Version 13. Cisco to Meraki Firewall Upgrade Graphical Instructions

Transcription

1 Version 13 Cisco to Meraki Firewall Upgrade Graphical Instructions We are pleased to provide this technology to upgrade Church meetinghouse networks. The upgrade process has been simplified, and these instructions provide needed information for performing the upgrade. If needed, more detailed instructions are available on the MH Tech website (provide URL). This document contains diagrams that show the proper layout for connecting network cables into firewall ports. However, we are not attempting to correct any cabling issues that may exist in a building. The goal is to make the upgrade process as easy as possible, so connect existing network cables to the new Meraki firewall the same way they were connected to the existing Cisco firewall. Instruction #4 will shows how to do this. FMs. Where possible, we recommend that you first upgrade building networks in locations that use DHCP (dynamic) IP addressing. Static IP and PPPoE require a little more configuration, and should probably be done second. Table of Contents Upgrade Preparation 2 Equipment List 3 Know Cisco ISP Connection 3 Step 1: Configure Meraki Firewall via TM 6 Step 2: Download Firmware 11 Step 3: Transfer Cables 13 Step 4: Test new configuration Test PCs and Printers 15 Appendix USB Ethernet Dongle 16 Activation Error Messages 17 Configure Static IP or PPPoE Connections 19 ISP Connection Not Working 20 Contractor Login Information 21 Property Not Found 21 1

2 Know Your ISP Connection You can check at TM.LDS.Org for your configuration DHCP Static IP PPPoE Automatic 10.xx.xx.xx Username / Password Preparation How to prepare for your firewall Upgrade Know Your Cabling You will be transferring all cables from Cisco firewall to Meraki. Make sure you know the purpose of each cable. Bring Tools Screw drivers (Philips and flat), portable drill, wire cutters, Velcro to bundle cables, 6 + ethernet cable to connect laptop to firewall, Paper Clip firewall reset Client Static IP Addresses If your building uses Static IP addresses for clerk or Family History PCs, changes may be necessary Access to Clerk PCs You will want access to clerk PCs to test their connection. This may require bringing clerk with you. Power Concerns?? New Access Point powered via PoE adapter Do you have open power plugs near Cisco firewall? You may need another surge protector. Do you need an adapter from US to local Connector? Connecting with Laptop? You may need to connect with the network via ethernet cable. Do you have an ethernet port or adapter for your laptop? 2

3 Equipment List You will receive one of these three packages Know your Cisco Firewall and Internet Service Provider (ISP Configuration This information will be required during setup Cisco Firewall Serial Number Look on the firewall for this information Your ISP Connection will use one of the following 3 methods: DHCP (dynamic) Nothing to note. It s Dynamic Static IP IP Address Netmask Gateway DNS PPPoE Username Password Configuration A Meraki MX 64 Firewall Configuration B Meraki MX 64 Firewall Ubiquity PoE Adapter Meraki MR33 AP Configuration C Meraki MX 64 Firewall TP Link Switch To discover which method is used, login to TM.lds.org Select Firewalls Search for your building Click on the Serial Number for the firewall of the building Select the tab Internet Provider If not listed in TM, please contact your Facilities Manager Example: Static IP 3

4 Power Test Network PLEASE TEST YOUR SYSTEM BEFORE REMOVING CISCO FIREWALL If the internet is not working when you arrive troubleshoot and resolve the connectivity issue before proceeding. If needed, contact the GSC for assistance. Firewall Placement 1. Test Wired PCs Login to clerk PC Use browser to connect to LDS.org or Another favorite website If this fails, see Troubleshooting section 2. Test Facilities Devices Have FM test Facility devices Your Facility Manager should have tools that allow them to test connections to facilities devices, such as door access, heating and cooling systems, etc. Please do not stack Meraki firewall on or under other electronic devices wherever possible. The device needs open space around it to keep cool. By stacking it with other devices, you create a lack of heat dissipation which can lead to failures. 3. Test Wireless Connections Connect Mobile Device to LDSAccess Use browser to connect to LDS.org or another favorite website We suggest doing this at several locations in the building LDS.ORG Restore LDS.ORG Internet 4

5 1-1 Step 1: Configure Meraki Firewall via TM Unpack Meraki MX64 1. Remove Meraki MX64 From boxes 3. Note the Serial Number from the Cisco Firewall 2. Note the Serial Numbers from the devices for later use Cisco 881, 881W, 891 FTX- Firewall Firewall Access Point Q2KN-- -- Access Pt Q2PD It is a wise idea to test your current devices to know they function properly. We suggest testing Clerk PCs and Wireless access. Do this before you disconnect the Cisco firewall. 5

