Meraki

Kamome · ‎Feb 9 2022

Oh, silly me. I just found that Meraki IDS/IPS is basesd on Snort VRT ruleset, and Snort VRT ruleset is alias for Subscriber Ruleset, which is paid one. Welp, that means I cannot see every signature list in Meraki IPS ruleset. But I think that Registerd ruleset can give me general idea of current Snort signature database.

Kamome · ‎Feb 9 2022

Yeah. I looked up Event logs, and it says that "snort_rules_version : 2.9.15.1"

Kamome · ‎Feb 9 2022

As far as I know, Meraki IDS/IPS uses Snort VRT rulesets, but there are absolutely no information about ruleset itself. All I can find is Meraki uses Snort 2.9 rulesets, but I;m not sure it's bases on community or registered ruleset. If it's based on registerd ruleset, that means I cannot access full signature list until I buy or subscribe Snort. Does anybody know what edition of ruleset Meraki uses?

Kamome · ‎Jan 27 2022

Update : I got answer from TAC, and they said that some kind of SSL inspection on on-premise side is rejecting MR's SSL certificate because it's "unknown CA". And it seems recently updated firmwares(MX/MS/MR) are all using SSL certificate.

Kamome · ‎Jan 24 2022

For now, there are no way to connect MRs to another Internet connection. To do that, I have to disable VPN on the site. But I'll try it if forced firmware upgrade is failed. Thanks.

Kamome · ‎Jan 24 2022

I've seen this problem on MX several times, and most of them can upgrade firmware properly after manual rebooting. Plus, in that case, I can see firmware upgrading message on Local status page. But I cannot see any of these messages on MR.

Kamome · ‎Jan 24 2022

Oh, so it was firmware update problem. I'll check support case and trying to go RC firmware. Thanks.

Kamome · ‎Jan 24 2022

I have a network with one MX65 and two MR36s. AutoVPN is full-tunnel mode, so MR36 uses IDC's Internet connection. Since initial install, MR36 keeps losing connection between Meraki dashboard for 2 hours, then back on for 2 hours, and losing for 2 hours again, and keeps repeating. Initially, MX65's firmware version was 15.42.1, so I upgraded it to 15.44(latest stable). After that, it seems bit better, but still doing flip-flopping. (MR36's version is MR28.5) Surprisingly, user have no issues with wireless, and on-premise NMS which checks devices' availability via ping reports no problem with MR. Even other network which is in same Organization and using MR36 have no problem with Meraki dashboard connection. I'm running several MX65/68 and MR33/36 combos, but seems only MX65 + MR36 have problem. Is this can be hardware or software problem?

Kamome · ‎Jul 20 2021

I'm using ZABBIX to monitor Meraki hub device's performance score via calling Meraki API. But today I found that ZABBIX cannot get any perf score sice last week. When I check items in ZABBIX, all items got HTTP 429 error. I've running this server for about 2 years on Openstack, and 3 months ago migrated to AWS. But both are using my company's local Internet - not AWS IGW. So I run cURL from ZABBIX server's shell, and it still gets HTTP 429. I'm monitoring 30 devices and each devices polling API every 1 minute. Therefore, there are only 1800 API calls per hour. That's way below to Meraki AP call limit. Plus, I cannot understand why suddenly ZABBIX starts to get HTTP 429.

Kamome · ‎Jul 15 2021

Oh, there were mentions about expire alert. Thanks. But I remember that I got first alert 90 days prior to license expiration date, and got several more on the line. It seems there are kind of policy update inside Meraki Dashboard.

Kamome · ‎Jul 14 2021

As far as I know, license expire alert is sent at 90/60/30 days before expiration date. But I cannot find any mention of alert interval in documentations. Does anybody know intervals of license expire alert or documents that explains about it?

Kamome · ‎Jan 24 2021

I think I saw UTC in some area. b. Change log. As far as I remember, I have to calculate device add/remove time to my local timezone.

Kamome · ‎Aug 6 2020

How about change minimum bitrate to assure full compatibility? If that darn smart plug is too cheap or old, it could be use old internals.

Kamome · ‎Aug 2 2020

Use getOrganizationNetworks and it will brings you every network's information including timezone info within an organization. Device's timezone follows network's timezone which is device belongs to. https://documenter.getpostman.com/view/7928889/SVmsVg6K?version=latest#531675ad-b85b-4683-babc-d04f7f917bc3

Kamome · ‎Jul 28 2020

It starts from customer's question : "Can you control Windows update data via Meraki's SD-WAN feature?" When I got that question, I became quite curious too, so I asked about it here. https://community.meraki.com/t5/Security-SD-WAN/Is-there-any-detailed-explanation-or-listing-about-pre-defined/m-p/93038#M23388 But even it was from Meraki employee's reply, I was little unsatisfied. I still cannot understand why answer was about contents filtering menu even though I asked about SD-WAN related features. However, as he suggested in second reply, I opened case to get details about SD-WAN policy categories. And it makes me write first ever ranting to TAC. First thing that triggers me was TAC said almost exactly same thing as reply that I got from link above. And it get worse when TAC said to me to "test with L7 firewall rules to check whether Windows Update is included in Software & anti-virus updates category." Links to document about blocking app with L7 firewall was sprinkling salt on top. Both says that they misunderstood my question. But why on earth they misunderstood when I clearly wrote "SD-WAN policy". Second, even I opened case as suggested, but TAC says that they don't have detailed list for SD-WAN policies. It doesn't makes sense at all to me. One person says that I can get desired information via opening case, but when I opened case as suggested, I got nothing. Is it that hard to have and provide details about features that Meraki is pushing really hard and made "another separate licensing" to support it? At first, I agreed with Meraki's philosophy. It makes me quite easy to build and manage networks. Even customers are quite satisfied. Now their requirements are getting more complex and I want to keep suggesting Meraki to more customers. But these kind of black boxing about features makes me hard to suggest Meraki any more because I'm not sure whether Meraki can provide what they want, and can I adopt requirements using Meraki. It became little ranting, but I felt that I have to say about this. I always agree with simpler network philosophy, but at least let administrators know what's under the hood. I'm sure that it will make Meraki more suggestable options to more customers out there.

Kamome · ‎Jul 20 2020

It's this menu.

Kamome · ‎Jul 19 2020

Recently, I got question from end-user manager about Meraki SD-WAN policy. He asked me that whether Meraki can handle Windows Update traffic via Meraki's SD-WAN feature. So I checked SD-WAN categories, and suddenly I've realized some of Meraki's pre-defined SD-WAN categories are quite vague. For example, I cannot sure that Windows Update is included in "Software Update" category. There's no detailed documentation about that. I assume that I can get answer by opening case and ask about it to TAC, but it's inefficient to do it every time when I need to check. Is there any documentation or something that describes details about pre-defined SD-WAN categories?

Kamome · ‎Jul 17 2020

As far as I know, you can't control WHAT TO SEE(menu item), but only can control WHERE TO SEE(networks). Besides that, I want more sophisticated admin privilege control, too. Several of my customers wants to see more than monitoring stuff, but to do that I have to give read-only permission to them, and that comes with risk of configuration exposure. And many of members here will know the consequences.

Kamome · ‎Jun 30 2020

Scenario 1: For 2000 endpoints (Z3C's), will I be hitting a limit for the MX250 (HA) as the gateway? Don't believe will have room to grow. Maybe better to go with the MX450? Well, it depends. According to MX Sizing Guide, MX250 could accept maximum 3000 concurrent VPN tunnels. So 2000 endpoints are about 60% of capacity, so it could be ok. But you must consider how much VPN traffic will occur. If 1000 endpoints are generating more than 1Gbps, MX250 will max out even concurrent VPN tunnels are way below it's capacity. Therefore, if 2000 endpoints generates more that MX250's VPN throughput, you have to consider going to MX450. Scenario 2: For 6000 endpoints (Z3C's), should be ok with MX450 (HA) as the gateway? Might be okay, but I recommend to use two MX450 HA sets. Although you use HA pair, only primary MX will do everything. That means all 6000 tunnels will be handled by single MX450, and it's about 20% more than MX450's maximum capacity. Therefore, use two MX450 and connect 3000 endpoints per one MX. (I'm using this method one of my organizations with one MX100 pair and one MX84 pair to split traffic that MX have to deal with.)

Kamome · ‎Jun 24 2020

LIC-MR-ADV-1Y is Advanced Wireless license, and it only can apply to per-device license organization https://documentation.meraki.com/MR/Other_Topics/Cisco_Meraki_and_Umbrella_Integration_-_MR_Advanced%2F%2FUpgrade_License You have to get Enterprise license(LIC-MR-1Y) in order to apply to co-termination organization. Therefore, I think you have to choose one of these options. 1. Convert organization from co-termination to per-device license. By this way, you can use already bought license, but you have to keep in mind difference between co-term. and per-device model. 2. If you want to keep co-termination model, you have to buy renewal license again with LIC-MR-1Y. In this case, you have to discard already bought licenses.

Kamome · ‎Jun 24 2020

It seems you got Advanced Wireless license, not Enterprise Wireless. Could you list up MR license's Item name?

Kamome · ‎Jun 11 2020

According to spec sheets, MS355-24X2 can support 720W PoE. https://meraki.cisco.com/wp-content/uploads/2020/05/meraki_datasheet_ms355.pdf

Kamome · ‎Jun 11 2020

Me saw after photo

Kamome · ‎Jun 11 2020

Wow, I didn't know Cisco makes ANC headsets also.

Kamome · ‎Jun 11 2020

It seems your network is combined network, so Dashboard is trying to apply MX configuration even though there are nothing in there. I think splitting network into security appliance and wireless network will help you. Update : I made a typo. I changed "anything in there" to "nothing in there" to make it more clear.

About Kamome

Kamome

Jinuk Jung

Community Record

Badges