Meraki

mmmmmmark · ‎Mar 30 2019

Thanks everyone. Got it sorted out with support's help.

mmmmmmark · ‎Mar 21 2019

So our company had split into two companies and we've gotten to the point where we'd like to split the Meraki devices into two organizations as each company pays it's own bills. So I thought i'd go to the license calculator to see what the co-termination dates would now be. I had no problem putting the devices that were going to go over to the other company and seeing what their date would be but when I put all the devices from our company into the calculator and tried to calculate our date, the page let me know that there's a limit of 1 wireless license and 4 Z1 licenses. Well, we've got two wireless licenses and seven Z1 licenses. So how am I supposed to see what the date is going to be? Suggestions? Thanks, Mark

mmmmmmark · ‎Dec 19 2018

First off, that looks awesome! I do wonder what kind of nightmare the power cords look like and I also wonder how much power the whole 'tree' uses? Nicely done folks, Merry Christmas!

mmmmmmark · ‎Dec 7 2018

I did exactly this with five ADSL connections into a pfSense box that had the firewall functionality all disabled so it was just routing/load balancing. Then it was connected as WAN2 into the MX. Worked well although it was just for failover if the primary WAN went down which I think happened once in 2 years.

mmmmmmark · ‎Nov 22 2018

I haven't used Meraki for DHCP in an enterprise network yet but i'm wondering how well the DNS would work compared to Microsoft. My hunch would be that it wouldn't be as good though. To get around your issue of no DHCP if the VM host is down, why not have a physical DC as well, you could have DHCP failover to it if the VM is down.

mmmmmmark · ‎Oct 12 2018

From a little checking, It looks like you can alert on devices that connect to the wifi supplied by an MX or Z1 but not devices that connect to a MR. You should cross your fingers and "make a wish".

mmmmmmark · ‎Oct 9 2018

I'm sad to say that I can't make it but i'll send my proxy 😉

mmmmmmark · ‎Oct 4 2018

I've tested this just now and it works, if you goto the devices, find their device and give them the policy of blocked, it will leave them connected to the VPN but they won't be able to actually do anything.

mmmmmmark · ‎Sep 27 2018

@jdsilva wrote: I would think you can do a packet capture on it though... I don't have a Z to look at myself, but everything else has that functionality. Yup, you can do a packet capture on a Z1.

mmmmmmark · ‎Sep 27 2018

And another thing that could happen is that you'll need to reboot the next device up the line when you replace the firewall. I've had a couple times replacing a firewall and had to reboot the modem in front of it as it was caching arp and wasn't happy.

mmmmmmark · ‎Sep 19 2018

@Asavoy wrote: So far this week I've been proactively rebooting every AP first thing in the morning and it seems to have helped. It's a PITA to reboot 50 WAPs though! Here's a thread on some ideas to reboot WAPs: https://community.meraki.com/t5/Solutions-APIs/API-Call-to-Reboot-AP/td-p/5863

mmmmmmark · ‎Sep 12 2018

So you've got a site that connects over MPLS to the colo and they also have a DSL connection. There's no infrastructure to put a WSUS at the site. Sounds like the MPLS is the primary uplink for the site. Any chance that the site could access the colo over the DSL connection and contact a WSUS there that way? I'd assume that the colo has a second connection? It would probably need a separate static IP as well due to WSUS going over 443.

mmmmmmark · ‎Sep 12 2018

1. Use a WSUS then you can force all of it's traffic out over that WAN. 2. Grab the list from here and then enter all those IPs into the Traffic shaping section and have all traffic to any Microsoft site go through that WAN.

mmmmmmark · ‎Sep 10 2018

Also, I've had the experience of having another employee get my phone call on their phone as both our phones were on the same wifi and were using the same icloud account. Don't know if that's still the case or not now though.

mmmmmmark · ‎Sep 7 2018

@Jacko wrote: Further to this, if we truly don't need AppleID's, is there a part of the SM policy where i can disallow an iphone user from actually signing into their appleID so that they cannot install their own apps? I've not tested it, but this should prevent the users from installing their own apps.

mmmmmmark · ‎Aug 22 2018

Just took a look at a couple of devices, an MX100, MX84 and MX64 and they all show that the MAC listed in the local webpage under the Security Appliance details is the LAN MAC. Same with the MAC listed in the dashboard under Security Appliance --> Appliance Status Also, the WAN1 MAC is one higher than the LAN MAC and the WAN2 MAC is one higher yet. So: LAN xx:xx:xx:bf:38:00 WAN 1 xx:xx:xx:bf:38:01 WAN 2 xx:xx:xx:bf:38:02 and LAN xx:xx:xx:8e:42:08 WAN1 xx:xx:xx:8e:42:0d WAN2 xx:xx:xx:8e:42:0e

mmmmmmark · ‎Aug 21 2018

Just a guess here since I haven't checked but i'd think that the WAN2 MAC would be one higher than the WAN1 MAC. So for example: WAN1: e0:55:3d:8c:32:08 WAN2: e0:55:3d:8c:32:09 But I could be totally wrong too.

mmmmmmark · ‎Aug 7 2018

@BlakeRichardson wrote: I have this dilema at home, my internet has just been upgraded to 1Gb down and 500Mb up but MX unit can't handle those speeds. Do I keep using the MX or change to my pre Meraki router which can handle these speeds. #rockandahardplace The struggle is real! Was just upgraded to 300/300 and the old MX64 just ain't up to the task 😉

mmmmmmark · ‎Aug 7 2018

I haven't tested it myself but does not deauthorizing the user or even deleting the user sever their connection? You would think that it would. I guess you could then add in a firewall rule to block any traffic or just VPN traffic from whatever IP they're connected from? Thanks, Mark

mmmmmmark · ‎Jul 21 2018

Couple things that I can think of off the top of my head: 1. It doesn't sound like you're that familiar with Meraki yet. I'd strongly suggest getting familiar before you start replacing the entire network of a client. 2. I believe that you'll have to create a VLAN for the second network, either the OPT or the LAN1 network. I'm guessing that the Zyxel acted the same way as pfSense acts where it has multiple NICs that are each a network, that's not how Meraki works though. You need to create VLANs for each network and then configure the ports to allow traffic on those VLANs to whichever ports are connected to whichever VLANs. 3. You can almost completely configure Meraki gear through the web portal without hooking them up before hand, when they do get online, they go up to the cloud (asuming there's connectivity) and download firmware if needed and the configuration. The only place where I believe you need to physically connect to the gear is for the MX with configuring the network details of the WAN(s) so i'd suggest that you connect a laptop or one workstation to the LAN port and nothing to the WAN port and configure that as you can't connect it to the network and tell it to have the same IP as the existing gateway (the Zyxel). Hopefully someone else will chime in with some more thoughts. Thanks, Mark

mmmmmmark · ‎Jul 15 2018

I know that Meraki uses cords with a notch in them on the MS350s but I think the catalyst line uses notched cords too

mmmmmmark · ‎Jul 15 2018

In Network-wide --> Group polices you can create a group policy and apply it to whatever devices you want. The only thing is that devices can currently only be in one group policy at a time. Here's the doc on group policies

mmmmmmark · ‎Jul 13 2018

The iPads in question have been enrolled in the Apple Device Enrollment Program or DEP program. Here's Apple's doc on the program: https://www.apple.com/business/docs/DEP_Guide.pdf and here's Meraki's doc on it: https://documentation.meraki.com/SM/Device_Enrollment/Using_Apple's_Device_Enrollment_Program_(DEP)_with_Systems_Manager

mmmmmmark · ‎Jul 10 2018

Funny story about when we used to use shared apple ids between devices. My mom called my iphone and since I was on the company wifi, the call also rang to a co-workers iphone. She answered and had a lovely chat with my mom. We got rid of the shared apple ids quickly after that. Course managing 60 apple ids which were all just aliases of a single email address was a bit of a pain so VPP and DEP has really helped.

mmmmmmark · ‎Jun 15 2018

A repeater?

About mmmmmmark

mmmmmmark

Community Record

Badges