Hot answers tagged

7

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a ...


6

As per IEEE 802.3 Clause 38, 1000BASE-SX requires OM2 (500 MHz·km for 850 nm) for max. 550 m reach. As a superset, OM4 is fine as well (there's little point buying OM2). With 10GBASE-SR the reach over OM4 is reduced to 400 m, so you're also good for an upgrade later on. There's also OM5 but it's only for higher speed WDM, not for longer reach with 850 nm. ...


4

It is the standard that you look for. In this case, it is 1000BASE-SX. Both of those transceivers use that standard, so they are compatible. It is much the same as Intel and 3Com 1000BASE-T copper transceivers that you would use on a copper-wired connection; as long as the transceivers use the same standard, they should work. You can connect two switches ...


3

802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the authentication server. The higher layer protocol can be switched and routed as desired. You cannot use 802.1X authentication across several switches. Essentially, ...


3

Merakis are managed via a centralized system hosted in the cloud. DNS is the way by which the Meraki endpoints (...whether switches, firewalls, AP's or cameras) connect back to that cloud system. It's also key to said endpoints being able to reach alternate management points should failures or excessive load occur in Meraki's infrastructure.


3

I think your client is asking for your public IP address (static/Dynamic) provided by your ISP.Please check the authenticity of the request before providing the information(IP address) to your client. If your sales process includes a call to a third party payment gateway/Banking API then it makes sense. Sometimes when multiple clients with the same Public ...


2

Just to add to this, client outbound active FTP (Ron's first picture) is not supported as of December 2016 without installing beta firmware on the Meraki MX appliances. Check the first note on the Meraki documentation: https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Active_and_Passive_FTP_Overview_and_Configuration This is because Meraki MX ...


2

Cisco maintains documentation for this type of thing. It takes about 2 seconds to locate the specific document on how to do this. Active and Passive FTP Overview and Configuration: Active FTP Overview An active FTP session involves the following steps: The client sends the PORT command to an FTP server. The source port is a random, high-...


2

Based on your output above, this specific site is matching blocked category bc_057, so something is triggering it. Under Security Appliance > Configure > Content Filtering what is configured? Check for Web search filtering, Blocked URL patterns and Blocked Website Categories. If there is nothing obvious under Content Filtering, this may be being ...


2

What he needs to know is the publiv IP address(es) that will be used when clients on your wifi network make requests to services on the Internet so that he can whitelist them in his abuse-control system. Depending on your network setup that may be an individual IP address or it may be a range of addresses. If you are sure you only have a single internet IP ...


2

As far as the VLAN for access port 1, that looks like what you need. Depending on how you have STP configured on the network, you should think about using RSTP. Also, STP guard on the access ports may be a good thing to do. The default native VLAN is 1, but you don't need a native VLAN, or you can set it to any VLAN. This is only relevant for trunk ports.


2

Spanning tree is to prevent layer-2 forwarding loops. It only works if you have multiple bridges (switches are bridges) connected. It works by forwarding frames toward the root bridge, thus preventing loops. If you connect each switch (bridge) to a separate layer-3 interface on your firewall/router, then you have no need for STP, but if you connect your ...


2

Other than the addition of 256-QAM [MCS 8], and (optional) 5-8 streams, you are correct. 802.11ac's advantages are small when limited to 20MHz. In the 5GHz band, there's no real reason to limit it to 20MHz. There's plenty of channels and not a lot of overlap. (which is why 160MHz is even possible) [See Also: Data Rates and Speeds Table (Wikipedia)]


2

"LAN workstation" is in the 192.168.213.0/24 subnet - the same subnet you're using for "BAY x LAN". That is a very bad design. Unless you are using destination NAT and source NAT between those locations, no communication is possible. Likely, you're using destination NAT from LAN workstation to reach "Device N", but without source NAT "Device N" tries to ...


2

As it turns out, Passthrough Mode on Meraki will not work behind an ASA. The Meraki will not forward traffic through the ASA, so TCP handshakes are broken, ie the VPN traffic sends SYN straight to the networked machine, but the networked machine responds back through the ASA, and the ASA drops the packets because it didn't get the first SYN. (The Meraki ...


1

I believe I have found the problem based on how you have described your configuration, but your description wasn't sufficient to provide the information I needed to notice the problem. I ended up creating a new demo account with Meraki, because I don't currently have an active Meraki installation I can access (my own demo accounts are tied to hardware with ...


1

You're looking for "1:1 NAT": https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX


1

Okay, so aside from posting here I forwarded config scripts to a few network guys at Region 5 Education and they found the error. On the EX-4300, which is between the EX-4600 and the HP-5130, I didn't do: set vlans JHStu vlan-id 270 set vlans JHFac vlan-id 280 set vlans JHFacBYOD vlan-id 288 I had everything tagged/trunked on the ports, but the ...


1

Your configuration looks correct from a dhcp-relay perspective. If swapping the VLAN for 236 works, then the issue may be with the DHCP Scope for those two subnets on your DHCP server - check that your subnet mask on the server matches the irb interfaces that you have defined on the EX.


1

Not currently supported. This is likely due to the fact that AnyConnect establishes an IPSec Tunnel based on IKE v2 whereas the MX appliance (afaik) still uses IKE v1 for negotation.


1

Meraki MX routers do not support Cisco Anyconnect. If Anyconnect is a requirement I'm afraid you'll have to stick with Cisco branded routers.


1

Assuming you are trying to use 802.1x to allow or prevent communication by a client through a given switch port (i.e. Port Access Control as defined in the 802.1x standard) the scenario you describe doesn't work. The standard explicitly states that : "The operation of Port-based Access Control assumes that the Ports on which it operates offer a point-to-...


1

Having used undersized routers for a while myself, I found that the most precious resource in an access router (besides bandwidth) is free memory/free space in the connection tables. Monitor the current number of connections for TCP and UDP, the amount of free memory and how they relate to the loss ratio. My bet is that once you cross a certain boundary, ...


1

Answer I wound up realizing that MAC-based VLANs isn't really what I wanted, and that Group-based VLANs are actually much more flexible. From here on out, the information will regard to accomplishing VLAN assignment based on group membership. Bench Test I followed this really great guide published by Meraki. It is 99% generic so if you're not a Meraki ...


1

Here are the general steps on the Cisco switch: Define VLANs 10 and 20 on the switch Configure the port connected to the Meraki as a Trunk port, with VLAN 1 as the native VLAN (should be the default). Allow all VLANs on that port. Configure the port connected to the device as an access port in VLAN 20 Change the management VLAN on the switch to VLAN 10 For ...


1

I would segment the VLANs based on the local structure. e.g.: Floor Level1 => VLAN101 Floor Level2 => VLAN102 This is a quite static approach in segmenting your network and much more simple to implement than using group policys. In my opinion troubleshooting is also simplified in this approach. Group policys are great for an organisation-based ...


1

Both of those IP addresses resolve to iad30s07-in-f14.1e100.net (using nslookup). Also, Why would some machines resolve to one while others to the other (unless you have multiple locations, maybe)? Either way, they're hitting the same box. Curl will misleadingly connect to a RESTful API (a website) while your browser may fail to connect to that same ...


1

I found the issue, it has to do with the device itself, specifically an Meraki MR42 AP. When the 802.03at Meraki APs first powers up, it does so in 802.03af mode, thus limiting the power it can draw. Then later in the boot sequence it tries to request more power to be delivered, and for some reason the HP switches does not understand to give it the full 33 ...


Only top voted, non community-wiki answers of a minimum length are eligible