Can 1 AP terminate tunnels on 2 different MCGs?

[GinaR]

With the newly launched Cisco Meraki Campus Gateway (MCG), Can 1 AP terminating its tunnels on more than one controllers residing in different networks for segmentation?

[alemabrahao]

Meraki APs can only establish a tunnel to one gateway/controller at a time. This is because the AP’s control and data plane are tightly coupled with the assigned gateway for policy enforcement and traffic steering.
The architecture does not support multi-homing or simultaneous tunnel termination on multiple MCGs. Each AP is associated with a single MCG for its tunnel termination.

[PhilipDAth]

When would you want to use an MCG?  I'm struggling to understand the use case or benefit.

[alemabrahao]

Well, from my point of view, MCG solves the challenges that arise in large campuses or deployments with multiple buildings, where Meraki access points need centralized tunnel termination for traffic, instead of sending everything directly to the internet, consistent application of policies across multiple VLANs and SSIDs, and segmentation and security without relying on complex Layer 3 designs or distributed firewalls.

[gregpalmer2]

I had a scenario where we had a building with multiple floors where users would go from floor to floor for different meetings. The constant roaming caused DHCP lease issues. Setting the DHCP timer to short or too long created issues. The MCG would have solved our roaming issue because the device keeps the same IP address, regardless of location.

[RWelch]

 

Not 100% sure about the "different network" part of the question but the next slide that you referenced shows:

Each AP establishes two QUIC tunnels to both Primary and Backup Campus Gateway

[alemabrahao]

This statement is true for the Control Plane, but not for the Data Plane.

An AP can maintain control plane connectivity to two MCGs simultaneously (Primary + Backup), data plane tunnels are still single-homed—traffic flows through only one gateway at a time.
The dual control plane tunnels are for redundancy and HA, not for segmentation or active-active forwarding.

[FlyingFrames]

But does that mean we cannot accomplish a usecase like this below on the same AP?

On one Meraki AP have Employee SSID tunneled to MCG cluster 1, guest SSID tunneled to MCG cluster 2.

[alemabrahao]

No, it's not possible. Meraki APs can only establish a tunnel to one gateway/controller at a time. 

[TBHPTL]

You can do this WITHOUT a MCG. You can tunnel SSIDS to an MX directly as long as the MX is in the same org

[GIdenJoe]

That has never been possible.  Also not in native Cisco WLC's.

The use case where they had a second WLC behind a firewall for guest access (guest anchoring) was made where the first WLC just tunnels to the second WLC.  The AP is always connected to only 1 WLC at a time.

But you do have centralized SSID's so you can just tunnel your guest traffic so it comes out on a centralized guest VLAN at the MCG.  So I don't see the issue there.

[FlyingFrames]

Thanks but our guest traffic needs to be opened out at DMZ, where MCG will not be in DMZ, so they can terminate employee traffic.

Does this mean my guest traffic has to go through the internal network? Since i do not see a way MCG can tunnel to another MCG in DMZ OR the AP cannot create tunnels to MCG on internal network & MCG in DMZ network at the same time?

[GIdenJoe]

So are you saying you don't have a layer 2 connection possible between your MCG and your DMZ firewall?
If you DO then just use a VLAN termination for guests only that runs on your switching between your DMZ firewall interface and the MCG's.
If you DON'T then the MCG will not be the best solution.
It would then be better to opt for the classic Cisco WLC solution where you have the foreign anchor deployment available here: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213912...

Then you could enroll the WLC into dashboard and still have some cloud management available.  There are of course some dashboard design elements that have to be taking into consideration.  So I will leave you with this document 😉
https://documentation.meraki.com/Wireless/Cloud-Managed_Hybrid_Operating_Mode_for_Catalyst_Wireless_...

[gregpalmer2]

Taken from the Campus Gateway Deployment Guide.

https://documentation.meraki.com/Wireless/Design_and_Configure/Deployment_Guides/Campus_Gateway_Depl...

“Active-Active clustering will be automatically configured by Dashboard whenever there are two Campus Gateways in to cluster. The members of a cluster will also be configured as mobility peers, so clients will be able to roam across APs tunneling to different primary Campus Gateways in the cluster seamlessly.”