Greetings fellow community'ers.   I am at my whits end with Meraki to the point where I want to rip it out and put in a real solution from their better half.   We have a recurrent issue where clients are incorrectly identified in the event log. I am trying to track a malicious actor through our network (it's just porn, not hacking but could easily be) and it just doesn't work. You find the client in the event log just fine, but when you click on them you are either taken to a (seemingly) random device, or a "Sorry we could not find that client. Please go back and try again".   I've had a case open with support since May and we are no closer to a resolution. They even confirmed it happens to them, too!   Does anybody else have this problem, or is it something peculiar to our network? I just need to be able to click through on the event log page and a) get a client, and b) be sure that this is THE client I clicked on. ... View more

Hello Community,   I've set up daily reporting on our network for a variety of things, but one thing I continually see is odd applications listed in the "Top applications by usage" section.   Dotted amongst the usual Office 365, Microsoft SQL Server etc are off applications like "2889", "2292", and "2294". When I follow the hyperlink in the email I just get presented with a blank Meraki page.         Has anyone got any idea where these applications in the list are pulled from? I'd like to understand what these random numbers are in terms of applications and why they are running on my network. ... View more

Hello all,   Does anyone know when Meraki are planning to fix the false positives in the event logs for IP conflict Source IP and/or VLAN mismatch? We're still seeing this in our logs on a daily basis and we can't tell any genuine issues apart from the false positives.   We had a case open with Meraki support who just said it was an issue they were planning to fix at some point in the future.   Thanks J ... View more

Hi folks,   We have content filtering set up on our MX, and it has suddenly started reporting that our Domain Controler is trying to reach pornographic sites at 3:33am most mornings. Our PDC is also our DNS server for the network.   We can't find any obvious cause for this. We aren't a 24 hour operation, so there is no one on the VPN or in the building at that time of the morning. The domain controller itself appears to be clean, and there's nothing in the DNS logs to suggest it's caching those nameservers for any reason.   Is it possible this is a false positive, or that it's coming from another machine on the network? ... View more

Hello team,   We are investigating an issue in our backup environment. We utilise Veeam and a job is supposed to run every night to copy our backups into PeaSoup cloud. This copy job has recently started failing.   We spoke with Veeam who said that our firewall is the likely root of the problem, and it needs to comply with their KB https://www.veeam.com/kb2140 but I can't see there is anything specific in that KB for us to "do" in order to fix the problem.   The backups have been working fine for months but recently started to fail with the error:   Failed to decrypt TLS data: (336130329) error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Unable to retrieve next block transmission command. Number of already processed blocks: [2810]. Failed to download disk '<our server name>.vhdx'. Reconnectable protocol device was closed. Failed to upload disk '<our server name>.vhdx' Agent failed to process method {DataTransfer.SyncDisk}. Our MSP has logged a ticket with Meraki support, but based upon my recent interactions with them I don't hold out much hope that they'll even understand the question.   Has anyone else seen anything like this before? I assume other people out there are using Veeam to copy jobs to an off-site repository!   J 🙂 ... View more

Hi guys,   For a few weeks now, we have been hammered with Apache Log4j logging remote code execution attempts from host0484.sdjihtbwyu8rtgutrw.com / 95.214.55.244. How can I absolutely ensure this traffic is dropped?   The MX identifies that this traffic originates from Poland, so I have added that country to our Geo blocklist. I've also added a L7 rule to deny this IP. Are there any other steps I should take to combat this threat actor? We are an SME and there's only a handful of us in IT, none of us are security specialists, so I want to make as sure as I can that this IP is blackholed, blocked, bounced, whatever - as long as it doesn't get though!   Thanks all J 🙂 ... View more