Recommended Dashboard Structure

MSPs generally have multiple customers in the same dashboard organization when delivering a standard service. Utilizing the standard service model (organization per service, network per customer) provides several operational benefits, however this structure should not be used if SD-WAN is being utilized as part of the service. This is because the scope of an organization defines the connectivity domain for Meraki Auto VPN, and it is important to keep customer deployments independent from each other in terms of connectivity. Generally, organizations for MSPs are separated in a one-organization-per-SD-WAN manner.

Given that this solution leverages Meraki Auto VPN and SD-WAN, each customer will need to be assigned to its dedicated organization. The recommended structure for this solution specifies the use of a base organization containing a blueprint network. This organization will serve as the foundation when creating independent organizations for new customer deployments, and each site is represented as a network under that customer’s organization. The structure is illustrated below.

Branch Network Infrastructure 

The network equipment to be installed at customer premises will vary depending on the connectivity needs and amount of clients at each location. A general network diagram for a single customer deployment with two branch locations is available below. This can be scaled to multiple customer organizations each containing numerous branch networks.

 

 

Specific device model information, technical specifications, and a sizing guide is available in table 1 of the Appendix.

Initial Setup and General Provisioning Workflow

In order to deploy this solution using the best practices provided in this document, the following workflows must be performed in order by the administrator.

The initial setup consists of... 

1. Creating the base organization for the service
2. Configuring the general settings for the organization
3. Creating the blueprint network

 

 

After initial setup, when the base organization containing the blueprint network is available, administrators can follow the below workflow for provisioning purposes.

1. Create a new organization by cloning the base organization
2. Create a new network by cloning the blueprint network
3. Add devices to the newly created network

 

 

A more detailed provisioning workflow is available in the “Automation of Network Provisioning” section of this document.

Network Creation

After a dashboard account and organization have been created:

Step 1. Log in to the Cisco Meraki dashboard as an organization administrator.

Step 2. Select Configuration templates from the Organization tab.

Step 3. Click the Create a new template button.

Step 4. Enter a Template name and make sure it clearly describes its purpose (e.g.“Blueprint Network”) and click the Add button.

Step 5. Leave Target networks blank, click on the Close button, and Save changes.

Step 6. Navigate to the Organization tab and select Configuration templates. The newly configured template has been created and it is available for configuration.

Step 7. Click on the name for the template (e.g. Blueprint Network) to start configuring it.

 

Note: By default, the ability to create new networks by cloning from a configuration template (blueprint network) is not enabled. Please reach out to Meraki Support to have this functionality enabled on the base org. This process only needs to be performed once for the base org. Newly created organizations will inherit this functionality from the base org.

Network-Wide (General) Configuration

For the purposes of consistency, it is recommended to configure the general settings that are common across customer sites in the blueprint network. Below is a list of the most relevant settings available when selecting General under the Network-wide tab.

• Country/Region sets the country of network; regulatory domain is set based on this

• Local time zone sets the time zone of the network

• Traffic analysis specifies the level of detail desired for traffic analysis

For added visibility, use the Detailed option for Traffic analysis. This enables collection of detailed information about the destinations which can be useful for troubleshooting.

 

 

Additionally, the Traffic analysis section allows for the definition of specific destinations to track and build a custom pie chart. The destinations can be defined based on HTTP hostname, Port, IP range, or IP range & port.

 

 

When a custom pie is configured and there is matching traffic to the destinations, traffic usage information will be available when selecting Clients from the Network-wide tab.

 

 

Security & SD-WAN (MX) Configuration

The configuration steps described in this section are specific to the Meraki MX Security appliances. The MX line has built-in security, SD-WAN capabilities, and is used in all the branch deployments as outlined in table 1 of the Appendix. Use the following steps to configure this portion of the reference network:

Step 1. Navigate to the Security & SD-WAN tab and select Addressing & VLANs

Step 2. From the Deployment Settings section of the page, ensure that the Routed and MAC address options are selected for the Mode and Client tracking settings respectively

 

 

 

Step 3. Scroll down to the Routing section and enable the use of VLANs.

 

 

Step 4. Click on the Add VLAN button to create each of the VLANs needed for branch deployments.

 

 

• Name: Use a name that describes the purpose of the VLAN (e.g. “Voice VLAN”).

• Subnet: Defines the subnet to be mapped to the VLAN. Use Classless Inter-Domain Routing (CIDR) notation.

• MX IP: The IP address within the subnet that the Security Appliance (MX) will use.

• VLAN ID: The assignment of the VLAN tag. Use a number between 1 and 4,096.

• Group Policy: Specifies the group policy to be applied to traffic within the subnet.

 

Step 5. Click Update after entering the VLAN information and confirm VLAN creation. Repeat the process for each of the VLANs needed.

 

 

Step 6. Navigate to the Security & SD-WAN tab and select DHCP. Each of the created subnets will have its own DHCP server configuration, ensure the Run a DHCP server drop-down option is selected for all VLANs.

Step 7. Scroll down to the DHCP server configuration for the Voice VLAN. In order to allow IP phones to retrieve configuration and a hosted phone firmware, add custom DHCP options entries with the following configuration:

• Option: Select Custom from the drop-down to configure an unlisted DHCP option.

• Code: Enter the number for the DHCP option (e.g. 150 for TFTP server address).

• Type: Select Text. 

• Value: Enter the URL or IP address information.

 

 

 

Step 8. Navigate to the Security & SD-WAN tab and select SD-WAN & Traffic shaping. Scroll down to the SD-WAN policies section and add a preference by using All VoIP & video conferencing under traffic filters and selecting Best for VoIP as the preferred uplink. 
 

 

Step 9. Scroll down to Traffic shaping rules and configure a new rule for All VoIP & video conferencing traffic. Refer to the image below for additional details on how to configure the rule.

 

 

Switching (MS) Configuration

This section walks through the Meraki MS switching configuration portion of the blueprint network.

Step 1. Navigate to the Switch tab and select Switch settings. 

Step 2. Scroll down to the Quality of service section of the page and create a new rule. Enter the voice VLAN ID, select Any protocol from the drop-down menu, and set the DSCP setting to Trust incoming DSCP.

 

 

Wireless (MR) Configuration

This section covers the Meraki MR wireless configuration piece of the reference network and it is only applicable to site deployments that leverage Cisco wireless phones. It is highly recommended to perform a pre-install RF survey as outlined in the Wireless VoIP QoS Best Practices document. Follow the next steps to configure the wireless settings of the blueprint network.

Step 1. Configure a dedicated SSID for voice by navigating to the Wireless tab and selecting SSIDs. 

Step 2. Rename the default SSID. Use a name that describes its purpose (e.g. “CiscoVoIP”). 

Step 3. Navigate to the Wireless tab and select Access control to configure the SSID. 

Step 4. Configure the Network access section using a pre-shared key with WPA2 as the authentication method and WPA2 only as the WPA encryption mode. 

 

 

Step 5. Scroll down to Addressing and traffic and select Bridge mode. In this mode, the Meraki MR access points will bridge the client directly to the LAN, and it is recommended for Layer 2 seamless roaming.

 

 

Step 6. Associate the dedicated voice SSID to the voice VLAN configured in the LAN by enabling VLAN tagging and specifying the ID for the voice VLAN used by the Meraki MX Security Appliance and Meraki MS switches.

 

 

Step 7. Scroll down to Wireless options and set the minimum bit rate to 12 Mbps. This is the recommended minimum bit rate for wireless networks with VoIP traffic. Disabling lower bit rates reduces overhead on the network and can result in an improved roaming experience.

 

 

 

Step 8. Navigate to the Wireless tab and select Firewall & traffic shaping and ensure that the voice-dedicated SSID is selected from the drop-down.

Step 9. Scroll down to Traffic shaping rules and create a new rule for All VoIP & video-conferencing traffic and set the Per-client bandwidth limit to Ignore SSID per-client limit (unlimited).

Step 10. Set the PCP and DSCP tags to 6 and 46 (EF - Expedited Forwarding, Voice) respectively.

 

 

For additional information, refer to the Wireless VoIP QoS Best Practices document.

 

Enabling and Disabling Meraki Insight

To Enable Meraki Insight on a network:

Step 1. Ensure the necessary licensing is available.

Step 2. Select the checkbox next to the network where Insight should be enabled.

Step 3. Click Add network(s) to Insight at the top left of the table to enable Meraki Insight on the selected network(s).

 

To Disable Meraki Insight on a network:

Step 1. Select the checkbox next to the network with Insight currently enabled.

Step 2. Click Remove network(s) from Insight

Configuring Meraki Insight for VoIP

After a dashboard account and organization have been created:

Step 1. Log in to the Cisco Meraki dashboard.

Step 2. Select VoIP Health from the Insight tab.

Step 3. Select Configure VoIP servers on the pop-up.

Step 4. Input the Provider name and the Hostname or IP. Repeat this step to add additional VoIP servers.

Monitoring Meraki Insight for VoIP

Once you provide the servers you’d like to monitor, you’ll be able to see an org-wide view of performance:

 

Step 1. Select VoIP Health from the Insight tab.

Clicking any row will take you to a drill-down view with detailed performance information:

 

For further details regarding the capabilities of Meraki Insight, see the Meraki Insight Introduction article.

Initial Setup

In order to automate the network provisioning, some initial steps must be performed:

 

 

Step 1. Create the base organization (see Creating and Configuring the Base Organization above).

Step 2. Locate the organization ID for the base organization. 

 

 

Step 3. Configure the provisioning tool with the located organization ID.

Customer Provisioning

Once the provisioning system has been configured, new customers can be deployed using the following steps:

 

 

Step 1. New customer order is placed, automated network provisioning begins.

Step 2. Create a new organization, cloning from the base organization.

Step 3. Locate the network ID for the network that corresponds to the blueprint network.

 

 

Step 4. Create a new network by cloning from the blueprint network.

 

 

Step 5. Add hardware to newly created network.

 

 

Step 6. Configure switch ports for voice services (access port and voice VLAN). As a general recommendation, you should utilize the Action Batches API documentation to perform this task.