Meraki Switches and Smoothwall

[timbo343]

One of our primaries has had a CtC and they have put in Meraki switches and APs. Never have i had so much faff with a network.

 

The primary is using a Smoothwall and since the smoothwall was restarted, the switches are unresponsive via the meraki dashboard.

 

I've tried restarting the smoothwall several times however this is not the first time this has happened. In the past i have had to pull the power lead out the back of the switches and do a hard reset - this time im unable to get to site.

 

Can anyone tell me why these awful switches are performing this way?

[snagrat]

Are the switches on the same VLAN as the WAN?

[timbo343]

We were asked to provide internal IP addresses on the main network for the APs and switches so the smoothwall and switches are on the same range. I've got 3 of the 4 switches on just by continuously rebooting the smoothwall.

[snagrat]

Ok that’s correct then.

 

Sounds more like a Smoothwall issue. The switches only need UDP/7351 open to communicate with the dashboard

[timbo343]

Ok that’s correct then.

 

Sounds more like a Smoothwall issue. The switches only need UDP/7351 open to communicate with the dashboard

 

I have a firewall rule to say that any of the meraki switch IPs can talk to anything on any port. I'm seeing a lot of ICMP traffic to 8.8.8.8 as the primary DNS on the switches are the onsite DC and the secondary DNS is 8.8.8.8.

[timbo343]

After having 3 of the 4 switches on, i rebooted the smoothwall again and now none of the 4 are saying they are online - what a bag a shite!

[timbo343]

Having managed to get all 4 switches on, the 27 APs are reporting they are on or off.

 

We are running Leeds 76 on the smoothwall and it's strange how the smoothwall cannot ping the devices which are showing offline but then the DC on the same LAN can ping the APs.

 

Is this a Smoothwall problem?

[Aprice]

Also would suggest your problem is likely the Smoothie,

 

Double check your firewall rules and make sure that UDP 7351 is allowed.

 

Another thing to do is open up the real time firewall logs on the Smoothwall, plug in the address of one of the switches into the source address. Give the switch a restart and look at the results. If the packets are being dropped / blocked there's your cause.

[Aprice]

Having managed to get all 4 switches on, the 27 APs are reporting they are on or off.

 

We are running Leeds 76 on the smoothwall and it's strange how the smoothwall cannot ping the devices which are showing offline but then the DC on the same LAN can ping the APs.

 

Is this a Smoothwall problem?

 

 

Is this just one flat network, I.E are the DC, Smoothwall and the APs all on the same VLAN / Subnet?

[tom_newton]

Some sort of arp cache issue maybe?

[timbo343]

Is this just one flat network, I.E are the DC, Smoothwall and the APs all on the same VLAN / Subnet?

 

There are VLANs on the network but the Switches, DC and Smoothwall are on the same subnet / default VLAN.

 

- - - Updated - - -

 

Some sort of arp cache issue maybe?

 

Should i increase the ARP table value?

[Aprice]

Correct subnet mask on all devices?

[ThomL]

This isn't a very helpful reply - we have Meraki via CtC with a smoothwall and didn't experience the issues you describe, we allowed the traffic for the Meraki devices through the smoothwall and all has worked well. Slight slowness in responsiveness of the Meraki dashboard sometimes, but that's about it. Guess what I'm trying to say is although painful at the moment, it shouldn't be and should be easy to manage once you have things setup correctly!

[timbo343]

Correct subnet mask on all devices?

 

The APs are getting their IPs from the DHCP server, I know! They need to be set with Statics but i wasn't involved in the install!

[tom_newton]

There are VLANs on the network but the Switches, DC and Smoothwall are on the same subnet / default VLAN.

 

- - - Updated - - -

 

 

 

Should i increase the ARP table value?

 

Clear the cache:

https://linux-audit.com/how-to-clear-the-arp-cache-on-linux/

[timbo343]

Clear the cache:

https://linux-audit.com/how-to-clear-the-arp-cache-on-linux/

 

@tom_newton I dont have the SSH password for this school

[timbo343]

I *think* i've fixed the issues.

[snagrat]

How????

[tom_newton]

Suspenseful thread. A+.

 

BTW if you have forgotten the root p/w we can help.

[Davit2005]

I *think* i've fixed the issues.

 

Be careful you have not Jinxed it

[timbo343]

Be careful you have not Jinxed it

 

Jinxed it!

 

Restarted the Smoothwall back to square one!

[timbo343]

I'm all out of ideas with this!

 

I'm going to attend site early doors unplug each switch and power it back on and come away. That's what i did last time (Easter Holidays) and it fixed the issue until the Smoothwall was power cycled.

[Steve21]

Only a thought, but have you set the APs to bypass SSL inspection if it's on? Just wondering if the "restart fixed it issue" is they're getting connected while the proxy is offline while when it's online they might not like it

 

Steve

[timbo343]

Only a thought, but have you set the APs to bypass SSL inspection if it's on? Just wondering if the "restart fixed it issue" is they're getting connected while the proxy is offline while when it's online they might not like it

 

Steve

 

Yup, they are now configured with static IPs, the web proxy is set so that the group of IPs is in transparent proxy with no auth - Network Administrator and Unauth IPs for those unauthenticated requests.

 

The Meraki IPs are in the Network Administrator bypass guardian group.

 

When i VPN into site, i am unable to ping the devices where are showing as offline yet the DC on the same VLAN as the Switches and APs can ping the equipment.

 

Is it a Smoothwall routing issue? Is it a switch issue? I don't know, i just know that the smoothie and switches are all getting a hard power cycle early doors tomorrow morning.

[timbo343]

Suspenseful thread. A+.

 

BTW if you have forgotten the root p/w we can help.

 

I've never had it for this primary school.