Meraki

Dunky · ‎Sep 18 2024

Can you not Deny at Layer 7 as below: And add L3 Deny rules for teamviewer.com etc provided the MX has seen the DNS lookup, or if using internal DNS setup a teamviewer.com domain and resolve to 127.0.0.1 ??

tkiel · ‎Oct 9 2023

sounds great, but seems like the link is not accessible even though I should have partner access. But thx anyways 🙂

amabt · ‎Aug 3 2023

Posting this for anyone else having this issue and is using Telstra (Australia) and searching this issue in the future. We have hundreds of sites with backup connection via Telstra 4G Data SIM. Provided you are on the telstra.extranet APN. Things will work no issues because you get a proper public WAN IP. You need to ensure the Meraki is set to use the telstra.extranet APN. How to get telstra.extranet APN? You need to be on an enterprise or corp level account with Telstra and ask for telstra.extranet to be enabled on the service (magic code GPTEXB3 needs to be added to the service). Telstra by default will put you on a 10.x ip range as they don't give out a pulic WAN IP for just any customer. If you are a Telstra retail customer. You will get CGNAT and you will have issues.

cmr · ‎Jul 20 2023

In your case, try changing to a different firmware, it looks like the unit is not installing the currently selected one and rebooting

IronBones · ‎Nov 24 2022

So did making sure RSTP was enabled and enabling BPDU fix the random switch/system drops? Similar issues on my network where switches randomly show offline. STP looks solid with NO Switchloops I can find. Topology describes a straight forward link from firewall SPF port to Switch, but still have switches dropping soon after reboot.

Sharjeel_Bashir · ‎Sep 2 2022

I appreciate each one of you taking the time out of your busy schedules to respond and assist me with this. The Cisco AnyConnect is unquestionably the best choice, but at this point, it depends on the client's willingness to pay extra for it.

cmr · ‎Jul 9 2022

@GreeNdeviCp3821 I'd get at least one genuine cable (the 40Gb ones aren't very expensive).

Make_IT_Simple · ‎Jul 8 2022

This KB may help to troubleshoot the issue: https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS_Issue_Resolution_Guide

redsector · ‎Jul 1 2022

We have some MR32 but no issues. Except of the fading blue LED light.

MSchwark · ‎Jun 15 2022

We updated several MX-100 and one vMX100. the vMX100 (virtual) updated to 16.16 without issue and is currently still on that version with a scheduled upgrade scheduled. The issue we had was with our physical MX100. When upgrading to 16.16 all of our MX100's would drop out, consistently, every hour for about 10-20 minutes, consistently. We were able to roll them back successfully. I tried several times but eventually updated them to version 17.6 which resolved the issue. The issue had to do with an upstream SFP connection at the DMARC. We have been running version 17.6 without issues for several months. We have not had any bandwidth issues on 17.6 and will upgrade to 17.8 this next week.

CW_KeithP · ‎May 9 2022

Yeah we've had huge issues with NBAR, in particular misclassifying Unifi management packets and 3CX tunneled voice traffic, so it's prevented remote management of some distant sites Ubnt gear, and causing their phone calls to repeatedly reconnect when using iOS or Windows clients. The solution was to manually update the L7 rules to exclude these false matches, but then 1) there maybe new false matches, 2) that's across dozens of sites we'd have to do this, and 3) then each month when new definitions are added we have to rinse and repeat. The other option at one point, unsure if this works, but turning off advance traffic analytics or something disabled NBAR, however, a lot of our sites actually need this feature. For now we're getting a pile of sites 'pinned' on MX15, and for others that are more critical eg local govt we are replacing the MX with FortiGate's which we've tested not to have this issue. I hope that helps! -KP

WB · ‎May 7 2022

I've just lodged a feedback for it.. will see if it ever eventuates I guess!

cmr · ‎Apr 20 2022

LOL, that is a lot, Sophos can do as many as there are physical ports on the device (minus 1 for LAN and one for HA if you are using it). I'm sure Meraki will move to more (3 or 4) but it may well only be on the newer MXx5 devices...

van604 · ‎Mar 26 2022

thanks, this is great info in helping sort out the update issue, worked for me

Hulafish · ‎Mar 24 2022

Thanks Blake, I did find that. Just wish you could disable it from wifi but keep enabled on LAN.

Jackson_J · ‎Mar 24 2022

Hmmm...and this is coming from a Meraki employee...so what I'm hearing from you is to probably Not upgrade to 14.33 in a couple of weeks?? Is that correct @Make_IT_Simple ? Is there any Firmware version that is the most stable that you guys would recommend? I appreciate your response in advance. Thanks Sorry about that @Make_IT_Simple , I misread your post. It looks like you're saying that in your experience, 14.33 did resolve these issues in your environment, is that correct? My apologies for misunderstanding, if that's the case.

Ryan_Miles · ‎Mar 23 2022

Concentrator mode only uses WAN 1 port What's the goal with using both WAN ports on the MX? Just LAG/more bandwidth? As Philip mentioned no MX supports LAG. And the MX105 has 10Gbe capable WAN ports. Typically in this design the MX would sit behind your edge FW in a DMZ using a private IP. The FW would have a NAT rule and access rule allowing VPN through it/to the MX.

CarlosCoque · ‎Mar 23 2022

They don't use the same ISP because there are people in other countries and they have the same issues.

LC_IT · ‎Mar 23 2022

Increase the Radius Timeout solved the problem! Thank you so much!

DasVillain · ‎Mar 22 2022

Sorry, I meant to say... I am testing using the GX20 browser interface that has a speed test function for this appliance specifically to check the connection to the appliance.

OVERKILL · ‎Mar 22 2022

Looks like two different countries (China, Russia). But the volume is just a trickle now compared to when it was on 443. I haven't seen any hits on it today for example. This client is a car dealership, so yeah, definitely no business in those countries, lol. Also, no further flaps of course, since AnyConnect isn't getting hammered now.

Bruce · ‎Mar 22 2022

And remember that if the warranty response time isn’t inline with your requirements, e.g. you want a 4 hour advance replacement (not something you’d normally want on an access point), or if the warranty is only for a year and you want to extend it, then you can get MerakiNow which is very similar to SmartNet in that it provides hardware replacement.

Make_IT_Simple · ‎Mar 21 2022

I don't believe that the MX will use any specific VLAN for the test, it will just use the primary uplink for the test, in your case is WAN2. I am not sure what is the end goal here, but I just want to say that dashboard throughput is not really something that you can use as speed test data. If you want to test the speed, it is better to just use any device downstream of the MX (server or any computer), then you can use the server/computer IP to create your traffic shaping rule.

KarstenI · ‎Mar 21 2022

“If the application on the server is secure” is the first misconception. There is no secure application. A DMZ is not that complicated, it’s best practice and you really should implement the server in a DMZ.

tantony · ‎Mar 21 2022

Thanks, I do prefer a physical MX like I have now, but just wanted to know the virtual MX instance works.

About Make_IT_Simple

Make_IT_Simple

Community Record

Badges