Meraki

MRCUR · ‎Dec 8 2017

I'm pretty sure the MX can only NAT from the outside (WAN) interface to an inside (LAN) interface, so I wouldn't expect the setup you're trying to do to work with an MX. It's not totally clear to me why you have this setup, so perhaps there's a workaround that's not clear to me.

MRCUR · ‎Dec 8 2017

You can create a 1:Many NAT rule on the Firewall page (very bottom). This should accomplish what you're looking for.

MRCUR · ‎Dec 8 2017

@IngramLeedy Azure or AWS charges are not included in the vMX license. There is no hardware cost to the vMX from Meraki since you need to pay Microsoft or Amazon to run the appliance. You're just paying Meraki for the software license.

MRCUR · ‎Dec 7 2017

@PhilipDAth There's no link to it from inside Dashboard that I've found. You have to bookmark the specific page.

MRCUR · ‎Dec 7 2017

This is useful but it really needs to auto fill based on the org's licensing status. It takes way too long to fill everything in for large orgs that are always buying new licenses/products.

MRCUR · ‎Dec 7 2017

@CharlesIsWorkin You can use PowerShell to get or set the VPN domain suffix. See here: https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnection?view=win10-ps Regarding @PhilipDAth's question - you're using a DC as a DNS server for client VPN, but does the MX have a route to the DC (can the MX ping the DC)?

MRCUR · ‎Dec 6 2017

Are you tunneling all traffic or doing split-tunnel? Do you have the correct domain suffix(s) applied to the VPN connection so you can use unqualified names?

MRCUR · ‎Dec 5 2017

@PhilipDAth I have a non-Meraki (ASA) peer going to the VIP without a problem. Works just fine in a failover scenario too.

MRCUR · ‎Dec 5 2017

@BHC_RESORTS Agreed. I've been asking about it for a while now. Perhaps they're having a hard time making it Meraki simple to run dual-stack.

MRCUR · ‎Dec 5 2017

@PhilipDAth Had to do this today after the introduction thread seemed to blow up! I guess the community has been discovered by the masses now.

MRCUR · ‎Dec 5 2017

@AbhilashRN Thanks for the excellent directions. These worked perfectly for me and now I have a vMX in its own RG that isn't locked. Forgive my unfamiliarity with Azure - but did you create a subnet dedicated to the vMX WAN port and then have another subnet used for the inside (what's supposed to be tunneled out the vMX)? Also, anyone figure out a way to set a static IP on the vMX WAN (not sure this really matters)?

MRCUR · ‎Dec 3 2017

@B_TylerYou can use a 1Gb SFP in either WAN port.

MRCUR · ‎Nov 29 2017

@Jsnyder81 Just to add the opposite of @MerakiDave's high traffic camera, here is the usage chart from an MV21 that's in a server room where there is typically no motion all day. You'll see the network usage is almost identical, so I think it's safe to plan for ~2Kbps of throughput and ~15-20MB of traffic each day per-camera. MV21 Usage

MRCUR · ‎Nov 25 2017

See the passthrough mode documentation here: https://documentation.meraki.com/MX-Z/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z1_Teleworker_Gateway

MRCUR · ‎Nov 20 2017

Agreed with @Adam suggestion. It sounds like the MX is running in NAT mode and doing exactly what it should be doing.

MRCUR · ‎Nov 20 2017

The trick is to not let the cert expire, make sure you renew it and don't upload the wrong cert! If any step is missed or done incorrectly, manual re-enrollment needs to happen.

MRCUR · ‎Nov 15 2017

Wired MS support for Sentry 802.1X is coming in MS firmware 10.X which is currently available as a beta. It does not currently support Windows however (so I guess it's only Mac currently). This would require MS switches though. I don't believe it's possible to achieve what you're looking to do without using MS switches and the new Sentry support.

MRCUR · ‎Nov 5 2017

@meraki_dev I would kill for a gnome! They're super hard to come by.

MRCUR · ‎Nov 5 2017

@MerakiDave Are you Dave S. who works with Matt S.?

MRCUR · ‎Nov 4 2017

@Mr_IT_Guy I'm not involved enough with it to speak to it unfortunately. We're very likely using it differently from use so I suspect that's where the different requirements are coming into play.

MRCUR · ‎Nov 4 2017

@Mr_IT_Guy We actually FTP files to them.

MRCUR · ‎Nov 1 2017

Do you have a custom password set at Network Wide - General - Device configuration?

MRCUR · ‎Nov 1 2017

@KarbonX1 Definitely submit a case about that. It shouldn't actually try to run the lower firmware than is required, even if you configure it on the network. It should just say it's up to date on the version you configure but continue running its minimum version silently.

MRCUR · ‎Oct 31 2017

@Asavoy Follow the recommendation from @PhilipDAth. That way you can ensure all of the necessary rules are in place.

MRCUR · ‎Oct 31 2017

Man you guys must be really excited for this launch. I was going to say it's only early afternoon at Meraki's HQ. They must've finished up lunch and clicked the right buttons to make it live.

About MRCUR

MRCUR

Community Record

Badges