MR57 WiFi clients on bridged SSID can't access local LAN

[haznix]

I have an internet gateway, with its own WiFi, running a DHCP server. I connected my MR57 to one of the ethernet ports and setup a 6GHz-only SSID in bridge mode. I connect my clients to the SSID and they get a DHCP address from the server on the gateway. I can access the internet from devices connected to this SSID. I have other devices connecting to the WiFi on the internet gateway as well. I am unable to ping the devices on this network. I can't even get a response back to the ping on the MR57's IP address on this network.

Topology:

----------

Internet Gateway (192.168.1.1) === ethernet === MR57 (192.168.1.5)

           ||                                                                             || 

        (WiFi)                                                                         ||

PC 1 (192.168.1.51)                                                        (WiFi)

                                                                              PC 2 (192.168.1.130)

When I try to ping 192.168.1.1, from PC2 I get a Request timeout. When I try to ping PC 1 the same, even for MR57. 

I have tried switching to NAT mode and enabling the Firewall rule to Allow Local LAN from Wireless clients. I switched back to bridged mode and it still doesn't work. I like to use RDP to manage PC1 but that bails out too. Needless to say it all works fine when I connect to the WiFi on the Internet Gateway.

As of this writing the firmware version on the MR57 is  MR 31.1.7, its connected to an AC power source.

If my SSID is bridged to the Local LAN shouldn't the wireless clients be able to see the other devices on the network? What am I missing? 

Update 1: Adding pictures of SSIDs summary page.

MySSID 1 configured in NAT mode

MySSID 2 configured in Bridge mode, notice how it says No on the 3rd line from the bottom where it says yes for Wired clients are part of Wi-Fi network in the picture above.

Thanks for reading. 

[Purroy]

Hello,

Have you tried to enable the setting that indicates which SSID a client connected to the LAN of a Mesh AP connects to?

This is done under Network Wide > Configure > General page.

In there you will find Clients wired directly into Meraki access point:

[haznix]

Hi Purroy,

Yes, that's what I thought about as well, changing this setting made no difference.

I would like to point out, I have a MR56 and MR44 in another network in my org and it doesn't seem to be a problem on that network. Not sure if it is relevant but I have a MX in parallel to the MR. There is nothing connected to it downstream, but its uplink is connected to an ethernet port on the same internet gateway.

[haznix]

I updated the original posted with pictures from the Wireless -> Configure -> SSID page where I noticed how it differentiates between two SSIDs configured in the same way with exception of WPA selection.

[MauroF]

Disable the application firewall installed in the PC or check the traffic shaping in the wireless setting if you have a "deny any LAN" in the rules.

[haznix]

So it's not just the PC, I can't even ping the MR57's ip or the main gateway running the DHCP server. I did set the Deny to Allow. I have tried NAT mode with allow as well and still no bueno. Thank you for the suggestion. At this point I feel this might be a firmware bug. My gateway router is a Comcast XB7 device, and when I connect to it's built-in WiFi everything works as expected.

[alemabrahao]

Can you share a screenshot of Wireless > Configure > Firewall & Traffic Shaping please?

[haznix]

Sure, here you go.

[alemabrahao]

I don't see any problem with your setup, so what I suggest is that you open a support case.

[haznix]

I am planning to do so, I think its a bug in the MR57 firmware. A MR56 and MR44 in the same org with similar config don't have this problem. Enabling disabling L2 isolaiton made no difference. 

[PhilipDAth]

Is client isolation enabled?

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Wireless_Client_Isolation

[haznix]

No it's disabled. I have a MR56 and MR44 in my org on a separate network with similar config and I can ping local LAN clients just fine. This seems to be MR57 specific. 

[haznix]

I think I figured it out the cause. My macbook's interface has an IP address of 192.168.192.113 but for whatever reason on the MR it's coming up at 192.168.192.34. I did a packet capture on the MR's wired interface with a ping going. 

Notice the destination in the packet capture.

When I checked the ARP table in Tools section I see the following. What I don't understand is, then how is all the other traffic properly working but only the local traffic getting directed to the wrong/non-existant IP address?

[haznix · Accepted solution]

TLDR; issue was caused by macOS's MAC address randomization for each different SSID on the same network.

The ARP cache on the macbook and MR57 and Gateway had duplicate entries. The macbook had saved a previous SSID with a randomized MAC address and new IP addresses were getting assigned to the same MAC address while the ARP cache had an old IP address for the same MAC address.

The fix? Changed the setting on the macbook to turn on MAC address randomization, delete the known networks and reboot all 3 devices. 

Thank you for your feedback folks. I hope this helps someone someday, so I updated this thread for posterity.