About Nash

Nash

Just to confirm, what's your Meraki dashboard structure for these devices? All in the same network? If different network, is scanning api authorized on all networks?

Nash

What's new in the domain of network security, for most networks, is reviewing your implementation of the basics. If they aren't there, then figure out what you can do within your network and do that. The latest and greatest gadget and whizzbang software will not save you if you don't close the front door.

Nash

Ah, gotta be careful with LastPass. Someone, whose name might be Nash, once accidentally changed client VPN PSKs because LastPass was helpfully autocompleting things when I would make new Meraki cloud credential users or whatever.

NolanHerring

@Brons2 wrote: I had problems with 11.22 also, see my thread "11.22 killed my call center". I rolled back to 10.45 though instead of going forward to 11.28. It sounds like I need to stay on 10.45 if I can't use port mirroring on 11.28. I have mirror ports going to a security device, looking for lateral movement of malware. I have no intention of disabling this. That is a safe way to go for sure, so I respect that. That being said, I am curious though if it was only because port-mirroring was enabling 'during' the upgrade process that it broke stuff. I wonder if you turn it off 100%, perform the upgrade, and then re-enable post upgrade if it would still cause issues or not. Obviously I don't expect you to find out with your production environment of course lol, but just food for thought.

BlakeRichardson

I have had mixed results, Cable length not always accurate for me.

BrechtSchamp

Congrats @Brian_Swanson @Spack and @fragonzalez !

PhilipDAth

I would really like to start on this program soon. I'm pulling my hair out trying to use the MV API. It is just too limiting and needs bug fixes and fundamental design changes to make it commercially viable at scale. At the moment, it is really only any good for pet projects.

PhilipDAth

Yes it sounds like the 1:1 NAT you have allocated might already be in use.

BrechtSchamp

Nice! Thanks for reporting back. Glad we could make it a pleasant experience!

Nash

In addition to everyone above. If you need to maintain any of the configuration on these APs, write it down beforehand. They will lose all config when being moved from one org to another.

NolanHerring

@jthunderbird wrote: Wow, so you cannot setup content filtering at a central location even with the advanced security license? I have to build a template to apply to all spoke nodes... This seems silly and counter to a server/client relationship. Frustration understood. I'm assuming there are two good reasons for this though: Processing overhead can be distributed vs condensed on a single appliance Its best practice (in general terms) to stop any unwanted traffic as close to the source as possible, at least from a security perspective (think ACLs etc.).

AndrejRistovsk

Hi there, From the old Cisco ASA firewall i am able to see that the VoIP provider subnet is 89.184.XX.0 255.255.XX.0. So i believe that in the 1:1 NAT in the Remote IPs i will need to replace any with 89.184.XX.0 255.255.XX.0 ?

superego

My Home VPN was working before using Windows 10 Laptop and Desktop. Then after the updates it stopped working. Modified the VPN Properties and allowed the protocols below and it started working again.

Rodrigo_

Just wondering, do you have "client balancing" enabled? This can be found on the rf profile. On event logs, look for rejected due to load balance or something like that, let us know what happens with the new ap

Austin

I contacted Meraki Support, as @Nash recommended, and received the following good news. Good morning, Thanks for contacting Cisco Meraki Support! I would be happy to assist you with this. We do not use either of those chips, so the MX devices are not vulnerable to the attack.

Nash

At least you won't have to worry about HTTP 418... I would listen to Phillip. He knows a great deal about Cisco kit.

DensyoV

Hi, just reiterating @Nash reply, the easiest way is to configure the Site-to-site VPN firewall rules allowing only the desired traffic. Here's the link to Meraki KB regarding the configuration. https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior hope this helps.

KrishnaGummadap

Ok. I will contact my ISP for changing their router config to bridge mode.

Asavoy

@ww Interesting! I just compared two WAPs in the same building, one had VLAN specified and one didn't. So, removed VLAN from the one, reboot, and presto.

BlakeRichardson

@GJ1 it sounds like you are OK to change it, at least if it doesn't work as expected change it back and start thinking on plan B. Good luck.

EClap5

I see a ton of these errors in Wireless Health for our company phones which have the PSK pushed down by an MDM so I'm in the same boat - I know the PSK in not incorrect.

cmr

Oh the irony, I tried to view the recording from my commuter train WiFi and Umbrella blocked me 🤣

Alex1597533

Thank you Uberseehandel. I understand you, but it is always good to gather information from everyone. Thanks again

jdsilva

Haha all good dude! Yeh if you haven't played around with the 30H then maybe that's where you and I aren't syncing? You don't configure the wired ports on a 30H like a switchport... You basically bind a wired port to an SSID (yes, I said to an SSID). You don't have things like access or trunk or whitelistsing or BDPU Guard available on the 30H. I agree with you that your DHCP solution is much better in this situation. I appreciate you talking this out with me nonetheless! And for now I'm going to stand by my assertion that MAC Whitelisting won't solve this problem 🙂

hockeydude

lmfao

Nash

Community Record

Badges