6 1-1 Step 1: Configure Firewall via TM Connect Laptop or PC to Existing Cisco network Wired Ethernet: 1. PC (Clerk of FHL) or Laptop. Clerk or FHL PC. These PCs should now be connected to the internet through the existing cabling Laptop. Connect laptop to Cisco 8X1 via Ethernet cable. We suggest you connect to port 1. (You may need to temporarily disconnect the cable in Port 1). If using a USB ethernet dongle for your laptop connection, please test beforehand. You likely need to download software. See Appendix A1 on page 14 for further information. 1-2 Step 1: Configure Firewall via TM Use Browser (Chrome, Internet Explorer, etc.) from PC/Laptop to Activate Equipment 2. Clear the browser cache. When you are in the browser (Internet Explorer, Chrome, Firefox, etc.) press the following keystroke combination: Ctrl + Shift + Delete. This will open a screen to allow you to clear the cache. 3. URL: Same login ID as LDS.org OR Wireless 1. You should be able to connect to LDSAccess. TM should be run in the normal browser mode (not in private or incognito mode). 6

7 1-3 Step 1: Configure Firewall via TM Select Configuration and 1-4 Enter Meraki MX64 Serial Number 4. Select the Configuration (Meetinghouse) 5. Enter the Meraki MX64 Serial Number You recorded earlier 6. Select Verify Step 1: Configure Firewall via TM Adding a Meraki MR33 Access Point? These Steps are Only for those who received a Meraki Access Point (MR33) Configuration B 7. Received MR33 Enter MR33 Serial Number Select Verify Select Continue 8. Did Not Receive MR33 Select Continue If your Serial number matches, you will see a screen like this. If wrong serial number you ll get an error. Please re-enter the serial number. Pay close attention to characters that look alike S or 5, B or 8. Please read the number from the device, not the Box. If using a smartphone or tablet to enter Serial number, be careful to check the autofill. It may change your serial number and you will get an error 7

8 When doing property search, please use the serial number from Cisco firewall you are replacing. Step 2: Configure Firewall via TM Search for Firewall Serial Number 9. Enter Serial number for existing Cisco firewall (the one you wrote down earlier on page 3) Serial Number Found? 1. Yes Select Radio Button for Destination Building Select Continue Go to Next Instruction page 2. No Check the firewall serial number and re-enter it. Still No match! Contact the Global Service Center. 11. Select Replace Firewall (upgrade program). It is important that you verify the serial number of the firewall you are replacing. This allows us to decommission the old firewall and properly configure the new firewall. 12. Select the matching firewall and then Select Continue For the firewall replacement program, you should NOT select this option. If the Cisco firewall is assigned to the wrong property contact the Global Services Service Center for resolution. It is important that you select the correct Cisco If more than 1 Cisco firewall is displayed, be sure you firewall. If you select the wrong Cisco firewall, select the correct firewall (same as noted from 3). you will get the wrong configuration on the new Otherwise, you could disconnect a firewall in a different Meraki and possibly create additional work. location by mistake! 8

9 1-7 Step 1: Configure Firewall via TM 1-8 Enter / Update ISP Information Step 1: Configure Firewall via TM Verify and Activate This step is optional 13. Enter updates about your Internet Service Provider (ISP). Include the following (where possible) ISP Name Bandwidth Speeds Account Information 15. Verify that the information you entered is correct 16. Select: Activate Firewall 14. Select Continue For Configuration B which includes Meraki MR33 Access Point MR33 needs to complete firmware download prior to pressing the activate button in the next step. The status light on the MR33 should be solid blue or solid green before moving to next step. Notes: ISP information from existing firewall will automatically transfer to this form The transferred information is only as good as what was entered in TM. Review the information for accuracy. There may be some truncation of data (system can only transfer 400 characters). This would be a good time to disconnect your laptop from the Meraki ethernet port and replace the cable that belongs in that port (if previously removed) 9

10 1-9 Step 1: Configure Firewall via TM Activation Success. Configuration Download If successful, you will see a message that the Firewall is in Process of Activating. The steps you have just completed will configure the firewall when it is connected to the internet. The configuration you have completed has the meetinghouse identity and the Meraki MX64 serial number connected. It is important that the serial number you have just configured be deployed in the right meetinghouse. Liahona Ward Q2KN-AAAA-BBBB Meetinghouse property and Meraki MX64 are now tied together. Do NOT install or move this device to another property 10

11 2-1 Step 2: Download Firmware & Configuration Unpack Meraki MX64 & Connect to Power 2-2 Step 2: Download Firmware & Configuration Move Internet Connection from Cisco to Meraki 1. Plug power cord into Meraki MX64 3. Disconnect the ISP cable from Cisco Firewall Port (Label A) and connect to the Meraki MX64 Internet Port (Label A in Diagrams) Configuration A or B - Cisco 881(W) A OR Configuration C - Cisco 891 A Meraki MX64-HW A Restore Internet Power ISP Connection Method IF Dynamic (DHCP, no additional configuration is required Static IP. & PPPoE. For this configuration, follow the instruction on the next page and go to page 19 to configure the Static IP or PPPoE settings 11

12 Step 2: Download Firewall Firmware & Configuration Firmware Download With Meraki MX64 now connected to the internet, new firmware (software) will be downloaded. The Meraki Status light will change colors to indicate the progress 5. Wait for Solid White Light before moving to next step 6. As soon as Meraki firewall has a solid white status light, connect Meraki MR33 Access Point (if provided) to Meraki firewall Normal time to update the firmware is 4 20 minutes, depending on your internet connection Firewall (MX64) Status Light Indicators: Solid Orange Powered on but not connected to internet Alternating Colors Device is attempting to connect to Meraki Flashing White Firmware upgrade in progress Solid White Fully operational and ready for configuration. Device is connected to the internet. Blinking Orange Hardware problem. May need RMA Step 2b: Download Access Point Firmware Connect Meraki Access Point (MR33) For Configuration B Only 1. Connect Ethernet cable to Meraki MR33. Connect other end of Ethernet cable to Power adapter, PoE port. 2. Connect another ethernet cable from Power adapter LAN port to Meraki MX64 port 2, if available. If a switch was plugged into the Cisco port 1, transfer that cable to Meraki port 2, and connect Meraki AP into switch Meraki MR33 will go through a power cycle where the status lights change colors. Device has updated firmware when status is solid Green or Blue. This may take from minutes. It has not yet received it s LDS Configuration yet. This will happen during activation process (page 12) Access Point (MR33) Status Light Indicators Orange - AP is booting (permanent Orange suggests hardware issue) Rainbow - AP is initializing/scanning Blinking Blue - AP is upgrading Green - AP in Gateway mode with no clients Blue - AP in Gateway mode with clients Blinking Orange - AP can't find uplink Front Panel Status Indicator Restore Power Internet Meraki firewall status light may change to solid orange after initial connection or firmware download. Wait 5 minutes before trying something different. If status light remains at Orange, your connection may be Static IP or PPPoE. Refer to page 19 for instructions It is ok to proceed to steps 2 & 3 prior to Meraki MR33 reaching a solid green or solid blue state 12

13 3-1 Step 3: Transfer Cables 1. Move all remaining Network Cables from Cisco firewall to Meraki firewall Following are examples of how your network wiring may be connected. Your situation may be different. The most important part of transferring the network cables is to match the cables going from the Cisco firewall into the matching Meraki Ports. It is critical that you transfer the cables to their matching ports. Failure to do so can render the entire network inoperable Cisco 881-K9 to Meraki MX64-HW Configuration A For example, If you have a cable plugged into a Cisco 881 Port 0, that needs to go into the Meraki MX64 port 1 (ports labeled B in diagram). A cable plugged into Cisco 891 port 3 goes into Meraki port 4 (see diagram on next page). A E D C B We suggest you take a picture of, and label the cables before moving them to help you identify cables. B C D E A Internet Restore Power Make sure all cables are removed from the Cisco firewall, power is unplugged, and then remove Cisco firewall from the area. Steps: 1. Unplug the cable from the FE WAN port (Label A) on the 881 and plug it in to the Internet Port on the MX64-HW (Label A) 2. Move Cables from ports 0-3 on the 881 to ports 1-4 on the MX64-HW (Labels B, C, D, E). Matching the ports is critical 13

14 3-2 Cisco 881W to Meraki MX64-HW (Port Available) E D C B A B C D E A Restore Power Internet Configuration B Configuration C It is critical that you transfer the cables to their matching ports. Failure to do so can render the entire network inoperable Steps: 1. Unplug the cable from the FE WAN port on the 881W and plug it in to the Internet Port on the MX64-HW (Label A) 2. Plug the Ubiquity PoE Injector in to a power source 3. Take an ethernet cable and run it from port 2 (Label C) on the MX64-HW (if available) to the LAN port on the Ubiquiti PoE adapter. If a Port is not available, plug this cable in to the existing switch that is plugged in to the MX64-HW 4. Plug an ethernet cable from the PoE port on the Ubiquity PoE adapter in to the MR33-HW Access Point 5. Move any remaining cables from ports 0-3 on the 881 to ports 1-4 on the MX64-HW (Labels B, C, D, E) Cisco 891 to Meraki MX64-HW with TP-Link I H G F D C B E A J H I A J G F E D C B Restore Power Internet Steps: 1. Unplug the cable from the WAN GE 0 port on the 891 and plug it in to the Internet Port on the MX64-HW (Label A) 2. Unplug cables from the 891 ports 0-5 and plug them in to ports 1-6 on the TP-Link switch (Labels B, C, D, E, F, G) 3. Unplug port 6 from the 891 and plug it in to port 3 on the MX64-HW (Label H) 4. Unplug port 7 from the 891 and plug it in to port 4 on the MX64-HW (Label I) 5. Plug an ethernet cable from port 1 on the MX64-HW to port 8 on the TP-Link switch (Label J) 14

15 4-1 Step 4: Test the New Connections Test Wireless Access Point 4-2 Congratulations! Your Firewall is Upgraded 1. Test Wired PCs Login to clerk PC Use browser to connect to LDS.org or Another favorite website If this fails, see Troubleshooting section LDS.ORG 2. Test Facilities Devices Have FM test Facility devices Your Facility Manager should have tools that allow them to test connections to facilities devices, such as door access, heating and cooling systems, etc. Cisco firewall Disposal: There is no sensitive data on the Cisco Firewall. Please dispose according to local guidelines. There is no need to follow sensitive data disposal guidelines. Does your network cabling follow Church standard? Although correcting network cabling is not part of the upgrade, it might be a good time for you to check to see if you are following standards. The charts below show the correct network configuration for the new firewall. 3. Test Wireless Connections Connect Mobile Device to LDSAccess Use browser to connect to LDS.org or another favorite website We suggest doing this at several locations in the building Dedicated Firewall Port Assignments Firewall Port(s) Connection Description Internet ISP Connection GbE LAN Ports 1 and 2 Public Network GbE LAN Port 3 Special Purpose Zone GbE LAN Port 4 Facilities Zone LDS.ORG LDS.ORG 15 15

16 A-1 Appendix USB Ethernet Dongle for Laptop Connection Most modern laptops do not have a built in ethernet connection port. In order to accommodate an ethernet RJ45 cable, a dongle (adapter) must be added to the laptop. The dongle often requires software to be installed for it to work properly. This software is typically provided with the dongle. Please make sure to download the software and run through the installation prior to going on-site. It is best if you test this connection beforehand. Example: USB Ethernet Dongle 16 16

17 A-2 Appendix A-3 Activation Error: Firewall Could Not be Found in Meraki Inventory What happens if an Error Occurs? If an error occurs during the activation process, please review the next few pages for solutions. If no solution is found, please call the Global Support Center or dial toll-free number for your area. Inventory message when entering the serial number for a Meraki device into the activation screen, you could get the following error message: This message will typically mean you have entered an incorrect serial number. Some letters / numbers can be difficult to distinguish, such as 5 and S. Please look at the serial number on the device and on the box, making sure they are the same. You need to use the serial number on the device. If you have confirmed the right serial number, please call the GSC for assistance

18 A-4 Activation Error: Firewall XXXX-XXXX-XXXX is already Activated A-5 Activation Error: Any Other Message Any other error message received from TM during activation will be caused by an internal processing error. Try the TM activation process again. Start at the point where you login to TM again. Enter the serial numbers for the devices again. Select property, etc. If you select activate firewall and it again comes back with an error, please contact the GSC. GSC personnel at this point should escalate to the TM development team. If you get this error message, it is because the firewall has already been activated in the inventory. It s likely an error related to an FM having multiple firewalls and he s using the same serial number from a previous activation. If the firewall is being moved from one building to another and the user is trying to activate in the new building, please call the GSC to deactivate the firewall from another network. If you experience any problems performing the Meetinghouse Firewall upgrade, please contact the Global Service Center (GSC) at or dial the toll-free number for your area

19 Your ISP may require a Static IP or PPPoE connection on the firewall in order to allow access to the internet. Follow the instructions below to configure the Meraki firewall to support one of these connection types. Contact your ISP provider if you have questions about your connection type. The GSC does not have this information. A-6 A-7 Configure Static IP or PPPoE ISP Connection Connect PC/Laptop to Meraki firewall Connect your Meraki MX64 firewall to the ISP modem. This will attempt a dynamic (DHCP) connection. If it fails to connect, the status light will turn solid orange, which means you may need to configure a Static IP or PPPoE connection. Connect a PC directly to the Meraki firewall. If using a laptop, you may need a dongle adapter to provide the ethernet connection. Please test your laptop connecting via ethernet cable beforehand. You will probably need to download a software driver to make the adapter work. Login to Meraki Setup From modern browser, connect to (do not use https) Username Device Serial Number Password leave blank Note: If Meraki firmware was previously downloaded, the username / password will be different. Use the following instead: Username admin Case Sensitive Password -- ld5b@53 Configure Static IP Connections Click Configure tab at top Configure PPPoE Connections Click Configure tab at top VLAN Tagging Don t Use VLAN Tagging Don t Use Connection Type: Direct Connection Type: PPPoE IP Assignment: Static Authentication: User Authen.. Address: Enter IP address* Username: Enter username* Netmask: Enter netmask* Password: Enter password* Gateway: Enter Gateway* IP Assignment Dynamic DNS Server Port 4 LAN DNS Server Web Proxy No Port 4 LAN Web Proxy No Go to the bottom of the page and select Save button The Meraki Firewall will reboot. Proceed to Activation Section We suggest you try all installations with the DHCP (dynamic) option first. Often times we have seen that *The Address, netmask, gateway, username, and the firmware will download and then you configure the password are provided by the ISP Static IP or PPPoE after

20 A-8 ISP Connection Not Working PPPoE With PPPoE connections, we have seen various configurations by the ISPs that affect how the Meraki firewall will connect. You may need to call the ISP to determine what type of configuration they are using. When talking to the ISP ask the following questions: Can you change from PPPoE to DHCP? If yes, is there an additional charge (normally, if available, it is less expensive to have a DHCP connection) We prefer DHCP connections easier to deal with Can we have the PPPoE credentials (username / password placed on the ISP modem? This is our preferred configuration for PPPoE ISP Connection Not Working Static IP Our experience has been very positive with Static IP connections. We haven t had one fail unless you have the wrong information from the ISP. Our only recommendation is to call you ISP to verify the IP address, Netmask and Gateway information. Then make sure you have correctly typed that into the Static IP configuration screen (instructions on page 17) A-9 ISP Connection Not Working DHCP DHCP Connection is Not working. Status light is solid Orange The most common cause of this is that the ISP modem is looking for the MAC address of the previous firewall. Since there is a new firewall, with a different MAC address, the ISP modem won t automatically connect Note: If you are not comfortable with these instructions, please contact the GSC To solve this, power off and disconnect the Meraki firewall from the ISP modem Power off the ISP modem for at least 15 seconds Power the ISP modem back on Allow 5 minutes for the ISP modem to reconnect to the internet and clear it s buffer Power on the Meraki firewall and Connect to ISP modem Meraki firewall will go through it s connection status light changes Solid Orange Powered on but not connected to internet Alternating Colors Device is attempting to connect to Meraki Flashing White Firmware upgrade in progress Solid White Fully operational and ready for configuration. Device is connected to the internet. 20

21 A- Contractor Login 10 If you are using a contractor for the installations, they will need to setup an LDS login account to gain access to the TM website. They do not need to be members to access the website. We have set this up so any LDS login will have access to the activation site. Anyone with an LDS login account can access the URL for activation tm.lds.org/#/meraki/activation. This is the same LDS credential that would be used for things like Family Search. To create a new account, please go to the following URL: A- 11 For Property Not Found There are a few scenarios that may exist that require you to select Property Not Found. Upgrading from old ASA or PIX firewall. These firewalls do NOT have Serial numbers that are tracked in TM. You do not have the correct Property or Unit ID for your building Whatever the circumstance is, please call the GSC for assistance. They can assign the proper firewall serial number to a property, locate the property information, etc. They will instruct you to follow the simple instructions below once everything is identified and hopefully corrected. Please inform your FM that you made this selection. He/she will need to work with Church HQ to properly connect the new firewall to the correct property 1. Fill out this form 2. When finished, Select Continue 21