Meraki

Mloraditch

The dynamic ports I think would only be open when in use, so I'm not sure that's unexpected.

Mloraditch

If you are allowing all ports and basic comms work it could be an AD issue. There are a LOT of possible reasons for failed AD replication. Windows Firewall will automatically take into account all things necessary for DC replication, but you can try turning that off briefly on both endpoints to see if it's the issue. You can also packet capture on each end when forcing a replication and see if packets are making it back and forth. Generally if you aren't putting any firewall rules in place on the site to site vpn, I would suspect software issues on the windows side for something like this. A stretch but you could try turning off AMP and IPS temporarily if in use.

Mloraditch

That is not possible with ISE and Meraki. Its possible with IOS based switches (in native IOS Mode): https://www.wiresandwi.fi/blog/cisco-ise-flexconnect-access-point-auto-smartport-trunk-via-macro-configuration In theory it could eventually become possible with Meraki Managed IOS switches, but definitely isn't available at this time.

Mloraditch

ISE can set a VLAN by name or VLAN ID and can also set a group policy. It can not set a smart port profile See here for how to use names: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/VLAN_Profiles#VLAN_Profiles_and_RADIUS

Mloraditch

Yes CW aps (and all new Meraki aps from here on out) can operate in either mode but with Meraki console is disabled.

Mloraditch

I've had to do this, but you could also get a Unifi Cloud Key Gen 2 Plus and migrate off the UDM to that. While you can definitely disable 99% of the UDMs networking functions you can avoid any possible issues that might happen if it ever randomly resets itself, etc.

Mloraditch

I'm struggling to find the reference info or perhaps it was just another post somewhere, but Im pretty sure I have heard of this and it is related to a boot sequence thing. Considering Meraki APs don't support console use, I would leave it unplugged.

Mloraditch

You can see all the official documentation here: https://meraki.cisco.com/trust/ on what they store. I don’t see anything official, but its a lot to read.

Mloraditch

Can your AP ping the LDAP server? You need that basic connectivity before anything else. Also port 636 is LDAPS not 626. If you can ping the server and neither port works you may need to packet capture to see what is going on. At least in cleartext (389) you will see exactly why it's failing in the ldap messages from the server. It's a bit harder with SSL. It sounds like a new setup so your AD admin may need to look at something like this: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ldap-over-ssl-connection-issues and verify things work in general.

Mloraditch

The AP ports need to be trunked. You can set them with 10 as the native vlan and at least vlans 10,30 allowed then your setup should work without other changes

Mloraditch

Is VLAN 30 allowed on the trunk from the MX to the switch involved? and same on the switch port to the AP? and is the AP's native vlan something other than 30?

Mloraditch

Yeah between all the different types of power events and what the end users describe, it's likely what we are being told are power outages may not directly affect the devices I'm checking. UPS kept things up, partial outage, etc. I guess what I would say to OP given that is if the Meraki says it lost power it did, but if it doesn't it's doesn't mean there wasn't some sort of utility event. May or may not matter with what you are trying to monitor or correlate.

Mloraditch

There is some difference yes. It notes Upgrades and Reboots (when initiated from the dashboard). I don't believe it distinguishes between power outages and other lack of connectivity situations. I've looked at a couple of clients who I know had power outages and they just say no connectivity.

Mloraditch

Good to hear. they may already know but I'm sure it could everyone in the long run if you take a few seconds to open a support case to help elevate the issue for them.

Mloraditch

I've not seen this before. This is likely either a GUI bug and you can try switching to the old or new version in the upper right of the switch view, depending on which version you are on and see if it clears. If it does I'd open a support case and make them aware. Or it's a backend data issue that could be on the backend or could require a reboot of the switches or a firmware update. If switching the gui doesn't work, I'd open a support case and ask them for further guidance so the issue can be logged and tracked if necessary.

Mloraditch

You are defining option 15 as a custom option and it's not sending? While I don't have a 9300L doing DHCP, that sounds like a potential bug and I would involve support. There is not a comprehensive checklist that I'm aware of (although there should be) You can find some details here: https://documentation.meraki.com/Firmware_Features/MS_Firmware_Features_Directory and here: https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Cloud-Native_IOS_XE_Overview If you aren't on the latest CS version you may want to try to upgrade. I don't see anything related to your issue in the most recent release notes, but it's certainly possible to be an already fixed bug.

Mloraditch

In theory this should work, but it sounds like something is blocking the connection. You can check the upstream device against the Meraki firewall rules as documented here: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity Once you get that resolved, you can use Flow preferences to send traffic from the specific SSID out that WAN: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences The traffic will need to be on a unique subnet.

Mloraditch

If you need geo blocking for RA VPN, Cisco has added it to Firepower recently. See here https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/770/threat-defense-release-notes-77.html You could get a small firepower unit and retain Secure Client.

Mloraditch

Yes they will.

Mloraditch

The MG is not a firewall. It's designed as a way to get a cellular connection into an MX or other firewall via a cloud managed device vs having to use another vendor's gear. While in a temporary setup an MR into an MG may work, I would not recommend it long term. The main limitations would be lack of VLANs, Group Policies, any advanced security features like IPS/AMP, etc. An overview of the basic features that can be configured is here: https://documentation.meraki.com/MG/MG_Best_Practices/MG_Wireless_WAN_Dashboard_Settings

Mloraditch

Sometimes I find an analogy helps, in the spirit of May the 4th, I'll lay out this: if the Emperor can Force Lightning you why does he have a royal guard and why does he live in a palace with several layers of security? Layers of security.

Mloraditch

The exact distance a signal will cover is determined by environmental factors from the building design to the end devices and their capabilities. 2.4Ghz will go further than 5, a Laptop may have a better wifi adapter than a roku, etc. A survey will be the most accurate way of seeing what is possible in your facility.

Mloraditch

If you solely want to manage end user devices, Systems Manager does that without needing any hardware. It's a regular MDM like Intune, JAMF, etc. The licenses are attached to your dashboard and then consumed when a device is enrolled. I can't say I'd recommend it in general on a server OS but it's fully supported and perhaps you have a use case where it could be a good idea.

Mloraditch

Systems Manager works independently of Meraki Hardware. You just buy a license for each endpoint: https://documentation.meraki.com/General_Administration/Licensing/Systems_Manager_Licensing General info: https://meraki.cisco.com/lib/pdf/meraki_datasheet_sm.pdf Now if you have actually have 100s of sites with 15 Windows PCs each, you may want to look more into a Microsoft Native Solution for the PCs for deeper integrations. I personally more advocate Meraki SM for iOS/Android and then maybe ultra small PC environments where AD/Entra AD are not feasible Now you also mention managing and monitoring the actual network infrastructure. That's a whole different situation. At 100s of sites, even though many are small, you are going to want to contact your Cisco Partner or Meraki rep and get them and pre-sales engineer involved. There are many possible solutions depending on your needs and while I could recommend a basic setup for a small site (MX67, MS130 or 150 24 or 48 port, and a couple of CW916X or 917X aps) you would be be best served by a deeper dive. Also given the time of the year (Ciscos Q4) engaging a rep will also position you to get the best pricing for such a large install.

Mloraditch

I should add that I'd recommend getting Secure Client (AnyConnect) licensing and switching to that. It's not that expensive and should work with most any ISP situation https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance

About Mloraditch

Mloraditch

Matthew Loraditch

Community Record

Badges