Meraki

RaphaelL · ‎Nov 25 2022

Well in my case I'm sure that the route was missing. Traffic was dropping. A simple reboot of the spoke 'solved' the issue , but there might be an underlaying issue that needs to be solved ( or is already solved in the 17.X train ) Anyways , an endpoint would help identify these issues 😞

RaphaelL · ‎Nov 25 2022

Hi , I might be blind but I don't see any endpoint to fetch the route table of a MX. I had 1 spoke with 96 routes and another spoke with 205 routes announced from the same HUB. I wanted to compare all my 1300 spokes route table to understand why some spokes were missing routes but this is not fesable without an API. Thanks.

RaphaelL · ‎Nov 23 2022

Haven't tested Python 3.11 yet. I'm guessing that you had no issues with 'older' versions ?

RaphaelL · ‎Nov 22 2022

Ouch please let us know your experience with that job ! Sounds like a hard job to maintain after your migration.

RaphaelL · ‎Nov 22 2022

Hi , I was reading the documentation about CoA ( https://documentation.meraki.com/MR/Encryption_and_Authentication/Change_of_Authorization_with_RADIUS_(CoA)_on_MR_Access_Points#Enable_Cisco_ISE ) Roaming with CoA There are a number of advantages to CoA and it enables many new use cases. SSIDs that require fast roaming should not use CoA. Fast roaming mechanisms like PMKsa, OKC, and 802.11r will be disabled on the SSID that is configured for CoA. Clients are forced to complete EAP on every association which ensures that the RADIUS server will send the CoA to the correct Access Point. Let's say I have an SSID with WPA2-Enterprise and a Radius server configured. I also have 802.11r enabled AND CoA configured. Does that mean that 802.11r won't work at all since Clients are forced to complete EAP on every association Will it cause conflict ?

RaphaelL · ‎Nov 17 2022

These issues are too random to perform a packet capture sadly. In my lab the Iphone is sitting on my desk and not moving around. It is probably going into a power saving mode or something. Happens at random moments during the day/night.

RaphaelL · ‎Nov 17 2022

Hi , I have noticed an increase of error messages with IOS devices running IOS 16.X : AP are running 28.7 , 29.4.1 , 29.5 and are all reporting this message. Seems to be only affecting IOS devices. I was able to reproduce the ''issue'' in lab. I have an Iphone sitting on my desk, AP is 5-6 feet away and randomly the logs are appearing. No user complaints so far , only flooding my logs. SSID is WPA2-Enterprise and clients are far from being out of range. Weird. Any one with the same issue ?

RaphaelL · ‎Nov 16 2022

I'm the exact situation. We have passed QA with 29.4.1. Redoing everything with 29.5 but have no idea what changed.

RaphaelL · ‎Nov 16 2022

We don't know for sure what was fixed between 29.4.1 and 29.5 right ? I know you had 29.5 in private beta , but I'm curious

RaphaelL · ‎Nov 15 2022

Well 29.5 is out..

RaphaelL · ‎Nov 15 2022

Kinda weird since they don't own 6.0.0.0/8. I know it's only used for services that you described but still

RaphaelL · ‎Nov 15 2022

Yes. I was curious if anyone has experienced that or has any idea about it. Happens on any version ( 15.44 , 16.16 , 16.16.16 , 17.10.2 and so on )

RaphaelL · ‎Nov 15 2022

Hi , We are running BGP on our spoke/hub. When looking at the route table the nexthop ( which is the HUB ) is identified with a weird RID ( always starting by 6.X.X.X ) When taking a packet capture you can clearly see the HUB sourcing these packets : PS : Both screenshots were taken on different hub/spoke , the 6.X.X.X is not a match. Why ? This is super confusing.

RaphaelL · ‎Nov 14 2022

Yes. it is already disabled by default.

RaphaelL · ‎Nov 3 2022

On that said SSID , what is the auth mode ( via API and dashboard just to confirm )

RaphaelL · ‎Nov 3 2022

Hi , You have to define the 802.1X Servers. Please refer to the documentation of that endpoint : https://developer.cisco.com/meraki/api-latest/#!update-network-wireless-ssid I'm pretty sure that you are trying to update a SSID

RaphaelL · ‎Nov 1 2022

Yes you will have 4 Tunnels. You can also see the tunnels in Security Appliance -> VPN Status In this documentation you will learn the formulas to calculate the number of tunnels formed per configuration : https://documentation.meraki.com/Architectures_and_Best_Practices/Auto_VPN_Hub_Deployment_Recommendations#:~:text=The%20number%20of%20tunnels%20for,L2%20(2)%20%3D%201600.&text=To%20continue%20our%20example%2C%20each,412%20tunnels%20per%20hub%20MX.

RaphaelL · ‎Nov 1 2022

Well done everyone ! Great participation this month !

RaphaelL · ‎Nov 1 2022

Same here. Seeing couple of these also : xtra='\<0600D5000A4D564D542D434F52504F01070C9824B048606C2102000C2432240128012C013001340138013C014001640168016C017001740178017C018001840188018C019001950199019D01A101A5012D1AEF0917FFFF00000000000000000000000000000000000000000030260100000FAC040100000FAC040100000FAC033C000100F3DD9DDBCA895701D3EA6D5D0AD20BD136033059003B1380515354737475767778797A7B7C7D7E7F8081460572000000007F0A04008880014000C00000BF0CB2799103FAFF0000FAFF0020DD070050F20200010002001067EB0551955CAF25D607FF05B9179D1203001641432D31372D43382D31312D45312D37353A7661703004001641432D31372D43382D31312D45312D37353A76617030050006AC17C811E175>' auth_mode='wpa2-802.1x' 11k='1' 11v='1' ft='1' reassoc='1' reason='invalid_pmkid' radio='1' vap='0' channel='153' rssi='37' Station is a Win11 HP laptop. None of these were seen before upgrade to 29.4.1

RaphaelL · ‎Oct 30 2022

We have 20 Hubs of MX450 and we are balancing 50-120 sites depending on the size. Depending on the load it is pretty easy to hit over 80% utilization. No full tunnel. BGP is on.

RaphaelL · ‎Oct 26 2022

No , this is currently bugged. I have an open case for many months. If 1 device has 150 failed auths, the API will log them all , but the dashboard may only report 1 or way fewer. I would suggest to open a case to put more pressure 🙂

RaphaelL · ‎Oct 25 2022

What endpoint are you using ?

RaphaelL · ‎Oct 24 2022

IMO the best way to do this is under a single SSID + None ( Direct Access ). Also configuring the SSID RADIUS attribute specifying group policy name to AirSpace-ACL-Name to allow ISE to push the Group Policy to your BYOD and override the vlan to separate your BYODs from your corporate assets. It is only a suggestion. Feel free to modify to your needs and security needs.

RaphaelL · ‎Oct 24 2022

Also , If you mouse over the 'connectivity' , you might not be able to see much ... : Half of the box is hidden

RaphaelL · ‎Oct 24 2022

End of the story : Case is closed. Meraki says that it is normal and expected to have 2 different behavior on the same product familiy. Well we choose our fights. Clearly lost that one.

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges