Meraki

thomasthomsen · ‎Aug 12 2024

Hmmm the AP lies to me, my phone is connected with 6Ghz ... interesting 🙂

thomasthomsen · ‎Aug 12 2024

Was WPA3 transistion mode not supposed to fix this for me ? This device has disabled the 6 GHz frequency band because there are no active SSIDs using WPA3 encryption. or did I miss a "memo" ? 🙂

thomasthomsen · ‎Aug 12 2024

Hmmmm ... "just" : General stability and performance improvements Roaming-related issues with 802.11r configured SSID (Wi-Fi 6 APs) Of course : Upgrading right now 🙂

thomasthomsen · ‎Aug 12 2024

"speak of the devil" ... new MR software arrived just now.

thomasthomsen · ‎Aug 12 2024

PS: I immediately wish for the Firewall log feature to tell me WHAT L7 rule / country (in this instance) the block is coming from 🙂

thomasthomsen · ‎Aug 12 2024

Thanks for the info, that was one of the providers I did not know Meraki was using.

thomasthomsen · ‎Aug 12 2024

MR APs do not seem to be affected.

thomasthomsen · ‎Aug 12 2024

MR31.1.3 seems to "break" authentication / association on CW9164 after a while. Different customers, and even in my lab, after the CW9164 has been online for a while a mix (when looking at the health score) of association and authentication errors seem to happen. Eventlog on PSK/SAE networks shows EAPOL timeout, on dot1x networks not much is revealed, only what seems to be general authentication errors. Reloading the AP fixes the problem for a while (dont know exact time). I have not been able to do wireless packetcaptures of the problem, but it is happening on the wireless side of things. It did not seem to be present on 31.1.2 Reverting to 30.7 and there are no problems at all, also after x time.

thomasthomsen · ‎Aug 12 2024

The country that it was block on was : "Qatar"

thomasthomsen · ‎Aug 12 2024

We had a fun problem today. This morning Microsoft teams acted up very strange, seemed online, but we could not send messages, or call anyone. No update of the MXs in the environment had been done, and they are running different releases. Pinging teams.microsoft.com you got no reply, and a packet-capture on the LAN side of the firewall said that all SYN's toward that resolved IP (52.123.128.14) was only replied with RST. Capturing packets on the WAN side towards 52.123.128.14, nothing, so it was pretty clear that the MX was the one "eating" these packets. To begin with I suspected content filtering, because the site we started to troubleshoot was running an old MX software 18.1xx.x, and I have some experience here where content filtering was doing "something wrong(tm)". But we then had reports of other sites, where luckily they where running a 18.2xx.x, and here the firewall log feature told us that traffic was being blocked by L7 rules. The only L7 rules the customer uses are country filtering, but the same list on all sites. Removing the list, problem solved. We are now trying to figure out what this IP has now been "assigned to". It should be US, that is not blocked in the list, but clearly something has happened. I dont even know who maintains the country list on MX ... Talos ? /Thomas

thomasthomsen · ‎Jul 30 2024

Hmmm search has failed me it seems. - Ill just delete this one tread then. Thanks.

thomasthomsen · ‎Jul 30 2024

So this is apparently the "settings" across all my networks and orgs. right now. And the slider does not go higher then 100Mbit. I will say, that when putting the slider to max, it does not seem to limit the client, but still, this is just strange, did anyone notice when this happened ? PS: I have of course not checked EVERY Org and network I am part off, but all the ones I have , so far looks like the one above. /Thomas

thomasthomsen · ‎Jul 26 2024

If you utilize a dot1x you can have your radius server assign a Meraki GroupPolicy with specific ACL for each client type. For example. You can have one client assigned with your "internal_full_access" GroupPolicy, and another client (on the same SSID / VLAN) assigned with the "internal_limited_access" GroupPolicy, the works very well. If you do not use radius, you could "more or less" do the same thing with the iPSK Without radius feature of the AP. Here each "PSK" is combined with a GroupPolicy on the same SSID. Of course this will require you to have different PSK (on the same SSID) for the different clients.

thomasthomsen · ‎Jul 25 2024

Yeah Im sorry ... then perhaps the only solution is to call their support. I highly recommend calling, because I think you might end up in some "packet capture" scenario thats best done "Live". Of course the "reset" the device is almost always the first thing they will ask you, so be ready for that 🙂 - And I have actually had "reset" solve a problem once 🙂

thomasthomsen · ‎Jul 25 2024

It seems something fails to load then. I have seen this a couple of times, but it usually just "goes away" . How strange..., and we are not in some kind of unfortunate situation where its a browser thing ? - Have you tried to go to the dashboard from another browser, clearing all cache and other "junk" in the browser, or even just use Incognito mode ? Going back through the release notes I have now realised that the bug I was originally thinking about was the MS390, and this one : In rare circumstances, MS390 series switches may disconnect from dashboard until rebooted. Data plane traffic is not impacted unless RADIUS authentication is used (present since MS 14.28) So right now Im not much help, its just strange.

thomasthomsen · ‎Jul 25 2024

Are the ports on the switch page greyed out, like they are disabled, or just blank black ?

thomasthomsen · ‎Jul 25 2024

https://www.youtube.com/watch?v=V6QhAZckY8w <- Sorry I ... HAD TO!! 🙂

thomasthomsen · ‎Jul 25 2024

Well back then it was so nice to see a, clearly Catalyst switch, in the Meraki portfolio, because we where all thinking "it", even back then. And the only reason we quoted it, was most likely because we, and the customer, thought: "more future proof" (something that you should absolutely never think in the IT world 🙂 ). We have had "all the problems", from stacking failing, to having trouble updating the dang thing, the switch loosing connection to the dashboard, but still functional (until restart), and so on and so on. I now, have "inherited" a customer that has the dang thing all over the place, and its always, "fun", especially when this customer does not really like to update switches, and that semi old MS390 software versions is "the worst". I think from version 16.x a lot of good has happened, but its IOS-XE17.15 Im most excited about, features, stability everything will get better .... right ... RIGHT ?...

thomasthomsen · ‎Jul 25 2024

"Is .. is that Thomas guy ok ? - he seems to speak, write, and hum .... all to himself .... a lot" 🙂

thomasthomsen · ‎Jul 25 2024

And the switch is online and "green" ? Can you use the tools on it, like ping and so on, its just the port-status that is broken right ?

thomasthomsen · ‎Jul 25 2024

🙂 I installed my first MS390 back in Nov. 2020 and I have hated the damm thing ever since, and never recommended it to any customer. I mean, its really nice hardware, but the software *sigh* it never became good. Lets hope things will get better now that the NexTunnel will be native to IOS17.15.x, it sure seems so, listening to the plans. But I need to see just the plain "boring" L2 Meraki goodness on that platform working flawlessly before I can get really exited.

thomasthomsen · ‎Jul 25 2024

What version are you running ? I think there was a version at some point that had this problem. Or maybe Im remembering the MS390 (with all the problems that platform has 🙂 )

thomasthomsen · ‎Jul 25 2024

How do the MT30 button communicate with the dashboard if the network is powered off ? 🙂 I have been thinking about having the MT30 button power off AP ports completely. Like when you go home from the office, you turn off lights, there might as well be a "button" that turns off the APs in the same spot. Then when you come back, and turn on the lights, you also press the "turn on APs" button. But then, we thought "dang it", we need APs up for the MT to be able to communicate with the dashboard, or else it will be a "non wireless day at the office" very quickly. - We could of course "omit" the closest AP from being turned off, but in this case, we are also lucky to have some cameras, and they also work as a MT gateway, and we dont turn those off when leaving the site 🙂

thomasthomsen · ‎Jul 25 2024

Is "hopping" between vlans easy in a wireless environment ? I, like WW writes, dont understand the major problem either. But you could tunnel the traffic from an MR to a MX, but that still "mixes" things up in my opinion. If you truly want all the VRF goodness, then its 9800, that actually supports VRFs on the box (lets call it "VRF light light" right now, but full VRF support is coming officially a little later for the 9800). From version 17.12.x there is officially VRF support : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/config-guide/b_wl_17_12_cg/m_vrf-support-and-overlapping-ip-address.html But its a ... lets call it L2.5 VRF , not full L3, but still in separate instances. I think that 17.15.x might be the release where full L3 VRF and routing is supported on the 9800, then you can actually terminate all the clients L3 on the 9800 in each VRF, but dont judge me if Im wrong, and its a later release.

thomasthomsen · ‎Jul 25 2024

What exact model of a C2960 is it connected to ? What happens if you enable LLDP on that switch ? (Can LLDP "see" the AP ?) Also, please give us a "show run int (the port the AP is connected to)" from the switch, because that could be interesting to see.

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges