Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Virigoth
Apr 28, 2009

Corona rules everything around me
C.R.E.A.M. get the virus
In the ICU y'all......



Get a Foscam that e-mails him on motion. The 3 step Cisco solution is to hard.

Adbot
ADBOT LOVES YOU

George H.W. Cunt
Oct 6, 2010





What are some good but not so obvious things one should look at on pluralsight?

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

Kashuno posted:

I don't have buying authority so if it's really bad I can blame it on someone else!

Boggles my mind that anyone would buy Meraki switches after the last couple of years worth of firmware they had.

I've never wanted to take a sledgehammer to something so badly in my life.

Thanks Ants
May 21, 2004

#essereFerrari


Wait I've not heard about firmware problems, can you expand? Meraki stuff is normally the approved option around here for someone wanting to admin a network without being a network person, or with a bunch of branches to cope with.

Kashuno
Oct 9, 2012

Where the hell is my SWORD?
Grimey Drawer

Thanks Ants posted:

Wait I've not heard about firmware problems, can you expand? Meraki stuff is normally the approved option around here for someone wanting to admin a network without being a network person, or with a bunch of branches to cope with.

this is me so I hope it's not that bad :ohdear:

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

Thanks Ants posted:

Wait I've not heard about firmware problems, can you expand? Meraki stuff is normally the approved option around here for someone wanting to admin a network without being a network person, or with a bunch of branches to cope with.

Oh man, where to start.

This goes back farther than 2 years, my sense of time gets skewed. Most of this was pre-cisco buyout or right around when they did in 2012.

Automatic firmware updates wiped switch configurations.
Automatic firmware updates that were turned off got applied anyway.
Switch lockups after firmware update.
Had to RMA three MX switches after downgrade bricked them.
Disconnects and reboots along the way with the APs
Beta firmware being applied when we weren't in the Beta program.
Huge and constant problems with 802.x
Lack of support for CDP/eigrp et al after the purchase bothered me, but that wasn't really their problem, its not hard to re-write your OS.

Lets not forget that at one point in time, if you stopped paying for the wireless configurator cloud thing, you couldn't make any changes to the APs that you owned.

I'm not a fan of Meraki in any way, shape or form.

DigitalMocking fucked around with this message at 03:00 on Dec 31, 2015

luminalflux
May 27, 2005



KS posted:

We have Cisco UC phones and I could buy nice video endpoints, but maybe there's a simple point to point solution I'm missing?

We use Chromeboxes at work with google hangouts.

Proteus Jones
Feb 28, 2013



DigitalMocking posted:

Huge and constant problems with 802.x

802.1X? Port security?

Sorry, not trying to be a pendant, but I legit went to google thinking there was 802 spec I never heard of before.

Anyhow if that is it, what was the issue? Was it just not enforcing, randomly enforcing, or not letting anyone auth to the port?

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal
I don't know how anybody could go with meraki switches when they're easily 5x normal cisco gear. The pricing is out of their loving minds.

adorai
Nov 2, 2002

10/27/04 Never forget
Grimey Drawer

Judge Schnoopy posted:

I don't know how anybody could go with meraki switches when they're easily 5x normal cisco gear. The pricing is out of their loving minds.
bbut it's in the cloud!

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

flosofl posted:

802.1X? Port security?

Sorry, not trying to be a pendant, but I legit went to google thinking there was 802 spec I never heard of before.

Anyhow if that is it, what was the issue? Was it just not enforcing, randomly enforcing, or not letting anyone auth to the port?

Yeah, sorry, missing the 1.

There was an issue where the switches wouldn't clear the last VLAN state if they lost connectivity to the RADIUS server.

Now to be honest, this was on beta firmware for the MAC based radius authentication, so we partly own that issue.

edit: It was in Beta a LOOOONG time, they didn't release it until I had moved on and landed in HP ProCurve hell and stopped doing any kind of consulting.

DigitalMocking fucked around with this message at 07:30 on Dec 31, 2015

GnarlyCharlie4u
Sep 23, 2007

I have an unhealthy obsession with motorcycles.

Proof

H110Hawk posted:

Because they know.

This is the right answer.

Kashuno posted:

f meraki PoE switches

This is the rightest answer. I'll see you over in the Helldesk thread. /wrists

Seriously though, if you're going Meraki, just go Cisco instead. Meraki is for people with more money than sense.
Also, I really don't like the idea of only being able to configure things in the cloud. It's not at all an option for networks that don't (or shouldn't) have internet access.

Ocanthus
Sep 29, 2009
I've got a toss up question to see if other folks have any run in to something similar and what you ended up doing.

We are going to be having some employees starting that are going to be mobile with laptops and iPhones and not work out of a branch location and apparently they are going to need to do a lot of printing either at home or at client's offices. I definitely don't want to give them local admin just so they can add printers, but is there a way to fine tune permissions so that they can, with a normal user account, add and remove printers? Alternatively, are mobile wifi printers practical? Since they are going to be printing out information that has people's social, date of birth, and such, I want to avoid them emailing it around to get printed if possible.

GnarlyCharlie4u
Sep 23, 2007

I have an unhealthy obsession with motorcycles.

Proof

Ocanthus posted:

I've got a toss up question to see if other folks have any run in to something similar and what you ended up doing.

We are going to be having some employees starting that are going to be mobile with laptops and iPhones and not work out of a branch location and apparently they are going to need to do a lot of printing either at home or at client's offices. I definitely don't want to give them local admin just so they can add printers, but is there a way to fine tune permissions so that they can, with a normal user account, add and remove printers? Alternatively, are mobile wifi printers practical? Since they are going to be printing out information that has people's social, date of birth, and such, I want to avoid them emailing it around to get printed if possible.

If they're on your domain you can just use Active directory to push printers to the computers.
Alternatively you can just create a shortcut with the printer's location as the target.

Edit: oh you want to edit user's ability to add printers without admin on their devices?

https://social.technet.microsoft.com/Forums/windows/en-US/df21d2c2-c2d4-4107-bfe3-bf8c5a1cd946/install-printer-without-being-administrator

GnarlyCharlie4u fucked around with this message at 14:39 on Dec 31, 2015

Ocanthus
Sep 29, 2009
Since they are going to be so mobile, they won't be on our domain typically (only when they VPN in) any the only consistent printer they would have access to is their home printer which also wouldn't be on the domain.

For workstations in our main office, we do use the AD push approach based on location for people to have default printers set.

Sefal
Nov 8, 2011
Fun Shoe

Ocanthus posted:

I've got a toss up question to see if other folks have any run in to something similar and what you ended up doing.

We are going to be having some employees starting that are going to be mobile with laptops and iPhones and not work out of a branch location and apparently they are going to need to do a lot of printing either at home or at client's offices. I definitely don't want to give them local admin just so they can add printers, but is there a way to fine tune permissions so that they can, with a normal user account, add and remove printers? Alternatively, are mobile wifi printers practical? Since they are going to be printing out information that has people's social, date of birth, and such, I want to avoid them emailing it around to get printed if possible.
I believe you can do this via group policy without giving them admin rights. Just give them access to printers and devices.
Sadly I don't think you can give them rights to manage printers that you don't even know about.
I just went through the 70-410 print services course. I don't recall it saying something about managing unknown printers.
Someone, please correct me if i'm wrong.

GnarlyCharlie4u
Sep 23, 2007

I have an unhealthy obsession with motorcycles.

Proof

Sefal posted:

I believe you can do this via group policy without giving them admin rights. Just give them access to printers and devices.
Sadly I don't think you can give them rights to manage printers that you don't even know about.
I just went through the 70-410 print services course. I don't recall it saying something about managing unknown printers.
Someone, please correct me if i'm wrong.

You can theoretically give them the ability to install printers+drivers as I mentioned above (click the link).
Have not confirmed if that works or not. But it is at least worth testing.

quote:


If you need your users to be able to add their own print drivers you will have to use GPO to edit the Driver Installation policy. It is located here:

Computer Configuration\Policies\Administrative Templates\System\Driver Installation

The setting is called "Allow non-administrators to install drivers for these devices setup classes". You will need to add the device class GUID of printers.
The GUIDs can be found here: http://msdn.microsoft.com/en-us/library/ff553426(v=vs.85).aspx
EDIT:
I've updated this with some more information as this was getting a bit old and people probably tried the same with network printers (which does not work the same way).
A few more steps are required for domain infrastructures where you add non-local printers:
Configure Group Policy settings for "Point and Print" on BOTH computer and user settings (Vista previously only had user settings). The Location of the settings can be found here in GPOs:
Computer Configuration\Policies\Administrative Templates\Printers\Point and Print Restrictions
User Configuration\Policies\Administrative Templates\Control Panel\Printers\Point and Print Restrictions
Point and Print settings will vary on what kind of restrictions you want, but if you want users to be able to install ANY printer, with ANY driver, from ANY server, set the Point and Print settings to "Disabled".
There are also other Group Policy settings that are related to print services, but I won't list them here. They may or may not relate to your planned print infrastructure, so read through them properly and try them out in testlabs if the above steps does not work for you.

