New AP firmware and MacBooks

[BeachBum]

Hello Meraki Community,

We're seeing some issues, specifically with newer Meraki AP firmware and MacBooks it seems.

At each of our locations, we have MR44s running 30.5 firmware, configured with two SSIDs:

A guest/public WiFi network with Password selected and configured in Security, WPA2 only, 802.11r Disabled, 802.11w Disabled, no Splash Page, External DHCP server assigned, VLAN Tagging with VLAN ID of 6.

A "production" network secured with Identity PSK with RADIUS, WPA2 only, 802.11r & 802.11w both Disabled, no Splash Page, multiple RADIUS servers configured on the dashboard which are running FreeRADIUS on CentOS, no RADIUS accounting is configured, External DHCP server assigned, VLAN Tagging with VLAN ID of 2. This network is connected to, and able to access internal servers -- file shares and our accounting program.

We've been running the above configuration for over a year without issue.

We've been receiving reports of, and have been able to duplicate, issues with connecting to our production network's SSID, but it is limited to MacBooks. The macOS version does not matter, we've seen it with both Ventura (v13) and Sonoma (v14). The WiFi icon in the menu bar appears to scan and scan, but will not connect. In some instances, the user is prompted for a password. Since we, IT, setup the computer, the users do not know the password. Clicking cancel on the password prompt, the computer may or may not connect. In some instances the user is either prompted for the network's password again, or prompted to run Diagnostics. Clicking cancel again, the computer may or may not connect, but, eventually, the computer finally does connect. This behavior does not occur on our Windows computers, either 10 Pro or 11 Pro.

In our HQ office, we upgraded our MR44s to 30.6 yesterday morning after seeing it's availability and its list of bug fixes, but the issue persists.

At another nearby building, we have two MR44s in our office space, and this is the location where we first received reports of the connectivity issues I described above. Here's kicker #1: in our warehouse space of this building, there are six MR72s running 26.8.3. These APs are part of the landlord's Meraki Organization, which I have admin rights to, and are connected directly to our Meraki MS320s (yeah, yeah, I know, they're going EOL, we have a replacement plan -- focus people 😉), just like our MR44s. These MR72s have the same SSIDs with the same configurations I described above. When I take a MacBook out into the warehouse space, where I get connected to one of the older MR72s running the much older firmware, there are no issues. I'm able to bounce between the guest/public network and our production network without any issues whatsoever.

Last night, I created a new Test Network in my Meraki organization and moved one of the MR44s from our HQ network to this new network. After I setup the SSIDs with the same configuration as our other networks/locations, I downgraded the firmware on this single MR44 from 30.6 to 28.5.1 since that was the oldest version available. I did this because I didn't want to downgrade all of the APs in my HQ network.

Here's Kicker #2: using a MacBook that's connected to the MR44 running 28.5.1 in the new Test Network, I'm able to bounce between the guest/public and production networks without issue. I know I'm connected to this AP because it's directly above where I sit, and I've verified the connection of the MacBook to this particular AP in the dashboard. I even created a third, non-broadcasting SSID that only exists in the Test Network with the same settings (IPSK with RADIUS, VLAN, etc). I'm able to bounce between it, the regular production network and the guest/public network. This MacBook would struggle with the same symptoms I described above (WiFi password and Diagnostics prompts) when the AP was running 30.5 and 30.6.

So, the million dollar question(s): anyone else seeing something similar? Any suggestions?

[Ryan_Miles]

Are the MR44s and MR72s in the same dashboard Org or different ones? And if in different Orgs are all the SSID configs the same? VLANs, firewall rules, RF profiles, etc?

[BeachBum]

The MR44s and the MR72s are in different dashboard orgs. I have access to, and can make changes to both dashboard orgs.

Across the board, with regard to the SSIDs, the VLANs, firewall rules, the configs are pretty much the same, except the MR72s have an outdoor RF profile assigned in the other org. But even there, the indoor RF profile I have configured for the MR44s in my org is pretty much the same.

[NolanHerring · Accepted solution]

Definitely get a case opened to track this first and foremost. I was going to say go to 30.6 as I know that version has tons of bug fixes, but looks like you already did.

My personal 2 cents here, is stability > features. I'm pretty much running 28.7 for all MR44's because its been rock steady and stable. I honestly could care less about fancy features, if the code isn't stable, I'm not interested. Nothing quite like unstable firmware code to make you look incompetent to the business, been there done that and it's stress I never want again.

I would downgrade to 28.7 for production environments (or whichever stable version you were on before), and then have that case opened and an engineer to work with you directly via a lab environment with 30.6 and get PCAPs and figure out what's what, and until you have a fix, hold off on upgrading.

[BeachBum]

Thanks Nolan, will definitely take your post into consideration.

[BeachBum]

Requested the downgrade for one of my networks to 28.7, it is scheduled for this Sunday at 5am EST, although they're putting us to 28.7.1. @NolanHerring thoughts on 28.7.1?

[NolanHerring]

28.7 vs 28.7.1 should have no impact or difference on the MR44 since the release notes (changelog) for 28.7.1 indicate the following:

New
This release adds support for MR28, CW9164 and CW9166.

Bug fixes
There are no bug fixes included in this release.

 

[BeachBum]

That's kind of what I thought, but you're the CWNE 😉

[PhilipDAth]

Is the SSID hidden?

[BeachBum]

Both our guest/public and production SSIDs are broadcasted.