnose any issues and provide logs which might be lost after a reboot of the appliance.

MilesMeraki · ‎Dec 3 2021

Unfortunately, this is the same for all other vendors as everything moves to SASE or "Cloud delivered". There are some fantastic BUNDLE offers on Meraki + Umbrella at the moment and I'd assume these will only get better over time.

MilesMeraki · ‎Dec 2 2021

I'm under the assumption that this might be removed/no longer available. The HTTPS feature on the MX's caused severely degraded throughput once enabled plus an array of other issues. I think the direction now going forward will be to perform the HTTPS/TLS decryption by a SASE security service like Umbrella in-line between the MX and the Internet/SaaS traffic. If you have a look at the updated Sizing guides this also seems to be the "recommended" approach. (https://meraki.cisco.com/product-collateral/mx-sizing-guide/?file). This isn't necessarily a bad thing. SASE security architectures allow for the same security posture and enforcement to be maintained no matter the user's location. This would effectively mean that their HTTPS/TLS traffic would be still decrypted when either on a trusted network or on an un-trusted/un-managed network. Most vendors are now taking this approach to security.

MilesMeraki · ‎Dec 2 2021

I have a funny feeling that the MX Firewall/Advanced security features will be shifted to Umbrella and the MX will be sold as a SASE/SDWAN appliance

MilesMeraki · ‎Dec 2 2021

Don't see how you'd achieve this without a NAC/Radius server? You could look at doing this with IPSK with Radius using Freeradius (open source). https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_with_RADIUS_Authentication

MilesMeraki · ‎Dec 1 2021

Sounds like the Mikrotik is just acting as a layer 2 switch. As you have created multiple different VLAN's (Broadcast domains/Virtual networks) which terminate on to the Meraki MX, if a client from network A tries to communicate with a client in network B it must go through the MX appliance regardless of the shortest physical path. This is called network segmentation. Normally as the MX acts as a firewall you can firewall the traffic to deny or allow it. To overcome this the NAS and client must be on the same VLAN/Network.

MilesMeraki · ‎Nov 29 2021

It completely depends on your requirements. Meraki is a fantastic solution if all the requirements can be met with it. Don't overcomplicate things by adding a separate technology and management/control plane into the Mix. That being said you could have a Meraki and Viptela solution working side by side. The only main reason I'd see you looking at a Viptela solution over Meraki is for some advanced SDWAN steering capabilities and layer 3 segregation (VRF) for compliance reasons.

MilesMeraki · ‎Nov 29 2021

Not at this stage; I've been told in later firmware releases more than 2 active WAN links will be supported for SDWAN purposes.

MilesMeraki · ‎Nov 29 2021

Don't always compare the specs and prices of the Boxes. SDWAN as a whole isn't all about the "box" which will be doing the routing. For example; The Forigate solution requires you to run FortiManager, FotiCloud, and FortiAnalyzer to get the same level of management, control, and visibility of what's offered for free in the Meraki dashboard with the appropriate license. The FortiGate solution would require you to host those management, control planes yourself which will add more $ and complexity to the overall solution not necessarily making it a better solution. Also, is the requirement to have NGFW features on the box, or could you look at offloading this to a cloud-hosted proxy service and generate a complete SASE architecture? Fortigate is severely lagging behind Cisco in this area. Cisco Meraki + Umbrella would be a fantastic compelling solution.

MilesMeraki · ‎Nov 26 2021

So.. What you're trying to say is that you're looking at relocating your public web infrastructure to a public cloud and implementing a vMX in the design to act as the firewall and VPN hub to other MX's for that env? This shouldn't be an issue. Personally, I wouldn't route your DNS records for your web infra at the vMX i'd look at implementing a WAF service in front of your web servers and then pointing the DNS at a Load balancing service.

MilesMeraki · ‎Nov 25 2021

Reading the question I'd guess A and B..

MilesMeraki · ‎Nov 24 2021

This can be achieved by using a local DNS server and setting up a local DNS zone for this use case. You could look at implementing BIND (https://www.isc.org/bind/) on a local linux host to resolve the local DNS queries to local IPs.

MilesMeraki · ‎Nov 21 2021

@PhilipDAth In the link to the survey, it states "Zero trust access network" so I would assume the acronym meaning would be "Zero trust network access/architecture". The joys of our industry and analyst/marketing teams...

MilesMeraki · ‎Nov 18 2021

I assume this is with OSPF enabled to dynamically distribute Auto-VPN routes to another router? Reading over this KB article (https://documentation.meraki.com/MX/Site-to-site_VPN/Using_OSPF_to_Advertise_Remote_VPN_Subnets) andto my knowledge, they are not summarised. You'll want the upstream router to summarize the routes if needed.

MilesMeraki · ‎Nov 15 2021

The following setup document outlines the steps for a vMX creation in Azure. In reality, when you create the network you could clone the network where your existing DC MX is sitting. I'd probably start with a greenfields design for the Azure side as I'd assume there would be some form of co-existence with the existing DC network and you'd therefore want to ensure there isn't overlapping addressing etc. https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Microsoft_Azure

About MilesMeraki

MilesMeraki

Eliot Foye

Community Record

Badges