Thanks Ants
May 21, 2004

#essereFerrari


^ that was going to be my suggestion as well. I read about it when I was trying to do a similar thing with home workers and printers, but the project got shelved before I could do any PoC stuff.

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal

GnarlyCharlie4u posted:

Seriously though, if you're going Meraki, just go Cisco instead. Meraki is for people with more money than sense.
Also, I really don't like the idea of only being able to configure things in the cloud. It's not at all an option for networks that don't (or shouldn't) have internet access.

There actually is decent application for the firewalls and waps for remote sites / MSPs / small businesses. I'm installing public access internet at three locations this year and it will not be connected to our network infrastructure, so the best way to monitor those resources and guests utilization is meraki.

Anything above the second tier device (mx100, mr32) and you should really be using cisco gear with staff on site to monitor and manage it.

Ocanthus
Sep 29, 2009

GnarlyCharlie4u posted:

You can theoretically give them the ability to install printers+drivers as I mentioned above (click the link).
Have not confirmed if that works or not. But it is at least worth testing.

Thanks, will check those out with a few users and see how it goes.

Moey
Oct 22, 2010

I LIKE TO MOVE IT

DigitalMocking posted:

Automatic firmware updates wiped switch configurations.
Automatic firmware updates that were turned off got applied anyway.
Switch lockups after firmware update.
Had to RMA three MX switches after downgrade bricked them.
Disconnects and reboots along the way with the APs
Beta firmware being applied when we weren't in the Beta program.
Huge and constant problems with 802.x
Lack of support for CDP/eigrp et al after the purchase bothered me, but that wasn't really their problem, its not hard to re-write your OS.

Lets not forget that at one point in time, if you stopped paying for the wireless configurator cloud thing, you couldn't make any changes to the APs that you owned.

I'm not a fan of Meraki in any way, shape or form.

I took over a Meraki setup a few years ago (access switches, access points and firewalls for VPNs) and have had 0 of these problems. I am running about 30 switchs, 50 APs and 10 or so firewalls (Z1 through MX80).

Walked
Apr 14, 2003

I'm also very happy with the Meraki gear I've used (MX100, few different APs).
No issues and the support has been very good.

Sheep
Jul 24, 2003
I've had some wonkiness with a single AP which was likely a faulty hardware issue. Other than that nothing but good things to say about Meraki. If you use it for what it's obviously intended for (remote branches, small organizations, MSPs, etc) then it works great.

Edit: actually I have one complaint, you can't manually flush the DHCP leases on their firewalls without rebooting the device.

Sheep fucked around with this message at 16:45 on Dec 31, 2015

Bigass Moth
Mar 6, 2004

I joined the #RXT REVOLUTION.
:boom:
he knows...
Never had a single problem with meraki and managed dozens of customers at my last job. Beyond a certain enterprise level I wouldn't use their switches or firewalls due to relative lack of configuration options, but for smb use they have been super easy to maintain and manage.

Moey
Oct 22, 2010

I LIKE TO MOVE IT

Bigass Moth posted:

Never had a single problem with meraki and managed dozens of customers at my last job. Beyond a certain enterprise level I wouldn't use their switches or firewalls due to relative lack of configuration options, but for smb use they have been super easy to maintain and manage.

Yeah, I have found them to be "too simple" some times, but I don't think that will be an issue in the SMB market. But for basic stuff (access layer, wireless, vpn) they have been great.

Thanks Ants
May 21, 2004

#essereFerrari


The firewall rules UI is a complete mess but I think again the assumption is that if you use them as branch office routers with VPN tunnels you're unlikely to have to expose internal services to the Internet.

Danny LaFever
Dec 29, 2008


Grimey Drawer
I don't mind Meraki firewalls for small biz especially if they have a couple small sites (the vpn tunnel mesh works fine)

Stuff I don't like about Meraki (they fixed some of this with firmware)

Load Balancing on the firewalls is/was garbage.
For a long time the firewalls could utilize more then one static IP on a single cable/DSL modem. (In cases where clients had need for two statics they had to buy two internet connections)
I can't remember the term but with the way they use ARP cache the biggest telco fiber provider in my market could not work on a meraki with a static. (it simply wouldn't acknowledge its existence)
They pushed WAN Optimization but it never worked and they just gave up on it.
Switches are not that great especially for the ridiculous cost.

For small biz. Like I said I don't mind using some MX60s (or 64s whatever they are now) with some procurve switches and call it a day.

keseph
Oct 21, 2010

beep bawk boop bawk

GnarlyCharlie4u posted:

You can theoretically give them the ability to install printers+drivers as I mentioned above (click the link).
Have not confirmed if that works or not. But it is at least worth testing.

Just keep in mind that a user with this right is only the tiniest jump away from local admin. So it'll protect against accidental dumb moves but any exploit kit or other malware/rootkit they stumble into won't even notice it as a speed bump. Treat the machines as appropriately untrusted.

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal

Moey posted:

Yeah, I have found them to be "too simple" some times, but I don't think that will be an issue in the SMB market. But for basic stuff (access layer, wireless, vpn) they have been great.

I don't know if they've fixed this but one huge VPN problem is they will not accept a NAT'd address on the far end, which is an extremely popular option for vendors to go with. I worked with Meraki engineers for a few days and they admitted their device can't handle it.

I had to put an old ASA 5500 on the inside of the network and finagle static routes to get the vendor VPN up, which was much less than ideal.

Walked
Apr 14, 2003

Danny LaFever posted:

I don't mind Meraki firewalls for small biz especially if they have a couple small sites (the vpn tunnel mesh works fine)

Stuff I don't like about Meraki (they fixed some of this with firmware)


For a long time the firewalls could utilize more then one static IP on a single cable/DSL modem. (In cases where clients had need for two statics they had to buy two internet connections)


This is wrong or I'm misreading somehow. We're using multiple external static subnets. Unless this is a typo and meant "for a long time firewalls couldn't".

Danny LaFever
Dec 29, 2008


Grimey Drawer
That one is fixed now.

A couple years back the Meraki interface had no idea how to use the second static IP on a modem. I spent enough time with support on this one to remember it.

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

Moey posted:

I took over a Meraki setup a few years ago (access switches, access points and firewalls for VPNs) and have had 0 of these problems. I am running about 30 switchs, 50 APs and 10 or so firewalls (Z1 through MX80).

You should go buy some lottery tickets then, you're the luckiest human I know of. :colbert:

Gucci Loafers
May 20, 2006

Ask yourself, do you really want to talk to pair of really nice gaudy shoes?


Welp,

My employer can't find anyone well-versed in MS SQL Server and now they're looking at the existing staff to step up to the plate. I know how to write decent queries but I don't know much else aside from typical Windows/Linux System Administration.

What exactly would I be getting myself into here?

ChubbyThePhat
Dec 22, 2006

Who nico nico needs anyone else

Tab8715 posted:

Welp,

My employer can't find anyone well-versed in MS SQL Server and now they're looking at the existing staff to step up to the plate. I know how to write decent queries but I don't know much else aside from typical Windows/Linux System Administration.

What exactly would I be getting myself into here?

Be very cautious as to whether they just need some work or want a DBA. If the latter, you best read up on it so you know what you're getting in to. Being a DBA is a nightmare and involves much more than writing stored procedures to access the data. You start getting into database design and a whole bunch of poo poo.

thebigcow
Jan 3, 2001

Bully!
If someone were a sadomasochist and wanted to be a DBA, where would you start?

DigitalMocking
Jun 8, 2010

Wine is constant proof that God loves us and loves to see us happy.
Benjamin Franklin

thebigcow posted:

If someone were a sadomasochist and wanted to be a DBA, where would you start?

You're 90% there with enjoying pain already. The rest is just learning to be bad at databases, but slightly less bad than 99.99% of everyone else.

Dr. Arbitrary
Mar 15, 2006

Bleak Gremlin
Just do everything in excel, maybe upgrade to access if it starts to get big.

bull3964
Nov 18, 2000

DO YOU HEAR THAT? THAT'S THE SOUND OF ME PATTING MYSELF ON THE BACK.


Being a DBA is the fine art of making sure that you never fully please any one person, but you please everyone just enough to keep everything from going pear shaped.

ChubbyThePhat
Dec 22, 2006

Who nico nico needs anyone else

DigitalMocking posted:

You're 90% there with enjoying pain already. The rest is just learning to be bad at databases, but slightly less bad than 99.99% of everyone else.

Pretty much this.

Adbot
ADBOT LOVES YOU

captkirk
Feb 5, 2010

DigitalMocking posted:

You're 90% there with enjoying pain already. The rest is just learning to be bad at databases, but slightly less bad than 99.99% of everyone else.

Make sure you don't know anything about disk, resource bottle necks, or the generally finite nature of physical memory. Those are all concerns for the systems team.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply