Hello Community,   I've set up daily reporting on our network for a variety of things, but one thing I continually see is odd applications listed in the "Top applications by usage" section.   Dotted amongst the usual Office 365, Microsoft SQL Server etc are off applications like "2889", "2292", and "2294". When I follow the hyperlink in the email I just get presented with a blank Meraki page.         Has anyone got any idea where these applications in the list are pulled from? I'd like to understand what these random numbers are in terms of applications and why they are running on my network. ... View more

Hello all,   Does anyone know when Meraki are planning to fix the false positives in the event logs for IP conflict Source IP and/or VLAN mismatch? We're still seeing this in our logs on a daily basis and we can't tell any genuine issues apart from the false positives.   We had a case open with Meraki support who just said it was an issue they were planning to fix at some point in the future.   Thanks J ... View more

Hi folks,   We have content filtering set up on our MX, and it has suddenly started reporting that our Domain Controler is trying to reach pornographic sites at 3:33am most mornings. Our PDC is also our DNS server for the network.   We can't find any obvious cause for this. We aren't a 24 hour operation, so there is no one on the VPN or in the building at that time of the morning. The domain controller itself appears to be clean, and there's nothing in the DNS logs to suggest it's caching those nameservers for any reason.   Is it possible this is a false positive, or that it's coming from another machine on the network? ... View more

Hello team,   We are investigating an issue in our backup environment. We utilise Veeam and a job is supposed to run every night to copy our backups into PeaSoup cloud. This copy job has recently started failing.   We spoke with Veeam who said that our firewall is the likely root of the problem, and it needs to comply with their KB https://www.veeam.com/kb2140 but I can't see there is anything specific in that KB for us to "do" in order to fix the problem.   The backups have been working fine for months but recently started to fail with the error:   Failed to decrypt TLS data: (336130329) error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Unable to retrieve next block transmission command. Number of already processed blocks: [2810]. Failed to download disk '<our server name>.vhdx'. Reconnectable protocol device was closed. Failed to upload disk '<our server name>.vhdx' Agent failed to process method {DataTransfer.SyncDisk}. Our MSP has logged a ticket with Meraki support, but based upon my recent interactions with them I don't hold out much hope that they'll even understand the question.   Has anyone else seen anything like this before? I assume other people out there are using Veeam to copy jobs to an off-site repository!   J 🙂 ... View more

Hi guys,   For a few weeks now, we have been hammered with Apache Log4j logging remote code execution attempts from host0484.sdjihtbwyu8rtgutrw.com / 95.214.55.244. How can I absolutely ensure this traffic is dropped?   The MX identifies that this traffic originates from Poland, so I have added that country to our Geo blocklist. I've also added a L7 rule to deny this IP. Are there any other steps I should take to combat this threat actor? We are an SME and there's only a handful of us in IT, none of us are security specialists, so I want to make as sure as I can that this IP is blackholed, blocked, bounced, whatever - as long as it doesn't get though!   Thanks all J 🙂 ... View more

Hello Community,   I just want to sanity-check something with you all.   We turned on Any Connect on our two MX's (MX105's in HA) and this killed our VoIP. We couldn't make or receive calls from any handset behind the firewalls until we turned the feature off again.   The AnyConnect subnet is completely different from any of our other production subnets, so we don't understand why this happened, and we think that it shouldn't have happened because the AnyConnect setup is independent of any other firewall features. Even if the MXs needed to re-provision (like Ubiquiti calls it) surely the spare should have taken over duties whilst the primary appliance did its thing?   It doesn't look like internet traffic was disrupted, just VoIP. We're a little hesitant to re-enable this feature because we need our VoIP as a key component of our business.   Any thoughts?   Thanks 🙂 ... View more