Meraki

FabianSchleef · ‎Mar 23 2024

Hi, you can also check if your carrier provides another APN that‘s not behind a CG-NAT and change your cellular gateway to it. This way you don‘t need to configure any manual NAT traversal rules.

FabianSchleef · ‎Mar 7 2024

Hi, it‘s a Firewall. You can create interfaces on it for routing and use those for talking to internal services. Take a look here: https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration Edit: to get things clear - There is no internal Management IP address on a MX like on MR or MS devices for example. Its reachable by the meraki dashboard through its own WAN IP address.

FabianSchleef · ‎Mar 7 2024

What could be possible is that dhcp snooping is enabled and not trusted on the AP port… I‘ve had DHCP issues with all kinds of Meraki APs (Catalyst 916x aswell) by not allowing „all vlans“ but instead only allowing the specific SSID VLANS on the switch port. Only with Meraki switches. Catalyst switches are uncomplicated in comparison lol

FabianSchleef · ‎Mar 5 2024

Hi, if you want to achieve a good rf design (it's not all about signal strength) you should consider talking to a wireless consultant which can do a professional wi-fi site survey. Here is a pretty nice Meraki documentation page covering all important aspects like capacity planning, radio settings and so on: https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless

FabianSchleef · ‎Mar 2 2024

Hi, so first of all - it sounds like you are using Non-Meraki VPN instead of Meraki Auto-VPN. Can you confirm that? Having identical VLAN IDs/IP Subnets on both ends is not a problem as long as you don‘t route them into the VPN tunnel. Can you provide any event log messages? Have you done a Packet Capture of your WAN Interfaces for the IKE and/or IPSec Negotiation? You could also do a Packet Capture for the same connection filtering for fragmentation since this could cause issues to your IPSec connection aswell. IKEv2 is the more efficient, secure and reliable protocol and you should prefer it over IKEv1. Regards, Fabian

FabianSchleef · ‎Jul 11 2023

Hi, thank you for your response. The risk doing this would be that no license migration from the global Org to China Org is possible afterwards, right?

FabianSchleef · ‎Jul 11 2023

Hi all, As far as I know, for regulatory reasons, it is necessary to create a separate organization at https://account.meraki.cn/ for locations in mainland China. I have a customer who runs several sites in China and connects these to Europe via MPLS. Theoretically they could provide the Internet breakout for the Meraki Dashboard traffic (Management Network) in Europe behind the MPLS. Then the site could also be operated through the customer's regular Meraki organization. The customer is planning to deploy MR access points only. Do you have any experience with this? How likely is it that the Chinese government will notice? Regards, Fabian

FabianSchleef · ‎Jul 9 2023

Hi, which browser are you using? Try downloading a pcap file with incognito mode enabled to make sure your cookies & stuff aren‘t the issue.

FabianSchleef · ‎Jul 9 2023

Hi, maybe you should get some VoIP Service consulting to get a scalable solution instead of doing network experiments. 🙂

FabianSchleef · ‎Jul 8 2023

Hi, This won‘t affect the MR upgrade process. Also upgrading your Switches from MS 14.33.1 is easy going. Just upgraded a whole customer organization from 14.33.1 to 15.21.1 yesterday without any issues.

FabianSchleef · ‎Jul 7 2023

Hi Kima, all MX devices will connect to the Meraki Auto VPN Registry with their current Public IP address. The Registry will provide these information to all MXs in your organization also connecting to it. So yes, dynamic WAN IP addresses are not an issue. https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshooting

FabianSchleef · ‎Jul 7 2023

Hi, I would shut down the whole stack. I‘ve never tested this on running Switches but this Link also recommends to shut them down: https://documentation.meraki.com/MS/Stacking/Switch_Stacks

FabianSchleef · ‎Jul 7 2023

Hi, sounds silly but factory resetting the device did the trick for me several times. Whats also helping sometimes (also silly) is switching from new to old Dashboard design.

FabianSchleef · ‎Jul 3 2023

Hi, if your MX is running in IPS mode with Security ruleset selected and if your firmware is up to date the SNORT engine will catch these for you. Had these at several customer sites and it was always catched by the MX. Regardless of the source IP.

FabianSchleef · ‎Jul 2 2023

Your Meraki MS120 switch doesn't need to have any IP parameters configured for your WAN circuit. You just need to configure a L2 transit VLAN (any unused VLAN-ID) on the interfaces facing the WAN-router and the MX WAN-interfaces.

Meraki

Community

About FabianSchleef

FabianSchleef

Community Record

Badges

Re: NAT type unfriendly

Re: Internal IP address of our Meraki FW

Re: Meraki AP & Radius Integration

Re: Access Points Coverage

Re: Site-to-site VPN issue inconsistent connection

Re: Options for a Chinese Meraki Site

Options for a Chinese Meraki Site

Re: MS250 pcap download issue

Re: meraki mx84 and mx64 vlan trunking

Re: MR Firmware Upgrade plan

Re: Cisco EZ VPN alternative

Re: Stacking Cable MA-CBL-40G-1M

Re: Problems registering devices to the meraki cloud

Re: Hammered with IDS alerts

Re: Is it possible for me to connect my internet link first to a switch (MS...

Re: Cisco EZ VPN alternative

Re: Access Points Coverage

Re: Stacking Cable MA-CBL-40G-1M

Re: Cisco EZ VPN alternative

Re: Site-to-site VPN issue inconsistent connection

Re: Hammered with IDS alerts