Meraki

thomasthomsen · ‎Feb 1 2023

Ventev does good work. We have often used enclosures from them.

thomasthomsen · ‎Feb 1 2023

As mentioned by everyone, it's not "the correct" way of running your AP (aka. bad 🙂 ). But you could get support to disable the other radio chains, and only have the one with the connected antenna enabled. It would still be bad, because of no diversity or mimo features would be in use, but better then running something where the same features would ruin things more when running, ehhh, "improper antenna configurations" .

thomasthomsen · ‎Jan 18 2023

Hmmmm ... I think 17.10.2 reintroduced the EEE bug on the MX85 boxes I monitor ... From just around the update I have started to see a lot of "Ethernet port carrier change" in the eventlog. I will try to "investigate" some more ....

thomasthomsen · ‎Nov 26 2022

So Im trying to troubleshoot some issues on a network with a MX85. In the eventlog for the MX85 I for example see "device: port3, carrier: false". Port 3 , on the dashboard UI page of the MX85 is the WAN1 RJ45 port, so this would be "bad". What boggles me, is that if this Port3 losts its carrier, then it would mean that WAN1 was down, and that I should then see a "Primary uplink status change" in the evenlog as well (since this MX has two running WAN links - not dual active). But I do not. I also see one or twice a "device: port4, carrier: false" and that would mean (according to the dashboard UI) that WAN2 would be down ? (Im not worried at all .... ... .... ). I then looked at the downlink switch, and on the lldp/cdp neighbour information of this switch it says : Meraki MX85 - fw01 / 6 - but there is nothing connected to Port 6 on the MX85. (the other downlink switch says : Meraki MX85 - fw01 / 7 for the lldp/cdp neighbour information). The actual dashboard UI ports are 11 and 12. So what can I conclude about this ? Is the eventlog information = the UI truth ? Or is there an "offset" somewhere, because the lldp/cdp information is clearly not equal to the UI. /Thomas

thomasthomsen · ‎Nov 17 2022

Thanks 🙂

thomasthomsen · ‎Nov 17 2022

Yeah they did. And I thought they would not, and just use the "SSID configured" VLAN for WPN. I dont mind, its fine. But I was just surprised. So Im guessing you could "mix and match" (I have not tested this). So two different GP (with the same VLAN override setting) and then two different iPSKs on the WPN enabled SSID would not be able to communicate. So you could have a "Group" of different GP (that would not be able to communicate) on VLAN 10 .. and another group of GPs using VLAN20 (that would not be able to communicate) .. on the same SSID ... I dont have a good usecase here ... But I now see WPN as a kind of iPSK scaling.

thomasthomsen · ‎Nov 17 2022

Hi all. This might be a dumb / quick question, but I just can't seem to find the information in the documentation. Is there a SKU for a standard MV32 bracket ? We have "lost" some, and I can't quite seem to find a SKU for a direct replacement. I can find the SKU for the Wall-arm and the "Telescopic"-arm - do these two require the standard bracket to function ? Do anyone know ? Thanks Thomas

thomasthomsen · ‎Nov 15 2022

I just found out something about the WPN feature that i DID not know. GP override VLAN works together with WPN. Or so it seems from the network i "converted" from multiple SSIDs (because of the 50 iPSK limit) to WPN.

thomasthomsen · ‎Nov 9 2022

So what was the problem ? Was it just the Pre-shared key ?

thomasthomsen · ‎Oct 13 2022

I think Im seeing some strange behaviour on MX84 and Layer 7 Firewall rules. The layer 7 firewall seems to block internal DNS requests (Clients on one vlan - dns server on another). DNS seems to be classified as eDonkey P2P traffic ... 😕 To external DNS servers it seems to work fine ... very strange. Im also seeing some strange behaviour on MX85 where it will stop traffic for small periods of time during the day, seems to be related to IPS rules that is being hit a lot of times all of a sudden, but Im more unsure of this one, --- It could also be a coincidence , and its in reality the WAN switch in this setup that is running out of buffer (for some reason).

thomasthomsen · ‎Sep 22 2022

One question. How many APs does WPN scale to ? Can I have 100 ? 200 ? (or more ) APs using it in the same Network / VLAN ?

thomasthomsen · ‎Sep 21 2022

Interesting ... But .... Im a little confused here ... WPN is for when you use one VLAN for all clients, and they are still seperated by #merakimagic right ? And iPSK with GP is for when you have multiple VLANs and want to separate clients on VLANs (of course you could put clients into the same VLAN with iPSK+GP but in this use case it does not really apply) Im currently running a dorm with iPSK+GP. And the way I got round the 50PSK limitation (with GP) was to create a SSID pr. floor. That way Im down to around 30 - 40 GP/PSKs. But I would really like to try just doing one large VLAN .. like a /22 or /21 and do one SSID with WPN and have clients separated by this. (using around 100 - 200 APs or so). But I always wonder if it will work 🙂

thomasthomsen · ‎Aug 17 2022

Well , those are the "rules" of our local regulatory domain (and I think it's the same for the rest of ETSI). - It states something like (in shortened form) --- You can use 10mW/mhz up to a max of 200mW EIRP (in UNII1-2A). Basically means that using a 20Mhz channel I can have a 200mW EIRP (10x20=200). But if i go to 40Mhz the radio needs to turn down its transmit power to 5mw/mhz in order to stay at the max allowed 200mW EIRP (40x5=200) ... and so on. In UNII2C my local regulatory states 50mW/Mhz and a max EIRP for 1000mW (1Watt). But yeah .. you also get the 3db SNR thing ... but that happens regardless.

thomasthomsen · ‎Aug 11 2022

Well here you are on channel 56 - UNII2A. Regdomain says 200mW EIRP on a 20Mhz channel at this frequency - so that would be 23dm EIRP. (Channel 36 <-> 64 are here). So here you are potentially missing 3.1 db. (And that's the same amount as you are missing with the same antenna on 2,4Ghz). 100 <-> 144 UNII2-EXT you are allowed 1 Watt EIRP for a 20Mhz channel = 30dbm EIRP. And remember, If you increase your channel width the AP must decrease transmit power 3db when its twice as wide. So 3 db down for a 40Mhz channel, and another 3db down from 40Mhz if you go to 80Mhz. PS: The rules are a bit more "complex" in 5Ghz frequency range 🙂 - When you factor in TPC + there are different rules for different parts of the range. - But Im pretty sure the APs supports TPC. PPS: Perhaps I should mention the above numbers are for ETSI reg domain. What US and other domains are doing I would have to look up 🙂 - Im sure there is a WiKi page for it 🙂

thomasthomsen · ‎Aug 10 2022

This should not have anything to do with elements (Im a little unsure what you mean here ... 🙂 ) But you are right, the MR76 would do better , raw signal wise, in every scenario (read, antenna attachment). They should just be able to beacon, and potentially do single stream data, at the highest allowed EIRP in your reg. domain. And they do not. But the MR46E is the worst one. (If I needed it to for some strange design reason...... it is of course not "best practice" to have your wireless network at max power - EIRP)

thomasthomsen · ‎Aug 10 2022

But what EAP method would work with SAML ? I'm guessing only one of the servers side certificate methods like TTLS and PEAP ? Or is this the real problem, that you cannot do EAP "on top" of SAML ? Then it becomes a whole new Hornets nest of development hell. Clients need to support it, the network devices needs to support it, and between the network and the AD SAML provider . So I'm guessing that because RADIUS ( you call it inflexible , I call it very flexible 🙂 ) is the standard for dot1x authentication, it will remain, until someone sets a standard for SAML network authentication from client device and out.....

thomasthomsen · ‎Aug 9 2022

I might create one for 5Ghz just for fun. One for UNII1 and one for UNII2-EXT.

