Meraki

Fady · ‎Oct 29 2023

In additional to what @PhilipDAth suggested, you can enable client VPN on those vMX to create a secure tunnel from your internet users (assuming those are your corp users).

Fady · ‎Aug 3 2023

@RobinsonRoca While I don't disagree that Meraki should have full functional vMX in a NAT mode and operate as a stateful firewall in the cloud but I don't see it deployed to terminate SDWAN tunnels, and you would still need to use vMX in the VPN concentrator state mainly because of routing. Currently, only VPN concentrators can be configured with BGP to exchange routes with your cloud environment automatically, and we have seen the adoption of Azure vWAN and AWS Cloud WAN, which are all based on configuring BGP; hence the need to consider a VPN concentrator in the environment. That is my 2 cents

Fady · ‎Aug 3 2023

I wouldn't consider or use OSPF as the route advertisements are only unidirectional -- From vMX to upstream, and you will need to manually configure the Azure ranges as local subnet in vMX. BGP is 100% what I would go for, and I would consider Azure Route Server to peer with. I didn't recommend directly peering between vMX and PA because Azure handles routing differently, and the traffic will have to hit the Azure SDN., which means you will still need to configure static routes in Azure route table for the traffic between vMX and PA.

Fady · ‎Jul 26 2023

Can you drop to MX17 and try again

Fady · ‎Jul 26 2023

Are you using MX18 firmware?

Fady · ‎Jun 26 2023

You need to create a transform rule with the below parameters.

Fady · ‎Apr 3 2023

Congrats @cyberdojoninja

Fady · ‎Jan 19 2023

My 2 cents SDWAN is not a replacement for MPLS. In my humble point of view SDWAN - Will keep the architecture simple (i.e. whether you have MPLS or internet or migrating from one to another, basically SDWAN will keep the architecture simple and scalable as it will build tunnel over whichever service you choose). - Will not need to exchange your LAN routes with your ISP (simplify operation). - Will expand easily to public cloud services (like AWS, Azure, GCP, Alibaba) - Scalable again. - Will secure your internet access as the SDWAN appliance is also a UTM. - Will also allow you to easily integrate with cloud security services (like Umbrella) as SDWAN is step one of SASE deployment.

Fady · ‎Jan 19 2023

Hi Andrew It seems you followed the correct steps, the next hop of the route in Azure should be - The next hop type is "Virtual Appliance" - Next hop address is "the ip of your Meraki vMX" I had some use cases that needed to forward all traffic from the branch to Azure and NAT out from there. I used Cisco virtual routers on top of vMX to perform NAT, you can follow the video and consider the LAN side of the Cisco router as your server farm. https://www.youtube.com/watch?v=MljINqgmDkM Let me know if you still stuck.

Fady · ‎Jan 18 2023

Hey Andrew, There are 2 solutions here Static Solution: Have the vMX in VPN Concentrator and you can either deploy it in the same VNET as your server or separately. If you deploy vMX in separate VNET then make sure to have a route table. The vMX default GW will be Azure wired IP and that is enforced by Azure. That default GW will be mapped to the route table that you will attach the VNET subnet to. Make sure to add the static routes inside Azure route table in both directions (towards vMX for remote SDWAN branches and towards other Azure subnets/VNETs) Add local subnet in your Meraki vMX for all your azure subnets to inject those routes into the site to site VPN. Dynamic Solution: Build Azure Route server to exchange BGP routes with vMX. In this solution, you wouldn't need to add local subnets in your vMX You still need to have route table attached to your vMX as Meraki resources are locked and Azure BGP routes won't be injected into the vMX NIC card. Let me know if you need more info and I will be happy to help you out.

Fady · ‎Mar 3 2022

Hi @rsweet , just wondering what type of integration with Aruba central and Meraki will be beneficial? If you are referring to Aruba ClearPass, then we already have integration with it. I agree that native integration with Azure will be ideal and I will have this as a feature request but till we have the native integration the detailed document I shared can be used as a workaround.

Fady · ‎Jan 24 2022

Check out this blog that was written by one of our brilliant engineers (Yuji) https://apicli.com/2021/12/13/meraki-mr-802-1x-with-azure-active-directory/

Fady · ‎Apr 8 2020

Hi viksep You will need to configure the RADIUS server under [radius client] section then under [radius server auto] you will need to input the MX details to act as a client. if you are running this DUO proxy on the same machine as your RADIUS server then please change the port of the proxy from 1812 because that is what I am assuming you are using for your RADIUS server already so DUO proxy has to listen to a different port to authentication users. Please check my short video of the integration but note that I used direct integration with AD instead of RaDIUS but the concept is the same. https://www.youtube.com/watch?v=0kmNsun48Wc&t=20s

Fady · ‎Apr 8 2020

Hi jfelix I have created a short video to show the integration between DUO and MX in case you still looking for the solution. https://www.youtube.com/watch?v=0kmNsun48Wc&t=20s

Fady · ‎Dec 17 2018

Meraki SD-WAN is feature that available on both Enterprise and Advanced so if you are looking for IPS, Content filtering, you will need to go with the Advanced license and this will still cover SD-WAN. Meraki Insight is additional license to the MX in general that you can buy on top of either Enterprise or Advanced license of the MX. In regards Cisco SourceFire and NGIPS, we keep integrating with Cisco product more and more whenever we see benefits to do so.

Fady · ‎Dec 16 2018

I am not sure if I get your question but could you elaborate more about the integration you are looking for?

Fady · ‎Aug 30 2018

Can you take snapshot of the NAT configuration you have applied. Thanks

Fady · ‎Aug 30 2018

Hi @onebill You can do double NAT where you configure 1:1 NAT and then use the LAN and WAN IP to be the same. The only thing that you need to confirm with your carrier, if they will route those 8 IP through the PPPoE connection.

Fady · ‎Aug 25 2018

Hi @Deba What is your issue with the vMX100?

Fady · ‎Aug 15 2018

Hi @Philip The best way to have public IP behind the MX100 is to perform 1:1 NAT --> (Double NAT-ting) so the LAN and Public IP should be the same on the NAT rule so when the traffic leaves the MX it will have the same public IP to the ISP. You need to make sure the public IP is route-able via the internet. https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX Please make sure to allow the remote IPs to allow the incoming traffic if you need these public IPs to be reachable from the internet.

Fady · ‎Aug 14 2018

I guess the question I have here, do you have a lot of inter-VLAN communication across those 30 VLANs?

Fady · ‎Aug 14 2018

Can I ask, why you need the default gateway to be the switch?

Fady · ‎Aug 13 2018

Correct, that is why I asked to point the default gateway to MX or the other option, to track users by IP and keep the default gateway to be the switch. Both scenarios should allow the group policy to be applied correctly.

Fady · ‎Aug 13 2018

Agreed, but because we are using Layer 3 switch, we should use IP tracking. Great Point @Philip

Fady · ‎Aug 13 2018

Actually, the source and destination IPs won't change so the MX will still see the traffic coming from the hosts IP but the MAC address of the switchport. But you are right, that we need to point the default gateway to the MX in order for the policy to be attached.

About Fady

Fady

Community Record

Badges