Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About cabricharme
cabricharme
Getting noticed
Member since Apr 19, 2023
yesterday
Community Record
47
Posts
9
Kudos
3
Solutions
Badges
Monday
(The server is refusing to power up (even BMC/IPMI) after I installed a 2nd dual port NIC - so all further testing is suspended until we resuscitate it.)
... View more
2 weeks ago
Thanks Ivan, I'll see if I can do it - but wanted to ask first: what would be my next steps based on the results of the capture? (And what exactly would I be looking for in the capture?) (The similar issues you've come across in the past - have they been posted to this forum, by any chance?) Thanks!
... View more
2 weeks ago
Yes, the 2nd NIC has a different MAC (for each of its two ports) - verified in Meraki and in the server's BMC, and in UEFI BIOS. Can't do much with the first server - like disconnect ports - until the 2nd is up and I can migrate VMs to it... 🙂 Will try v.17, thanks! (Probably not until Thursday.)
... View more
2 weeks ago
No, the server modules only share power supplies and a storage backplane (no shared storage either - just the backplane). The NICs are completely isolated from each other. @PhilipDAth wrote: For example, if you don't plug in the Ethernet cable to the second blade, can you still talk to the second blade? Definitely a "no" 🙂 (We run 20+ of these in remote locations so I am pretty familiar with them. This one is unique in terms of the specific NIC chipset, the motherboard and the CPUs - but it shares the architecture with all other TwinPros and BigTwins we are running.)
... View more
2 weeks ago
Thanks for the quick response! Everything on the network is sharing a single physical switch. There's only one physical switch at that location. No distributed vSwitches are configured. (Is that what you mean by "shared"?) Each has a separate (if identically configured) set of vSwitches. The ESXis do have identically configured vSwitches - which is necessary for VMotion. (All of our 40+ ESXis are similarly configured and we had no similar "flapping" issues until this one came along.) The "flapping" MAC address reported by Meraki belongs to the X710 NIC and not to any VM. The 2nd ESXi has no running VMs and thus, no VM on it can conflict with VMs on the 1st one.
... View more
2 weeks ago
A very weird issue with Meraki MS120-48LP starting to report "MAC address flapping" on multiple wired ports. I can't yet make sense of it. Suspecting incompatibility between the switch and the NIC or a bug somewhere. Anything I can do to zero in on the culprit short of installing a new NIC and disabling the onboard Intel X710-AT2 on the server? Notes: The device is Supermicro TwinPro SYS-120TP-DC8TR where each of the two server modules in a 1U chassis has a dual-port 10GbE NIC (Intel X710-AT2). One of the servers in the Twin is online (running ESXi 7.03) with both the X710 ports connected to the switch. Seems to be doing OK except relatively frequent and quite regular packet loss spikes: The moment the 2nd server in the Twin is powered up and the OS comes online (also ESXi 7.03), the switch starts reporting "MAC address flapping" - but not on the 2nd server - on the 1st one. (That's one of several baffling things about it.) Sample of "flapping" events in Meraki logs: Dec 5 13:33:07 **_Switch01 Ports 29, 31, 29 Switch port MAC address flapping mac: 7C:C2:**:**:08:74, vlan: NNN, port: 29,31,29 Dec 5 13:32:31 **_Switch01 Ports 29, 31, 29 Switch port MAC address flapping mac: 7C:C2:**:**:08:74, vlan: NNN, port: 31,29,31 Dec 5 13:32:11 **_Switch01 Ports 29, 31, 29 Switch port MAC address flapping mac: 7C:C2:**:**:08:74, vlan: NNN, port: 31,29,31 Dec 5 13:31:42 **_Switch01 Ports 29, 31, 29 Switch port MAC address flapping mac: 7C:C2:**:**:08:74, vlan: NNN, port: 31,29,31 Port 29 is connected to the working server - which seemed to work fine and generate no "flapping" issues prior to the 2nb server firing up. Port 31 - the 2nd server. (It's as if the 2nd server's NIC is telling the switch that it has the same MAC address as the NIC on another server?) If I disable one of the ports on the switch connected to the 2-port NIC on the 2nd server - no change, still "flapping". There is a thread on Intel forum from 2021 describing a similar issue with Intel X710 and Cisco 5672UP switch, and where switching ports, cables, SFPs, etc. - did not help. (It didn't in my case, either.) The resolution was "shutdown port" on the switch after which the issue went away for them. In my case, I "disabled" the port on the 2nd server several times - but not on the 1st one - as it's running production workloads and cannot be easily taken offline. Port 29 configuration on MS120-48LP in Meraki dashboard: Port status Enabled Type Trunk Native VLAN *** Allowed VLANs all Access policy Open Link negotiation Auto negotiate (1 Gbps) RSTP Enabled (Forwarding) Port schedule Unscheduled Port isolation Disabled Trusted DAI Disabled UDLD Alert only Tags none PoE Disabled Port mirroring Not mirroring traffic Thanks for any help!
... View more
Labels:
- Labels:
-
Other
Sep 24 2024
6:41 AM
2 Kudos
Turns out, "Blocked URL list" under "URL filtering" under "Content Filtering" had '*' for the entire network (not just this specific SSID, not any specific VLAN or device group). Not just on that network, either. Removing it resolved the problem. I'll have to dig around a little more to see why all the other SSIDs (4+) and wired devices across several VLANs worked, or why that particular SSID was working up until a few weeks ago, yet the root cause seems to be a bad case of misconfiguration with multiple rules and policies in different places stepping on each other where which rule takes precedence is unclear. (While troubleshooting this, I was wishing for something like Active Directory's "resultant set of policy" tool that gives me a prioritized list of rules and policies applied to a specific entity or a set of them. Makes it much easier to troubleshoot issues, especially when multiple rules with overlapping scopes and restrictions are scattered across OUs. (In Meraki's case, it's firewall, group policies, SSID-specific policies and rules, content filtering, port configuration - which can all step on each other and where the result can be quite unclear - like in our case.) That, and better log aggregation and querying. Is this too much to wish for?)
... View more
Sep 24 2024
6:11 AM
Thank you, appreciate the comment. The DNS was internal servers (and working) via DHCP (i.e. no manually set DNS specific to this SSID), the location is in the US, no L7 rules. Turns out it was content filtering ("blocked URLs") set to * for the entire network (not just WiFI, or a specific SSID. The entire network with lots of internet-accessing wired and wireless clients.)
... View more
Sep 23 2024
12:53 PM
Is there a troubleshooting checklist for a WiFi network that has next to no internet connectivity? I.e. steps to run through to isolate or eliminate specific potential root causes, from bad DNS configuration, to misconfigured firewall or content filtering settings, to APs acting up, etc.? run a trace route on a random web destination, see what it shows, where it takes me? 🙂 (Haven't tried that yet.) Context: 20 retail locations each with similarly configured Guest WiFi - yet only one location has the issue 4 MR42 APs (v.30.6), MX64 (v.18.107.10) at this location (similar to others) this is a Guest WiFi, isolated from the rest of the network, with mostly default settings (from what I could tell) no red flags or warnings in "Wireless Health" or elsewhere (from what I could tell) it does not appear to be any sort of a DHCP exhaustion issue (10.0.0.0/8 DHCP pool with one IPv4 client successfully connected at the time of testing) when I say "next to no internet connectivity" for this specific Guest SSID, I mean: no errors on this WiFI network like "no internet" on Android or iOS devices Google.com shows up fine, with the usual search bar and the newsfeed trying to run Chrome's built-on "speed test": "looks like the speed test is too busy" or something like that some other random sites (e.g. Ookla speed test): "cannot be loaded", "connection reset" errors seemingly most sites don't work MS Outlook and MS Teams messages sometimes go through, sometimes hang for hours and days before getting through on a cellular network or a different SSID - i.e. there seems to be some connectivity, especially given that google.com come up there was a bunch of changes and activity on the wired network across all locations setting up site-to-site VPNs and static routes - possibly something went haywire there (I managed to fix a "no internet" issue for a different SSID after tracking it down to SSID-specific traffic "deny" rule blocking traffic to local DNS servers - which apparently was in place forever but only started blocking that traffic after some other change on the network. That "some other" change like to do with that flurry of S2S VPN and static route changes and updated) What I've tried: checking all tabs in "Wireless Health", going through "connection log" with a fine-tooth comb hunting for any errors - seeing nothing. "Overview" - all green "Connection log" - a few association errors (wrong passphrase) - common for a fairly well trafficked location with random devices trying to connect w/o knowing the passphrase. But otherwise - nothing there. Thanks!
... View more
Labels:
- Labels:
-
Other
Aug 24 2024
5:35 PM
Did you end up using Datadog, @FlorianDewilde, or something else? (Would love to use Azure Log Analytics or a similar time-series store with a decent QL - like Prometheus and PromQL but that's seem to be an option yet?)
... View more
Aug 24 2024
5:17 PM
[...] it seems like you are mainly focused on events. Correct. I.e. don't need "visual" or "simple to use" but rather - a splunk-like QL for Meraki events that is simple to set up and maintain and ideally wouldn't require me to set up some sort of a forwarder (like a syslog server). (E.g. all that Datadog seems to need to start receiving logs into their system is an API key. That's already much better than setting up a syslog server.) In other words, the main question remains: What is the simplest way to use a decent Query Language for Meraki events? Perhaps it's Logic Monitor or Datadog or New Relic - or Splunk, all of which have integrations. But which one, in terms of QL maturity and overall value? (Ideally the answer would come come from someone who has tried a few and zeroed in on something that worked.) Thanks again!
... View more
Aug 21 2024
10:03 AM
Basically I am looking for a Splunk-like tool for Meraki events across 20+ networks and MX devices, 60+ switches. Given I have next to zero money aka budget (that I know of, haha), and next to zero time to maintain that tool (wearing lots of other hats) - the focus is on the simplicity, ease of maintenance. (Splunk is a bear to maintain - and can get expensive fast.) Need something simple yet where an SQL-like query would give me a fast answer to "top 10 networks with most site-to-site auto-VPN failures" and then chart the results over e.g. 3 years. If you have a suggestion, please include a screenshot (or a link) to a dashboard or report (or other KO) example of how this tool actually works, what results it produces. Context: Given Meraki's focus on ease of use and putting everything in the cloud, I was surprised to find out just how limited event search in Meraki is. Can't search for specific strings or regex in the events. Can't search across 2+ networks. Can't even export a full CSV of a specific log, or all logs. (Seriously?) Forget any sort of analytics other than what Meraki dashboards already provide. Given the (event) data is already in Meraki cloud (even if with very limited retention), I thought maybe there are good integrations with other cloud-based analytics and o11y tools - Splunk, Azure Log Analytics, Datadog, New Relic - that use the data in place... Authorize, connect, and Bob's your uncle? But... no: there's not a single one letting me search the existing data in place - must forward first to a different tool with its own storage. Hmmm, OK. There are some integrations like Cisco Meraki connector for Microsoft Sentinel - yet that is anything but simple: set up a syslog server, Sentinel agent, all that - apparently with a number of seemingly critical issues that (a) make the solution anything but simple and seem to be a recipe for a mountain of technical debt, and (b) require a purchase of another product we don't have (Sentinel) and not sure we need. there're Splunk Web Add-on for Cisco Meraki, and Splunk Add-on for Cisco Meraki, both with very sparse information - e.g. no examples of KOs, reports, dashboards - and I am hesitant to spend weeks or months on setting up a POC, only to find out there're insurmountable limitations. P.S. Please help me with the subject / title of this thread. What should it be if I am looking for a substantial upgrade to Meraki's current event retention, querying and analysis functionality? "Log aggregation" doesn't quite sound right. SIEM? This isn't about security - more about o11y and analytics that's not limited to security. Thanks!
... View more
Labels:
- Labels:
-
Other
Jul 19 2024
5:01 PM
If we can make it secure enough, allow RDP-ing into that VM (with only RDP traffic allowed) I'm pretty sure CVE-2019-0708 would work on Windows Server 2000 and an EOL patch was not released, allowing RCE on that box where a threat actor could easily pull the AD creds of users and further exploit your environment. I would not recommend this. Thanks for the comment, understood. This doesn't quite apply to my situation and goals. The RDP access will only be open to specific IPs. Not to the entire network, VLANs or subnets. Just IPs. The server isn't domain-joined, there's nothing to pull. It'll be powered down most of the time, awaken only on request. It's read-only in a sense there's no new data written to it. If someone malicious manages to get in, and it goes up in smoke, no biggie. Restore a month-old version from backup or a snapshot. The security part isn't to protect that server, it's to protect the network in case the server is already loaded with malware. Far as I can tell, the precautions I am taking with everyone's help here would keep this setup reasonably secure. In terms of your kind suggestion to finally retire the damn thing: sounds like you're fully behind the idea of reducing technical debt and minimizing high effort useless tasks. Me too! 😎 Thanks again!
... View more
Jul 19 2024
12:07 PM
Could someone please say something about my proposed plan in the OP so I could accept it as a solution? Something like: The plan looks good with some concerns or side effects (list them please if you can). (I think @alemabrahao meant to say this with this reply - but can't be sure as he didn't explicitly say, "looks OK, except your 200 bullet points can be boiled down do just two.) The plan is not secure enough to my 👀 and here is why (list concerns) something else Thank you!
... View more
Jul 19 2024
12:00 PM
Thank you - I am relatively new to Meraki (about a year) and only dealt with networking and VLANs occasionally in the past - yet a sort of a general impression is that for transparency and visibility, it's better to keep the configs in one place - on the MX (if it doesn't add too much overhead). The other thoughts are: if we can make it secure enough, can we connect that VM to a shared printer on a different VLAN instead of dedicating one to it, given it's only being used once in a blue moon? (I know, it's not what I said in the OP - but I can change my mind, can't I? 😊 If we can make it secure enough.) if we can make it secure enough, allow RDP-ing into that VM (with only RDP traffic allowed) Thanks again - I wasn't aware of this possibility of avoiding any configuration changes on the MX.
... View more
Jul 19 2024
11:51 AM
2 Kudos
@cmr wrote: Does the host have any free network ports? If so connect the VM to a VMware switch that maps to that port. On the switches create two access ports on the new VLAN, don't create an interface for it. Connect the host NIC to one port and the printer to the other. No risk of traffic getting outside of that. Plenty - something like 8 (Dell R740, 4 10Gb SFPs, 4 1Gb RJ45 - I didn't buy them 🙂 but hey it's nice to have spares) - but don't want to tie the VM to a specific ESXi in a cluster of 4 and occasionally 5 or 6 when we're testing new ones. (Good thought though - I'll come back to it if the original route ends up in smoke or is not secure enough.) ("On a vSwitch, will travel" is my preference vs. mapping a VM to a physical NIC, which ties it to a specific ESXi.)
... View more
Jul 19 2024
11:45 AM
Right - or USB passthrough was my second thought. No idea what support for that looks like on Server 2000 though... Don't want to tie the VM in to a single ESXi - but can try it if it comes to it. (Good thought.) My other thought is do users need to access this server? If so, OP's proposed solution will not work, and the server will only be accessible through VMRC... What's wrong with giving select AD users access to specific VM's VMRC? (Seems to be working well although RDP is preferred of course.)
... View more
Jul 18 2024
11:54 AM
Thank you. Is it safe to assume that the following is then the best (so far) answer to the original question? I.e. the answer to the OP question ("what is the best practice...") seems to be a "no, Meraki does not appear to offer a good, simple way to connect a non-Meraki VPN peer to auto-VPN sites, however the simplest way to do this is using a non-Meraki S2S VPN gateway - especially if the number of auto-VPN sites is large enough."
... View more
Jul 18 2024
11:49 AM
@alemabrahao wrote: Don't you know how to create a L3 security rule? https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings#Outbound_rules Ouch.
... View more
Jul 18 2024
10:27 AM
@alemabrahao wrote: Create a security rule denying any and above of this rule create rules for what you want to allow. Thank you. Which question are you answering with this? This is the main one: How does one isolate (air-gap) a VMware VM yet allow it to print, using a Meraki stack? Ideally in a series of easy-to-follow steps vs. "go RTFM". (Highlighting mine.) This is the follow-up one: Do the above steps do what's needed, to fully isolate the VM with the exception of talking to a printer? Did I miss anything obvious (or not so obvious)? (It's two questions - yet both still boiling down to, "did I miss anything?") Thanks again - and apologies for needing precision and well defined steps as opposed to "being pointed in the right direction".
... View more
Jul 18 2024
9:40 AM
Sorry that I am not entirely following. You configure the non-meraki VPN once, and any branch that is configured in the Availability option, will build an individual IPsec-tunnel. With that you have a very small config even for a large amount of branches. Doesn't the idea of building individual tunnels to each branch contradict the idea of a "very small config"? I.e. could a set of 20+ individual VPN tunnels be called a "very small config" even if they're configured similarly? (We are essentially asking the MSP to build and maintain a fairly large number of individual tunnels on their side - all because we on our side can't route single VPN tunnel traffic to/from our branches? That doesn't quite make sense to me.) Your non-meraki VPN-Hub still needs to be configured to accept the session from all branches. What is a "non-Meraki VPN-hub"? I've poked around searching for it, and not seeing much. Native Azure VPN gateway SKUs all seem to be site-to-site, i.e. there isn't a way to configure a single one to connect to multiple endpoints in a hub-like fashion., and you pay separately for each one you set up. Similarly, most other S2S VPN gateways seem to be set up in a similar fashion: separately configured individual tunnels vs. anything resembling a "hub". P.S. It seems (to this VPN/networking rookie) that setting up one VPN tunnel from our HQ to the MSP using non-Meraki tech e.g. a standalone Aruba S2S appliance is all there should be to it: Meraki will see it as a direct-attached subnet, and thus allow to route traffic to/from it, including to/from Auto-VPN sites the MSP only has to maintain one tunnel we only have to maintain that one appliance and the associated tunnel with its routing and ACLs (At least that's what I am seeing suggested on the interwebs when searching for "connect a non-Meraki VPN peer to Auto-VPN sites".) P.P.S. Granted, the above (using a non-Meraki VPN appliance configured outside of Meraki) falls outside of the OP question scope: What is the best practice to connect a non-Meraki VPN peer (e.g. our Azure or AWS services) to our auto-VPN sites (networks)? ... but then so does the vMX. I.e. the answer to the OP question ("what is the best practice...") seems to be a "no, Meraki does not appear to offer a good, simple way to connect a non-Meraki VPN peer to auto-VPN sites, however the simplest way to do this is using a non-Meraki S2S VPN gateway - especially if the number of auto-VPN sites is large enough." Thanks!
... View more
Jul 18 2024
9:17 AM
How does one isolate (air-gap) a VMware VM yet allow it to print, using a Meraki stack? Ideally in a series of easy-to-follow steps vs. "go RTFM". (Trying to translate documentation - e.g. Switch ACL Operation - and related threads - e.g. Isolate vlan from all other vlans! - into actual configuration steps.) The task is to "air-gap" a VMware (ESXi / vCenter) VM yet allow it to print to a physical printer on a network. The printer can be dedicated to the task, i.e. it does not have to be shared with any other devices for printing. The VM is a P2V'd Windows Server 2000 machine (presumably vulnerable, presumably even running malware) running an old LoB application that occasionally needs to be accessed and records from it - printed out. The stack is MX100 with MS switches, a few ESXi 7 servers, vCenter 7. So far the plan is: VMware: Create a vSwitch (vCenter / ESXi), set it to a unique VLAN that's not used elsewhere. E.g. 2001. do not (yet) connect the VM's NIC to it: the VLAN is not fully isolated yet - not until the MX is configured to stop almost all of the traffic flow to/from it Meraki MX: Connect a network printer to a Meraki switch port, "access" type, VLAN 2001, port isolation: disabled (no point given port isolation won't stop traffic flow within the vSwitch, or between VLANs?) Create a "deny everything" Group Policy, name it something like "VLAN 2001 printing only" Create a new VLAN on the MX ("Security & SD-WAN" -> "Addressing & VLANs" -> "Routing" -> "Add VLAN", give it a non-routable subnet with the smallest range possible (e.g. "VLAN interface IP" of 10.201.0.128, Subnet 10.201.0.128/30, then give the VM and the printer .129 and .130 IPs) assign the above group policy to it Now connect the VM's NIC to the vSwitch configured above, configure IPs on the printer and the VM, try pinging the printer's IP from VM, confirm no ICMP response create an "allow" rule in the GP configured above allowing ICMP traffic from the VM to the printer (and back?) try pinging again, confirm it's working modify the "allow" rule configured above to include TCP/UDP traffic testing printing Do the above steps do what's needed, to fully isolate the VM with the exception of talking to a printer? Did I miss anything obvious (or not so obvious)? Thank you!
... View more
Jul 12 2024
7:36 PM
vMX is not always an option with MSPs. In our case - not (yet) an option. The goal is to make it work between a non-Meraki peer and auto-vpn peers. Performance requirements are negligible.
... View more
Jul 12 2024
1:29 PM
What is the best practice to connect a non-Meraki VPN peer (e.g. our Azure or AWS services) to our auto-VPN sites (networks)? Seems this cannot work purely within Meraki: Auto VPN and Non-Meraki VPN peers An MX Security Appliance can establish tunnels to both Auto VPN and Non-Meraki VPN peers. The MX will send traffic to those VPN peers using the principles discussed above. However, an MX that builds tunnels to both Auto VPN and Non-Meraki VPN peers, will not route traffic between the non-Meraki VPN peers and other Auto VPN peers. ... yet this seems a fairly common SD-WAN configuration for any org with multiple branches and hybrid or MSP-managed environment? P.S. The other parts I can't seem to wrap my head around: why is there an "availability" configuration in non-Meraki VPN peering settings? Just in case remote networks aren't connected via auto-VPN but via some other mechanism? when "availability" is set to "all networks", the non-Meraki VPN peer is lit up green on the network where it's configured, and red on all others. Is this Meraki way of saying, "we don't support this configuration even though our UI provides no indication that it won't work during configuration"?
... View more
Jun 13 2024
2:01 PM
I hear you on simplicity, security and reliability. One reason to use a switch like that is because we have it... 🙂 The other - to counter ISP's assertion of "you have a lot of errors on your side" and get port error stats from a switch that can collect and report them. (Generally, get a little better visibility into WAN traffic.) Yet another: ease of configuration and testing. Configure two ports for one ISP circuit, another two - for the 2nd one, another - for a cellular uplink, isolate them all, see them all...
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 446 | Sep 24 2024 6:41 AM | |
| 1216 | Jun 13 2024 1:47 PM | |
| 1817 | Mar 28 2024 4:44 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 446 | |
| 2 | 1891 | |
| 2 | 1216 | |
| 2 | 1216 | |
| 1 | 1515 |
© 2024 Cisco Systems, Inc.