thomasthomsen · ‎Aug 9 2022

Just because Im an annoying fellow (I tried to write a bad word here, but it would not let me 🙂 ) , I created this easy visualised sheet that tells you how bad this really is. From all the APs I had access to. (I do have an ... ehhh .. collection of Cisco Classic APs as well, but I just compared to the "new ones"). https://docs.google.com/spreadsheets/d/1-s5IOMg09DTCFnODNapsYXta_onfO4W6SqG3E6sn9tg/edit?usp=sharing (I want to in advance apologize for the sarcastic and Im guessing for some, un-fun, notes I made in it). I also did real world measurements, standard passive scanning for beacons, and it fits the data.

thomasthomsen · ‎Aug 9 2022

Reading all this. There could also be another solution. Microsoft could just provide a RADIUS service in their Azure AD solution. Problem done. Because the real issue here is of course, network equipment speaks, good old fashioned, has always worked, RADIUS, and Azure AD speaks SAML . And in case you didn't know SAML != RADIUS. 🙂 So who "gives in" first ? The network provider, that now have to invent a new integration to potentially all cloud solutions, that can be completely different from each other, or , the AD cloud provider who should just provide a well defined service in their solution , that would then work with every network vendor. - So should the pressure not be on the cloud AD provider instead of the network vendor ? - I dunno. This is why we get these fun solutions with a "translator" in between from RADIUS to SAML 🙂 Just my thoughts. - Not here to fight 🙂

thomasthomsen · ‎Aug 9 2022

I can tell you that on the 9166 sensors do not work in the "Meraki Persona". But the XOR 5/6 Ghz radio settings are there and operational. (I currently have some 9164 and a couple of 9166 in test. They are REALLY nice 🙂 ) So far , everything I have tested on them works. I have not gotten around to test WPN, but since everything else works, I dont see why this should not. For switches. Well, what you get is basically the MS390 features on a Cat9300. I guess if you are an org. that really want the same Hardware everywhere then its a good "deal", if not, hmmm ... then I would wait until "Managed" comes to the 9200 series (unless we all of a sudden get more interesting features in the Dashboard --- I mean... just give me VRF LITE ??!?!?!?, and Ill be mostly happy 🙂 )

thomasthomsen · ‎Jul 28 2022

Interesting. I have seen something similar I think. But it seems to be kind of a "random" problem, and to us/me it seemed to only affect certain "older" clients, and it always seems to happen when the client roams (again like you the roam , dot1x and so on seems fine, but from the client perspective the network does not forward traffic). Im really looking forward to test the 29.2 software, just to see if anything changes.

thomasthomsen · ‎Jul 25 2022

There is a known bug with MR46 where it, overtime, does something(tm) that causes low throughput. Reload, or a "shut / no shut" of the SSID fixes the problem. This issue should be fixed in 29.2 (and only 29 software as far as I have heard, since it requires a Radio Firmware upgrade). Perhaps that is what you are running into.

thomasthomsen · ‎Jul 25 2022

I have heard a little bird tell me that you will also be able to monitor CAT9800 in the Meraki dashboard down the road. But I think its somewhat far down the road, since we have just had release for monitoring of the CAT switches (and the management of those switches in dashboard is still not publically available). So Im guessing that you are looking at a 6 - 12 months timeframe <- Pure guessing from my side. But in theory yes, then you could monitor your 9800 both in DNA-C and The Meraki Dashboard, like you would be able to do with all your switches. - The only question is why would you want to monitor them (it) in both places ?

thomasthomsen · ‎Jul 2 2022

In theory, beamforming to a client should give you a better signal at the client end. But that requires client "feedback", and in theory that was specified in the 802.11n specifications, but actually never implemented on clients (Intel, I think, might have done it, as the only client vendor at the time) , unless the Meraki APs can do what Cisco used to call "ClientLink(tm)", and I do not think they can. Regardless, sending single stream data and beacons at the lower transmit power is bad, especially for warehouse environments. And Meraki should fix this, sooner rather then later.

thomasthomsen · ‎Jul 1 2022

have anyone noticed that this (Group Policy) does not even work statically with anyconnect and SAML ? I just tested with a customer, and the static Group policy in the config (at the very bottom of the page) does nothing. It works fine in non-SAML ... how strange.

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges