Meraki

MRCUR · ‎Dec 11 2017

Yes, you can do this with device based app licensing. This will allow you to silently install the app. You should "purchase" licenses for the SM app in the VPP store and then deploy it to devices making sure to select the device assigned licenses.

MRCUR · ‎Dec 11 2017

NAT rules are bidirectional - otherwise there wouldn't be a valid return path. I haven't tried this specific setup with 1:Many NAT, but I don't see why it wouldn't work.

MRCUR · ‎Dec 11 2017

The MX250 and MX450 are the latest MX models. The MX400 (and MX600) are the previous generation models. Don't worry about the numbering - it'll all be aligned again in the future. Between the 250 and the 450, the 250 is the "lower end" model.

MRCUR · ‎Dec 11 2017

No, you need to supply a public IP that the MX has configured on its WAN interface subnet. Then in the LAN IP, you can put your internal network that you want to use the configured public IP for SMTP traffic.

MRCUR · ‎Dec 11 2017

@Paulofg wrote: To get a whole subnet to use a different outbound IP you will only be able to do that if the IP belongs to the WAN interface and as someone mentioned above you could achieve that with another L3 device connected to WAN2. You don't have to connect it to WAN2 in the setup I suggested to be clear.

MRCUR · ‎Dec 10 2017

@BHC_RESORTS wrote: @LindseyM wrote: Personally I don't think retention is a big issue. The camera's can average 90-120 days, how often do you need to go back farther than that? Even with standard quality, I'm a little dubious about that amount of footage in real world scenarios. Perhaps with standard quality and motion retention enabled, but I also agree. I'm only seeing that kind of retention on cameras in server rooms with little to no movement.

MRCUR · ‎Dec 10 2017

Do you have a /30 from the ISP AND another block of IP's that the ISP is routing to the /30 (Comcast does this for example)? In that case, what I've done in the past is terminate the /30 on a L3 switch that sits in front of the MX. Then on the switch, create a VLAN with the public IP block and connect the MX WAN port to this VLAN.

MRCUR · ‎Dec 8 2017

I'm pretty sure the MX can only NAT from the outside (WAN) interface to an inside (LAN) interface, so I wouldn't expect the setup you're trying to do to work with an MX. It's not totally clear to me why you have this setup, so perhaps there's a workaround that's not clear to me.

MRCUR · ‎Dec 8 2017

You can create a 1:Many NAT rule on the Firewall page (very bottom). This should accomplish what you're looking for.

MRCUR · ‎Dec 8 2017

@IngramLeedy Azure or AWS charges are not included in the vMX license. There is no hardware cost to the vMX from Meraki since you need to pay Microsoft or Amazon to run the appliance. You're just paying Meraki for the software license.

MRCUR · ‎Dec 7 2017

@PhilipDAth There's no link to it from inside Dashboard that I've found. You have to bookmark the specific page.

MRCUR · ‎Dec 7 2017

This is useful but it really needs to auto fill based on the org's licensing status. It takes way too long to fill everything in for large orgs that are always buying new licenses/products.

MRCUR · ‎Dec 7 2017

@CharlesIsWorkin You can use PowerShell to get or set the VPN domain suffix. See here: https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnection?view=win10-ps Regarding @PhilipDAth's question - you're using a DC as a DNS server for client VPN, but does the MX have a route to the DC (can the MX ping the DC)?

MRCUR · ‎Dec 6 2017

Are you tunneling all traffic or doing split-tunnel? Do you have the correct domain suffix(s) applied to the VPN connection so you can use unqualified names?

MRCUR · ‎Dec 5 2017

@PhilipDAth I have a non-Meraki (ASA) peer going to the VIP without a problem. Works just fine in a failover scenario too.

MRCUR · ‎Dec 5 2017

@BHC_RESORTS Agreed. I've been asking about it for a while now. Perhaps they're having a hard time making it Meraki simple to run dual-stack.

MRCUR · ‎Dec 5 2017

@PhilipDAth Had to do this today after the introduction thread seemed to blow up! I guess the community has been discovered by the masses now.

MRCUR · ‎Dec 5 2017

@AbhilashRN Thanks for the excellent directions. These worked perfectly for me and now I have a vMX in its own RG that isn't locked. Forgive my unfamiliarity with Azure - but did you create a subnet dedicated to the vMX WAN port and then have another subnet used for the inside (what's supposed to be tunneled out the vMX)? Also, anyone figure out a way to set a static IP on the vMX WAN (not sure this really matters)?

MRCUR · ‎Dec 3 2017

@B_TylerYou can use a 1Gb SFP in either WAN port.

MRCUR · ‎Nov 29 2017

@Jsnyder81 Just to add the opposite of @MerakiDave's high traffic camera, here is the usage chart from an MV21 that's in a server room where there is typically no motion all day. You'll see the network usage is almost identical, so I think it's safe to plan for ~2Kbps of throughput and ~15-20MB of traffic each day per-camera. MV21 Usage

MRCUR · ‎Nov 25 2017

See the passthrough mode documentation here: https://documentation.meraki.com/MX-Z/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z1_Teleworker_Gateway

MRCUR · ‎Nov 20 2017

Agreed with @Adam suggestion. It sounds like the MX is running in NAT mode and doing exactly what it should be doing.

MRCUR · ‎Nov 20 2017

The trick is to not let the cert expire, make sure you renew it and don't upload the wrong cert! If any step is missed or done incorrectly, manual re-enrollment needs to happen.

MRCUR · ‎Nov 15 2017

Wired MS support for Sentry 802.1X is coming in MS firmware 10.X which is currently available as a beta. It does not currently support Windows however (so I guess it's only Mac currently). This would require MS switches though. I don't believe it's possible to achieve what you're looking to do without using MS switches and the new Sentry support.

MRCUR · ‎Nov 5 2017

@meraki_dev I would kill for a gnome! They're super hard to come by.

About MRCUR

MRCUR

Community Record

Badges