Meraki

thomasthomsen · ‎Aug 29 2024

Just wiped the config and tried all over. Still the same. The Automation selects the right port-profile, but the trunk port-profile only allows traffic on its native vlan, all other vlans are blocked somehow. And again, the fun thing is that the mac-address table of the switch actually tells you that there is a client in the (in this case) tagged vlan 10 on that port, but no traffic. A packet capture on that Automated port, actually captures incomming packets tagged with the VLAN , but there is never any reply from the network. *sigh*

thomasthomsen · ‎Aug 29 2024

PS: And yes .. you can try to configure the new NexTunnel on IOS-XE 17.15 on your switch (the commands are there ... actually they are also there (on the switch) in 17.12.3 because the 9800 uses this from that version) like described in the video, but the dashboard rejects the request 🙂 So its not quite ready yet, but soooooon someone told me 🙂

thomasthomsen · ‎Aug 29 2024

The only real elephant in the room problem right now is that the MS switches do have more cool features then the CS switches. I know this will change, but it is really a bit annoying, at the moment, that port-profiles (and now Smart Port Automation), or even the SecurePort is only a MS feature - There are also other things..... *sigh* If you really want to know whats coming check out the video from Tech Field day at Cisco live : https://www.youtube.com/watch?v=gflqOvn6ipY For those who have access to Cisco live material, its the BRKARC-1975 session, but basically its the same thing covered.

thomasthomsen · ‎Aug 29 2024

SmartPorts Automation with Trunk ports as the Smart port profile still does not work. The SmartPorts Automation selects the right SmartPort profile but the trunk config of the SmartPort profile does not work. When applied manually (the same SmartPort profile) everything works. I gave up on the support case, but I cannot be the only one in the world with this problem.

thomasthomsen · ‎Aug 29 2024

I think that will happen quite "soonish" because of IOS-XE 17.15, also the C9500 series.

thomasthomsen · ‎Aug 28 2024

Now we just need the last part of the MS2xx series. I guess the replacement here will be 9200(L) switches when they eventually arrive as -M SKUs. It seems fine, cant wait til 17.15.x when NexTunnel becomes native to IOS-XE like on the WLCs (You can actually try it on 17.12.3 on the switches, but the dashboard denyes your request 🙂 )

thomasthomsen · ‎Aug 23 2024

lol .. downgrading to 17.12.1 solved the problem. wtf.

thomasthomsen · ‎Aug 23 2024

Downgraded to 17.12.3 , same error. 😕

thomasthomsen · ‎Aug 23 2024

Could this be because the switch is running newer software 17.12.4 then the dashboard that runs C9300 switches as 17.12.3 as the latest ? - Just wondering.

thomasthomsen · ‎Aug 23 2024

Just tried on another C9300-24T , without a NM but same IOS-XE 17.12.4, same error.

thomasthomsen · ‎Aug 23 2024

I have a colleague that has run into a strange issue. When trying to convert a C9300 to managed mode the switch gives this error on registration. Switch#show meraki comp Switch# SKU Bootloader Version ---------------------------------------------------------------------------------------------- 1 C9300-48T - Compatible 17.12.1r - Compatible Switch#service meraki register % Health Check Warning: Switch 1 PowerSupply 0 State is No Input Power Please use show environment power all exec CLI to get more details % Are you sure you want to continue? [no]: yes Starting to register switch 1 Converting catalyst.meraki.com to 158.115.128.76 Successfully connect to Meraki Dashboard Error: Received failed respose from Meraki Dashboard!!! (Message Response: HTTP/1.1 400 Bad Request [{"mac":"<mac-address>","error":"Product type is not supported","status":"FAILURE"}] My only thought was that it might be the NM module, but the NM module is a C9300-NM-8X, but as you can see it does not show up in the "show meraki comp" output. Switch is running 17.12.4, and the config has been erased, so it does just have the basic config required for converting. have anyone else seen this issue ? Thanks Thomas

thomasthomsen · ‎Aug 19 2024

A week on , and still trouble free.

thomasthomsen · ‎Aug 19 2024

In theory the new smart-port feature should sooonish support dot1x override port config ... as far as I know. Then it should be possible with your standard radius server of choice. But I have never had AP with secure-port quit on me before, perhaps I have just updated (rebooted) them more often, and they have just renewed their cert then ?

thomasthomsen · ‎Aug 13 2024

Well, fingers crossed yes.. But I still suspect it was a "time" (perhaps memory leak) issue. So ... waiting 🙂

thomasthomsen · ‎Aug 13 2024

Is this a known error on 17.x or was it also there previously ? , I think I just encountered it today 😕

thomasthomsen · ‎Aug 13 2024

Lets see if the CW APs in the lab will be more stable then 31.1.3 - 24 hours on (give or take) everything OK. The only thing REALLY annoying is this: I have two transistion mode SSIDs one with PSK/SAE and one Dot1x. The Dot1x one actually IS being broadcast on 6Ghz, the SAE one... not so much. “Ah, cruel fate, how swiftly joy and sorrow alternate!”

thomasthomsen · ‎Aug 12 2024

Hmmm the AP lies to me, my phone is connected with 6Ghz ... interesting 🙂

thomasthomsen · ‎Aug 12 2024

Was WPA3 transistion mode not supposed to fix this for me ? This device has disabled the 6 GHz frequency band because there are no active SSIDs using WPA3 encryption. or did I miss a "memo" ? 🙂

thomasthomsen · ‎Aug 12 2024

Hmmmm ... "just" : General stability and performance improvements Roaming-related issues with 802.11r configured SSID (Wi-Fi 6 APs) Of course : Upgrading right now 🙂

thomasthomsen · ‎Aug 12 2024

"speak of the devil" ... new MR software arrived just now.

thomasthomsen · ‎Aug 12 2024

PS: I immediately wish for the Firewall log feature to tell me WHAT L7 rule / country (in this instance) the block is coming from 🙂

thomasthomsen · ‎Aug 12 2024

Thanks for the info, that was one of the providers I did not know Meraki was using.

thomasthomsen · ‎Aug 12 2024

MR APs do not seem to be affected.

thomasthomsen · ‎Aug 12 2024

MR31.1.3 seems to "break" authentication / association on CW9164 after a while. Different customers, and even in my lab, after the CW9164 has been online for a while a mix (when looking at the health score) of association and authentication errors seem to happen. Eventlog on PSK/SAE networks shows EAPOL timeout, on dot1x networks not much is revealed, only what seems to be general authentication errors. Reloading the AP fixes the problem for a while (dont know exact time). I have not been able to do wireless packetcaptures of the problem, but it is happening on the wireless side of things. It did not seem to be present on 31.1.2 Reverting to 30.7 and there are no problems at all, also after x time.

thomasthomsen · ‎Aug 12 2024

The country that it was block on was : "Qatar"

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges