Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About JordanCN
JordanCN
Here to help
Member since Mar 4, 2022
Mar 9 2024
Community Record
31
Posts
3
Kudos
0
Solutions
Badges
Jan 30 2024
2:36 PM
I saw that updating my profile xml enabled the users to control the Captive Portal Detection, but as you noted, even though I set it to True and True, the setting did not check the box. Each user had to go into the Anyconnect settngs and check the box. I discovered that when they set the option to Disable CPD, the setting got applied to the preferences_global.xml file under the <ControllablePreferences> section. This entry was written: <DisableCaptivePortalDetection>true</DisableCaptivePortalDetection> Preliminary testing looks good. I had a person with this issue happening repeatedly and it appears to have stopped.
... View more
Dec 14 2023
2:31 PM
Thanks for the info. Is there another load blancer that is compatible with Meraki? I am trying to setup 2 web servers that are running the same application. I wanted to use the build in NLB so it wouldn't look sloppy by having 2 links to the web application incase one of the servers was under maintenance or the physical host for that server was offline. I know I could put in another VM for a load balancer, but then that adds a third VM and my goal is to keep as few VMS as possible.
... View more
Dec 13 2023
7:20 AM
I have not thought of using it because it looks like it requires additional licensing. That is not to big a deal, but I also want to avoid having to give user accounts in another system. Is there a way sync or approve users by using Azure or On Prem AD?
... View more
Dec 13 2023
7:16 AM
I have seen a couple of posts back in 2018 about issues with Windows NLB and the Meraki switches but I wanted to check in to see if a solution has been developed in the last 5 years. My configuration is 2 Hyper-V servers both running Windows 2022 Std with about 5 VMS on each host. I have 2 VMs where I want to use Windows NLB. The two VMS are Windows 2022 Std VM setup on different hosts. NLB on the two VMS is in IGMP Multicast mode (Tried Uni and just Multi with same results). Both VMs configs have MAC Spoofing enabled for the NLB NIC. Both physical NICs from each Hyper-V hosts are plugged into the same MS120-48. Server1 - 192.168.1.10 (on Host 1) Server1 - 192.168.1.20 (on Host 2) NLB - 192.168.1.30 All the VMs on each Hyper-V host are able to connect (and ping) the NLB at 192.168.1.30. No physical computers on the MS120 or other switch are able to connect or ping the NLB. I am assuming the VMs on each host can only see the NLB node on their own server. MS120 cannot ping the NLB and when I try to packet captuer for the NLB IP or MAC I just seen ARP requests with no response. I have been seeing that in order to use Windows NLB I need to have a static entry for the virtual IP and MAC, but can't see how to get this on the Meraki.
... View more
Dec 9 2023
7:51 AM
Yes, back in april. There have been a lot of dashboard updates this year so I wanted to check back.
... View more
Dec 9 2023
6:49 AM
Hi alemabrahao , Thanks for the reponse, but that just tells me how to setup the access which I have already done. The sponsored devices get on fine so that is not an issue. Also we don't want the Admins to have to approve guests or receive one off emails on approvals. Now that they are on, I just want to run a report that lets me know who approved the active devices and maybe things like when they were approved, how long they have left, and which SSID they are on.
... View more
I have a couple of areas in my facilities where we need WiFi and just have one or two clients there, so I picked up the MR36H access points. The built in 3 switch is not exactly what I was expecting because I thought it would operate similar to the MS switches. I am confused by the way I have to assign a SSID to the port. For my regular MS switches I would set the port types to Access and enter my VLAN (data) and Voice VLAN. This allowed me to use the one port for my VoIP phone and plug my computer into the passthrough on the Phone. On the MR36H It looks like I have to select an SSID for the port to get connectivity for that port and I can only use the port for a single VLAN. In order to get the switch ports to work for my I had to create a hidden SSID that connects to my VoIP VLAN and apply it to Port1 on the MR23H, then apply my SSID that connects to my data network to Ports 2+3. Is that the way these are meant to be setup or is there a way to get all 3 ports so they can have data and voice vlan access?
... View more
Dec 9 2023
6:13 AM
Is there a way to get a report of all the active sponsored wireless devices and who sponsored them? We have an SSID with Sponsored access for guests. The SSID has no LAN access and uses Meraki DHCP and the guest can request upto a couple of weeks of access. We also setup a second SSID for the employees to add their personal mobile devices. Basically the same setup, but the employee gets 6 weeks automatically. They just enter their own email as the requestor and approver. This network also has not LAN access and we also throttle the bandwidth and content filter. Currently I have to go to each device and check the settings to see who sponsored the device, but it would be great if I could either run a full report of the devices. Even better would be a weekly email of all sponsored devices.
... View more
Nov 30 2023
2:36 PM
2 Kudos
So I put in a ticket with Meraki support about the xml extension doubling up and also having to enable Profile Update to get the OnConnect to work. They said since I figured out then it really isn't a bug. NIce.......
... View more
Nov 30 2023
2:09 PM
Excellent. I did not know that was an option.
... View more
Nov 30 2023
1:32 PM
So we have some high speed fiber for our primary connection, but the best we could get for our backup line was a LTE 50/5 connection. Is there a way to limit the IPS, VLANS, SSIDs, or Services that are allowed to use WAN2 when a failover occurs. Ideally, I would like just access to email (O365) and our VoIP system to work and block video content like Teams Meetings, Youtube, and streaming services.
... View more
Nov 26 2023
8:41 AM
Thanks WW. I was able to get this to work by adding an OnConnect.bat file to the \Scripts folder. I have not tried the OnDisconnect.bat option, but assume it will work as well. I did have a gotcha to add. The script would not run unless I had Profile Update set to enabled on the Meraki MX's AnyConnect client settings. I did not have to upload a profile, but it had to be enabled or else the script would not run. I am going to put in a ticket for this as a bug because I also noticed that when I would upload an XML profile, it would be downloaded to the clients as filename.xml.xml. I am easily able to work around it by just removing the .xml extension at the end so it overwrites the desired file.
... View more
Nov 25 2023
7:56 AM
Back when I used to use the Cisco ASA, I recall being able to run a login script upon connection to the VPN. But the ASA controlled the script. Is there anything like this on the MX setup with AnyConnect? I did not see anything in the Profile Editor utility for this either.
... View more
Nov 13 2023
6:33 AM
Would Certificate and Active Directory authentication offer any improvement?
... View more
Nov 12 2023
5:18 PM
Quick question on when or if the encryption starts when using the RADIUS authentication option with Certificates. In the setup article: https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication The Network Policy configuration steps for RADIUS say "Deselect all checkboxes and select Unencrypted authentication (PAP, SPAP)". So is this connection method unencrypted?
... View more
Labels:
- Labels:
-
Client VPN
-
Firewall
Hi Phillip, I use the older Z1 devices now for my home office and some others, but it would be very cumbersome for the team to take them on the road and very expensive for each home office. Thanks for the suggestion.
... View more
I have some user where they want to be sure all their traffic flows through the VPN when they travel to places around the world that might have less than stellar privacy standards. (Unlike the wonderful privacy standards we have here in the US - LOL) Currently using version 5.0 of the AnyConnect client with our MX devices. Using Radius authentication with certs. I am using a split tunnel setup for my clients. I have my AnyConnect client configs for my MX devices setup with the following on the dashboard: Client Routing: Only send traffic to these destinations: (my local LAN network addresses) Dynamic Client Routing: Only send traffic going to these destinations: (List of web addresses) So is there a way to configure the local AnyConnect client so they use my split tunnel config as the default, but be able to turn on full tunneling on their own? I took a look at the VPN Profile Editor settings, but did not see (or missed) a settings to allow end users to do this.
... View more
Nov 9 2023
2:28 PM
Hi t4alha, Every device is different. You will have to check the documentation for the device that your ISP gave you. For example on my backup internet connection I am using one of those Verizon wireless gateway devices that give private IPs. I had to go to the Port Forwarding tab and forward Port 443 to the external IP of the Meraki MX. I am using the AnyConnect client for VPN access which is why I use 443. If you are using the built in Windows client, I think it is 1701 or 1723. Anyway, you are going to have to work with your ISP who gave you the device to figure out how to forward the ports needed.
... View more
Oct 28 2023
8:36 AM
Occasionally we have an issue where every minute or two a user/device will have a huge spike in bandwidth for just a second or two. Even though we have our VoIP devices on a separate VLAN and QoS configured these spike can cause some noticable issues. What is the best way to find a user/device that is causing the spike for brief moments. I tried to using the data usage history, but it does not appear the culprit is using all that much data all together.
... View more
Labels:
- Labels:
-
Firewall
Jul 13 2023
12:34 PM
I have about a half dozen sites setup with MX 84 devices with AutoVPN setup. All site can commuicate fine. Site 1: 172.16.10.x Site 2: 172.16.20.x Site 3: 172.16.30.x etc, etc, etc We need to connect to a vendor's infrastructure so we setup a Non-Meraki Peer to the Public IP of their appliance and the Local ID is the external IP of the MX at Site 1. I can communicate to the vendor's infrastructure from Site 1, but I need all six sites to traverse the tunnel. From what I understand I can setup Site1's MX as an Exit Hub so all traffic routes through Site 1, but I really only want the traffic for the vendor's subnets to travel through Site 1. Is this possible or do I have to setup Non-Meraki VPN Peers to each of the external IPs of every MX device with my vendor?
... View more
Labels:
- Labels:
-
3rd Party VPN
Is there a report to see the name or email of the guest for a device on the WiFi and the email address of the one that approved the access? Under the details on the client there is the approver's email address, but I would like to know who asked for the access. A report would be better because going from device to device is a pain.
... View more
Oct 3 2022
2:12 PM
Still no resolution. However I have linked it to computers that are having issues where a device randomly disconnects and reconnects. I and users have heard Windows make the device disconnect sound and then immediately make the reconnect sound around the time the AnyConnect window pops up. Most of the time it is the Realtek NIC that flakes out for a second several times a day. This is very painful because we use several programs that have SQL back ends and they can't handle the random temporary disconnects without bumping the user out of the application.
... View more
Aug 22 2022
7:23 AM
I am using the latest posted 4.10.05085 AnyConnect client to connect to my MX-84 units. Occasionally the AnyConnect client will pop-up on its own. I have to verified the reason, but it may happen when it sense some sort of connectivity change. This occurs whether or not the client is trying to get on the VPN and even when they are in the office. Maybe a few times a week. I have two questions related to this. First, is there a way to stop this from automatically popping up? Second, question is just me being very picky. I have used the AnyConnect many times over the years and I only seem to recall the AnyConnect GUI appearing in the lower right corner of the screen. Now it pops up in some random spot on the screen. Is there a setting for keeping down in the corner?
... View more
Jul 28 2022
7:45 PM
I have my MX setup to use AnyConnect and I am using Certificate Authentication with RADIUS (Windows NPS). This is working great, but just before the user gets prompted for a password, the AnyConnect client shows an error "Connection Failed" but allows the user to login without issue. Not sure why this is saying the connection failed, but I would like to get rid of this false error.
... View more
Jul 28 2022
7:31 PM
Also, I just came across this online utility that was created to make a VPN client connection. https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html I noticed at the end of the script there is a command to create a registry for connecting to a MX behind a NAT. You could try just running this command and rebooting the client and see if this resolve the issue. New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\PolicyAgent -Name AssumeUDPEncapsulationContextOnSendRule -Value 2 -PropertyType DWORD -Force | Out-Null
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 435 |
© 2024 Cisco Systems, Inc.
