Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About svk253
Community Record
23
Posts
1
Kudos
0
Solutions
Badges
Ok, so I did two things, not sure which helped but my problem is now resolved. 1) I added VLANs to the RADIUS server as attributes 2) I re-did the tagging for the VLAN I added to the Company_Secure SSID. So I made a tag called "VLAN16", added it to the AP, and added it to the VLANs on the SSID The client also had to delete the wireless profile and re-add it before it worked.
... View more
@NolanHerring - Do you have a separate network for that branch office or is that AP sitting in the main office meraki network on the dashboard? The branch office is on a separate network and is separated from the main office with a router. The router has a sub-interface with the new VLAN on it. The AP is at the branch office. How do you have the port configured where the AP connects to? The port is currently set as a trunk port. How do you have the access control settings configured for the SSID (assuming local LAN access is allowed). - It's set for direct access and the firewall allows local LAN Assuming also you have the AP's tagged correctly? I believe so. I don't know though. The AP is tagged and the tag was added to the Company_Secure SSID and the SSID shows up. Then I added another tag for the VLAN ID as shown above in the screenshot.
... View more
I hope I can explain this correctly, it's a strange issue and I'm wondering if I'm just missing something. I deployed a new Meraki AP at a branch location, on a new VLAN (let's say vlan 16). The intention was to extend our secure wireless out to that branch. So the same SSID used at the main office is on the branch office AP. However the main office is on VLAN 10. I added VLAN 16 to the branch office. If I place a port in the new vlan and connect a laptop to it, the laptop connects to our LAN just fine. It gets a DHCP address as expected and can reach the gateway. Routing is good. If I plug the Meraki into the same port in the same new vlan, it also gets a DHCP address and can be managed in the dashboard. It shows green. Works the same if I switch the access port to a trunk port which I've done. If I connect a client to the SSID, it fails to grab a DHCP address and cannot reach the default gateway. It can however ping the Meraki. Otherwise no network access. The SSID is configured with RADIUS for authentication. RADIUS seems to work because the client device can sign in and connect. They just get no network. The last step I did was add the new VLAN to a RADIUS attribute but I ran out of time to test it. The SSID, let's call it Company_Secure, has the following VLAN settings. I am not sure if I should tweak these, or if I'm going off into the woods on something that's not the issue. Has anyone run into a similar issue? Thank you for your time.
... View more
Apr 26 2018
11:01 AM
Thanks for your suggestions NetworkingGuy, I would like to implement something a little cleaner someday, but this is sort of the minimum viable product at the moment... Our public wifi is sort of an add-on to internal staff wifi that we've had for a while. Branches already have contracts for their own ISP separate from the WAN link back to the main office, but they have no staff network. The main office is different because we have the staff network too. On another note.... here is where I ended up: I grabbed a client and set it back to clean factory defaults, just plain old Windows 10 and downloaded nmap. Did a ping scan and STILL, it could somehow pull up the names of our workstations. So, I went ahead and changed the DNS again to 208.67.222.222 and tried a ping scan. Sure enough this time the names did not show. So, I don't know if nmap saw our internal DNS server somehow? I am really at a loss. But if this is the case I'm going to do some more testing to see if we can still use Meraki NAT / DHCP. Thank you everyone for your time and insight!
... View more
Apr 25 2018
9:56 AM
Ok, so it says default server unknown. I feel like maybe nmap is giving me misleading information. I am trying an experiment...maybe this is off topic, but if I set the SSID to Layer 3 roaming, and put it on our 'guest' VLAN that has ACLs protecting it from the LAN, then...would that work? I don't know how all of the other branches will handle Layer 3 roaming, because they each have their own Comcast or whatever router and DHCP is set up on that. They don't really come back to our network or VLANs. But the SSID is on all of these APs.
... View more
Apr 25 2018
8:02 AM
Could it have anything to do with the fact that the client I'm using is joined to the domain? I'm not logged in as a domain user though, I'm using local admin. Just tried on a different client, a brand new laptop that was just set up. Unfortunately, also on our domain. Nmap resolved the names somehow.
... View more
Apr 25 2018
7:51 AM
Ok, interesting! If I switch the DNS to custom and use the ones you used as a test, I cannot resolve the PC name. The ping replies as unreachable from 10.128.128.128. However, nmap still can resolve the name... I don't understand why that is. Tried clearing DNS cache, restarting... Weird!! Next step is to find a client that hasn't been on our network and run nmap...
... View more
Apr 25 2018
6:59 AM
Hmm, I added a switch to my scan and now it says 'host is up, received arp response'.
... View more
Apr 25 2018
6:48 AM
I do see the MAC address of the Meraki AP. But I also see a list of host names plus their IP addresses, and it claims that the hosts are up. Is this the AP responding? Why would I see the computer name and IP of all the different workstations? I can see the domain name and PC name thru ping, and if I run a quick scan sometimes I can see the operating system it's running...like it's the actual domain name and IP. If I try to ping any of those with CMD it comes back with unreachable from 10.128.128.128 but I would think it should time out, instead? I cleared ARP and DNS cache on the client. No change.
... View more
Apr 25 2018
5:59 AM
Our local network is 10.0.0.0 /24. I just added that explicitly, and tried really hard to make sure my client was not still using the same stream... deleted the wireless network, turned off wifi, rebooted. Still, it can see our workstation IPs. I have yet to try a different client, so I'll do that and compare.
... View more
Apr 24 2018
2:13 PM
I am using nmap to do a scan and it reports that the workstation is up and it can resolve its name (guessing the quick scan uses ping). I'm scanning the entire subnet. When I ping anything on the LAN using CMD it gives replies but it says net unreachable.
... View more
The policy says 'Normal' when I check it. Maybe I'll try a different machine or my phone tomorrow. The particular client I'm using was previously on the LAN at one point, but not recently. I did reboot the client and it's been some time, but ping is still working. Can I kick the client off through the AP to clear those streams? I'm looking but haven't found it yet. Thanks for taking a look at it so thoroughly though! We would much rather do this than bring in a separate ISP. But only if it is secure.
... View more
Apr 24 2018
1:18 PM
It's set up pretty simple, the only thing I specifically enabled for the SSID besides the firewall rules is the splash page (no login, users can click through). The Deny All rule has been there for a few days, I just added the ICMP rule. No group policies. I don't *think* the client is whitelisted, but how would I check that? SSID drop down is on the correct SSID, let's say Company_Public. Client is connected to Company_Public.
... View more
Apr 24 2018
12:51 PM
It doesn't appear to be blocking yet... does this look right? I did just set it. (see screenshot). The client I am using is completely disconnected from the LAN, no cables. It's just on the guest SSID. What other things do I need to add to make this SSID bulletproof? They should *only* be able to get to the internet. I sort of thought that was the case already, but now I am paranoid, lol.
... View more
Apr 24 2018
12:39 PM
I get it, but I can discover IP's, MAC addresses and DNS names of every workstation on my local LAN. Someone coming in off the street shouldn't be able to do that. We need to have the guest network as isolated as possible. I asked in another post about how to do that without having to bring in a physically separate ISP, or VLAN it off, and Meraki NAT should be the answer, no?
... View more
Apr 24 2018
12:27 PM
But the Deny Any / Any to the local LAN would not block ping? I don't really want our servers and workstations discoverable by the general public. I can try to add a separate rule to block ICMP and see how it goes. I find it weird that Meraki APs allow that to begin with between the isolated guest network and the LAN.
... View more
Apr 24 2018
12:09 PM
Hi Dylan, I thought that too, but it will only let me select that option if I am in bridge mode for the SSID. I am using Meraki NAT so they are isolated from our LAN. Thanks! Sandra
... View more
Apr 24 2018
11:47 AM
Hello, I started to play around with nmap on the guest network I just set up to test the security. It appears that my client, while connected to the new guest network, can discover all of the workstations on our LAN. I don't think it can do much else. But should it be able to do that? We have another guest network for vendors that is on another VLAN and is restricted via ACLs on the switches, and it cannot see the other workstations. I have the firewall rule set up as Deny Any to the local LAN (see screenshot). Thank you.
... View more
Apr 23 2018
8:34 AM
So, would the correct thing to do be delete the device that is not licensed and no longer used? If Meraki licenses by org, how do you renew a license for an entire org and still have unlicensed devices? I'm a little confused.
... View more
Apr 17 2018
1:28 PM
There was an audit comment last year that pointed out that we did not physically separate our wireless networks, and suggested we do so. We have accepted the 'risk' as an organization to use VLANs (I know...), but it is usually something that is brought up often.
... View more
Apr 17 2018
1:13 PM
Hi Chris, That is the route I am thinking of going, but I think concerns will be raised on whether or not that's 'separate' enough from our local network...
... View more
Apr 17 2018
1:13 PM
Hi NSGuru, We do not use an MX firewall, the routing is done through layer 3 switches and we have a firewall on the perimeter. I did add a deny rule to the LAN on the Meraki side, but these users are still technically on our local network?
... View more
Apr 17 2018
8:00 AM
We have a single SSID for Public wifi access, and this has been deployed to Meraki access points at our branch locations. Each branch has its own separate DSL or cable modem for these to plug into, physically separate from our LAN. They're configured with Meraki NAT mode / dhcp. We want to deploy public wifi at the main branch office now, but the issue is that we already have Meraki APs deployed for staff (secure) and guests that are not the general public, like vendors and whatnot. These APs are trunked and the networks are on different VLANs with security in place. We want to add the Public SSID to our existing Merakis here at the main office. But we aren't sure whether or not we can bring in a separate ISP and VLAN it off, and still have the setup functional at the branches? Would we need a new SSID for that to happen? Is just having Meraki NAT mode secure enough for this purpose? It is still on our native VLAN though... only separated by the Meraki AP. What are your thoughts? I hope this makes sense, please let me know if I can clarify anything.
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 24550 |
© 2024 Cisco Systems, Inc.
