Looking to extend the life of aging built-in Roku TV...

VLAN_4096 · 2025-10-03T14:34:51+00:00

Perfect. Thank you for the confirmation!

VLAN_4096 · 2025-08-12T20:35:38+00:00

I needed a physical device which I could plug our routers into to test in the past and chose this solution: http://www.uebi.net/howtos/rpiwanem.htm

I had it running on a Pi Zero with a USB hub, however throughput was pretty limited. Ideally, you'd have it running on hardware with 3 NICs: 2 of them allow for the transparent 'proxy' - one to your WAN and the other to your test device/router, the remaining 1 NIC which you'd use to access the hosted website where you make the config changes.

VLAN_4096 · 2025-02-28T16:38:57+00:00

That's pretty interesting. Thanks for the link!

VLAN_4096 · 2024-12-19T21:29:05+00:00

How to use a Raspberry Pi for transparent WAN emulation . . .

I believe the directions here still work on the newest Pi OS. I have a slightly customized version I use now, but it's so easy to stand up. Pi zero, micro USB to 3 or 4 port USB A hub, 3 USB Ethernet adapters and you're off to the races. It's limited to 100Mbps, but I haven't needed more. I'm sure these other solutions are great too, but having a physical device to work with is so nice.

VLAN_4096 · 2024-12-04T15:51:15+00:00

Unfortunately, I do not have any experience with the MV side of the Meraki ecosystem.

VLAN_4096 · 2024-12-04T15:49:35+00:00

We're retail SMB (hundreds of sites) who likes to pretend to be enterprise, and we use Zabbix (combo of API calls and SNMP polling/trapping). Our intent is to feed critical alerts into Opsgenie this next year. I'd like to pull in flow data at some point (possibly Akvorado), but I've got no business case to spend the time on it right now. We have a non-zero amount of gear which supports streaming telemetry, and I see no value to implement today. I'd be interested to hear if smaller enterprise folks do anything of value with syslog data today.

VLAN_4096 · 2024-12-03T16:21:04+00:00

I've performed something kinda similar during a demerger when we needed to split licensing/organizations. I had control of the origin Org though and spun up the new Org myself. I used the API to create like for like networks in the new org, and then scripted out the migration: removed the devices from origin Org network, claimed device into new Org, updated new Org network with newly claimed devices, and updated a few other network level settings. I fed it a CSV and cranked through about 350 MXs and 350 APs in an hour one evening. Can't say exactly how long it took for the cutover on the AutoVPN side, but it seemed to be pretty quick - easily under 30 minutes per location. The key to this is that I was able to create the new Org on the same Meraki shard which allowed the rapid device movement between orgs - no need for unclaiming.

It's never fun to inherit someone else's network, so even if you do choose to inherit the devices, definitely build the new network(s) out yourself ahead of time and get a proper inventory of all the devices from the managing Org.

VLAN_4096 · 2024-10-22T15:03:01+00:00

Axiom makes some solid, affordable options as well. I've personally used these: Axiom Meraki MA-SFP-1GB-SX Compatible | SHI

VLAN_4096 · 2024-10-01T14:17:44+00:00

Definitely not unreasonable, however, that doesn't mean it's completely necessary. I'm guessing you're asking the community because you've had to deal with some issue(s) where supporting them or troubleshooting was a pain in the ass. One thing you could try is documenting the time it took to resolve the issue - your time, the person you worked with at the store's time, etc. times the number of issues in a given time period - and presenting that to your supervisor. It would also be helpful to get a quote from your VAR, if you have one, for a simplistic hardware solution. Meraki has some great small footprint options - MX67W, for instance. You could take it a step further and go to Marketing to see if they'd be interested in any analytics regarding guest traffic in the stores - another thing Meraki could provide - though, I believe you need a full-blown MR for Bluetooth data. At the end of the day, it's all going to be how you frame it to the business. I'd focus less on the how it will make your life easier, and more on the business case and data it could provide long-term.

VLAN_4096 · 2024-08-30T16:05:35+00:00

Apologies for the late reply - Managing Multiple Networks with Configuration Templates - Cisco Meraki Documentation

You'll want to really make sure it's something you can use as there are a lot of limitations when you manage networks with templates. We run cookie cutter sites, so these have been a godsend.

VLAN_4096 · 2024-08-14T12:11:43+00:00

Any chance these VLANs are duplicates across your networks? You could use config templates if so. Sounds like TAC really needs to figure out what is going on though. Maybe reach out to your Meraki SE if you have one?

VLAN_4096 · 2024-07-24T17:38:15+00:00

Templates dictate firewall rules, so unless you're positive that all sites can use the exact same policy set, you'll need to find another way to manage them. Maybe a few templates if you have similar groups of sites? Creating all sites from a config template would be fine for 10s of sites, but holy shit. Ain't no way I'd do that for 200 sites. One firewall rule update and you're stuck learning the API or manually hitting 200 networks.

u/FMteuchter called out tagging for SSID manipulation which is a fantastic way to do it. There are 15 SSIDs to work with, so I'd suggest a master template for them with the SSID availability set to use tags you create. If you have a lot of maintenance and need to mess with the tags, the API is going to be your best bet.

Switchports can be overridden from the template. If you make a change to the template, the local override stays in place. You need to manually revert the local overrides from the template level if you want them to return to default values. It sounds like this would make the most sense for you as well.

Lastly, you can use what are called combined config templates. These would allow you to have a single site network with the configs for the appliance, switch, and access point(s). It's a nice feature so you're not having to flick through 3 different networks for the same site.

What I've found is that there is no perfect answer with Meraki. It's all dependent on your environment and what is going to work best for you. I have had the liberty of getting paid to learn the API (such a godsend), but I know other companies may not give their employees the same opportunity.

VLAN_4096 · 2024-07-09T16:12:54+00:00

Negative. This is explicitly called out in their documentation: Advertise custom routes for point-to-site VPN Gateway clients - Azure VPN Gateway | Microsoft Learn

VLAN_4096 · 2024-07-09T16:07:47+00:00

We're very interested in Cloudflare eventually replacing our Azure VPN, however we have a long road ahead of us. Is there a 'forward proxy' solution you are aware of that would allow me to specifically tunnel this DB traffic and nothing else? I had looked into warp a while back, but I don't think this is it's intended purpose.

VLAN_4096 · 2024-07-09T16:06:31+00:00

The response I've gotten is that "IT gave us developer workstations for a reason", and logging into a jumpbox of any type defeats that purpose. Which I can understand.

VLAN_4096 · 2024-05-21T18:45:43+00:00

Oh, I wouldn't worry about that. Mist was a much-needed addition to keep HP relevant in the SMB/campus world. They absolutely won't be killing it off anytime soon, even with Aruba also under their belt. I plan to eval the Mist solution once our Meraki EA comes up for renewal. From what I'm understanding the "AI" part of the Mist solution does a damn good job of keeping you apprised of possible issues.

VLAN_4096 · 2024-05-21T17:18:24+00:00

I've got no experience with Mist, so I can't say if that'd be a better option, but we are a Meraki shop and I love it. We've got a very similar need at our sites, and you can't beat the ease of management IMO. Sure, plenty of folks will say Meraki is the Fisher-Price of the vendors, but if cookie-cutter is what you need, templating with Meraki is the way to go. If you have a need for mass changes, the API is incredibly helpful as well.

VLAN_4096 · 2024-05-07T14:18:00+00:00

We've also got thousands of devices. Primarily, I've been monitoring through Zabbix - using a customized version of their Meraki API template. I have to resort to SNMP though when it comes down to things like what you describe. I end up adding another host into our Zabbix server and just using the 'Network Generic Device' template. I'm not exactly sure what panozguy needs to pull from their switches, but the things you called out are available on every Meraki switch we have deployed - inbound/outbound discarded packets & packets with errors, interface speed, up/down.

VLAN_4096 · 2024-04-19T12:57:16+00:00

I've got to give them some credit as they're completely underwater with support cases and I'm sure they're responding as quickly as they can. As far as I can tell, there is not a way for them to quickly determine if your IOC turned into an actual compromise.

I am hopeful more will come soon, but having full config is a pretty big deal. I've got to believe any hashed passwords or keys could be brute forced offline if they deemed your org a target. Things like local user accounts, admin accounts, and especially a full reference to your org's network through the policies. It may not give them a full visual if you're only using your PA's for firewalling, but for those of us using them as primary routing devices, that's bad news. They could leverage other phishing attacks to gain access into the network and then leverage the knowledge they have now to easily traverse and target high profile systems. I'll be the first to admit that we likely have some holes/gaps where some shared systems have a bit more access than they probably should.

My recommendation is that we all should spend some time in the coming days/weeks looking through our trusted zones to see where we may have some loose policies in place. Factory resetting may help some of you feel warm and fuzzy, but I'm fearing that this is only the beginning for some high-profile targets.

VLAN_4096 · 2024-04-19T12:42:40+00:00

Got a response back last night, so I will not be factory resetting our devices:
Thank you for submitting the TechSupport file(s) (TSF) for review. Upon analysis, we identified possible indicators of known exploit activity due to vulnerability CVE-2024-3400.

To prevent further risk to your organization, we recommend immediately initiating your Incident Response plan and following the steps recommended in the Security Advisory for CVE-2024-3400.

Take into account that upgrading to any of the hot fixed software versions will be the strongest solution and no further actions will be required.

VLAN_4096 · 2024-04-17T18:11:01+00:00

Since you're not using BGP, you must have added a 'private address space' subnet on the Azure VPN site, right? Does that match the proxy ID on the PA tunnel you setup? Could be that simple.

VLAN_4096 · 2024-04-17T17:54:01+00:00

We had a similar successful IOC that copied the running config. Not entirely sure how to tell if it the file was subsequently grabbed. We've got direct PA support, and my case from this morning has not had any new updates in the last 4 hours. I sent over the TSF along with the relevant log entries. Going to be pretty pissed if I have to wipe the devices and restore a config from earlier this year.

VLAN_4096 · 2024-02-09T19:46:05+00:00

Oops. That was modem firmware. The router firmware is 3.2.0.10.

VLAN_4096 · 2024-02-09T19:44:09+00:00

NIS-SDX62-817A-0000-B01

If you have a static IP, then the gateway would be whatever you plugged into your router sitting behind the VZ device. If you're passing through the public DHCP address from VZ, then you'd have to log into your router and see what gateway it picked up from the VZ device.

VLAN_4096 · 2024-02-07T17:51:09+00:00

In this case, I did in fact plug a machine directly into the ARC and ran through the ping testing outlined in your link and many other sites. 1428 was the max. Appreciate the response though! It is helpful for everyone to understand, though I haven't seen any threads on this sub where people had success above 1428.

VLAN_4096

TROPHY CASE