Meraki

RaphaelL · ‎Mar 31 2022

I had seen your answer. OP didn't mention anything about ICMP...

RaphaelL · ‎Mar 31 2022

Have you tried to reboot the MX ? There is probably a flow table that won't get updated until the flow times out / expires.

RaphaelL · ‎Mar 28 2022

Ahhhhhhhhh ! Thanks ! Completly missed it !

RaphaelL · ‎Mar 23 2022

Great ! We now have answers to our questions 1- CC:03:D9 is always used on MX in Warm Space ( doesn't matter if it's concentrator or routed mode ) 2 - This ''issue'' is fixed on the MX 16.X branch , and seems to have been introduced in MX 15.XX and MIGHT be fixed in 15.44.1 ( still to be confirmed ) Thanks a lot for your time ! : )

RaphaelL · ‎Mar 22 2022

Hi , We have multiple warm spaces and I have been taking packet capures and this is what I found : MX450 Warm Space 15.40 VRRP MAC ADDRESS : e0:cb:bc:a3:9b:f8 burned-in MAC : e0:cb:bc:a3:9b:f8 ( Passthrough ) MX450 Warm Space 15.42.1 VRRP MAC ADDRESS : 2c:3f:0b:e6:ba:47 burned-in MAC : 2c:3f:0b:e6:ba:47 ( Passthrough ) MX250 Warm Space 14.53 VRRP MAC ADDRESS : cc:03:d9:25:be:f9 burned-in MAC : f8:9e:28:25:be:f9 ( Routed ) Does anyone have a Warm space with 15.44 or 15.44.1 that is willing to do a packet capture and compare with my finding ? It MIGHT be fixed in 15.44 or 15.44.1 but I'm not too sure. Also , the MS documentation states : "The virutal MAC address will always begin with 88-15-44" then procedes to show a screenshot with the VRRP Mac adress from the RFC 5798 ( 00-00-5E-00-01-XX , where XX = RID ). It's a bit confusing and there is a typo ( virutal ). https://documentation.meraki.com/MS/Layer_3_Switching/MS_Warm_Spare_(VRRP)_Overview The MX documentation doesn't state anything about the MAC adress so you would assume it is under the VRRP standard , which is false. It would be nice to include how the MAC is selected ( The First 3 octets for the virtual mac address will be "cc:03:d9" and is based on Primary MX. https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair Some will say that I'm picky , you are 100% right 🙂

RaphaelL · ‎Mar 18 2022

I will be increasing our timeout to 5 seconds , but we don't have currently issues with timeouts. However you seem to be having issues with it.

RaphaelL · ‎Mar 18 2022

Can you do a packet capture and calculate how long does the request take ? First packet to the last one ( Access-Accept ). If it is over 1000ms , it will we flagged as didnt respond.

RaphaelL · ‎Mar 18 2022

Update. It seems that the error is not showing the same description from Wireless -> Health -> Connection log versus Wireless -> Health -> Timeline In the Timeline page you will see : Client X had a failed connection to SSID Y on AP Z during authentication because the auth server rejected the auth request. In the Connection Log : Client made an 802.1X authentication request to the RADIUS server, but it did not respond.radius_ip='XX.XX.XX.XX' reason='radius_login_failure' radio='1' vap='0' channel='104' rssi='50' I know this case is a bit different from yours , but can you check if you are seeing the same log message in the Timeline page and post the results between Timeline and Connection log. Thanks ,

RaphaelL · ‎Mar 17 2022

I just opened a case regarding that. We are on 27.7.1 and 28.5 and I keep seeing "Client made an 802.1X authentication request to the RADIUS server, but it did not respond." Upon taking a packet capture we can see the Access-Reject from our Radius server. The request was made in 300-400ms which is below the default timeout. To be continued...

RaphaelL · ‎Mar 17 2022

The default is 1s , and according to Cisco's documentation it seems to be 5s on Cisco's WLC . Strange to see such a big difference between 2 timeouts. I will try to adjust it and monitor the difference in the logs

RaphaelL · ‎Mar 17 2022

Following this thread. We do have lots of these , but never had the time to troubleshoot it properly.

RaphaelL · ‎Mar 10 2022

I think 28.6 fixes some bugs related to PKMID which ''could'' slow association time. That might be worth a try !

RaphaelL · ‎Mar 10 2022

Out of curiosity , what MR firmware version are you running ?

RaphaelL · ‎Mar 9 2022

Hi , I wanted to create a simple SSID for my guest network. Upon entering the correct PSK , I want my guess to receive my splash page with a simple addition : an embed youtube video on autoplay ( rickroll'd lol ). So I created a Custom Theme in the Wireless -> Splash page. In the continue.html file I wanted to insert this snippet : <iframe src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1" allow='autoplay'></iframe> The code is working fine on Chrome, but Meraki won't let me finish my evil plan. Everytime I hit save , it goes back to the default ''continue.html'' file. I was able to edit it ( ex : remove the footer ) , so that proves that save button is working , but it might not like my insertion of my iframe. Is there any limitation to that feature ? Maybe Miles has the answer 🙂 ? Thanks !

RaphaelL · ‎Mar 9 2022

Are you not using auto-vpn between your 2 Meraki products ? I'm so confused...

RaphaelL · ‎Mar 9 2022

Hi , "As soon as I disable site to site tunnel , client VPN works" this was a good indicator that you were in full tunnel and lan trafic from 172.10.0.0/16 is routed through the S2S. If thats not the case , do you have a firewall rule to allow the outbound trafic ( on Site B )

RaphaelL · ‎Mar 9 2022

You are probably in full tunnel mode. Your Client VPN flow is going thru your VPN tunnel and not over the internet.

RaphaelL · ‎Mar 9 2022

Hi , As stated by rymiles this is the SSID used for Mesh. You can disable it ( it is a Network-Wide setting ) : Meraki allows the ability to disable mesh on the Meraki Access Points. The toggle is a network-wide setting and is configured under Network-wide > Configure > General > Device configuration Disabling mesh will stop the APs from broadcasting the Mesh SSID to save airtime. https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Wireless_Mesh_Networking

RaphaelL · ‎Mar 8 2022

Hi , There is no manual priority to elect a master switch. To my knowledge the switch with the lowest MAC will be the master.

RaphaelL · ‎Mar 8 2022

That rule needs to be a Site-To-Site VPN rule and not a L3 firewall rule . Correct me if I'm wrong

RaphaelL · ‎Mar 7 2022

@PhilipDAth , I'm trying to move from RSTP ( spanning-tree mode rapid-pvst ) to MSTP single instance as suggested. What are the benefits ? The convergence time should be the same ( 3 hello x 2 seconds ) , no ? Am I missing something obvious ? Ps : I have read your posts on cisco also , but I can't make my mind on it 🙂 Thanks ,

RaphaelL · ‎Mar 7 2022

That doesn't make any sense. If your networks are combined , getNetworkClients will return ALL clients from the network, including those from the MX , MS , MR.

RaphaelL · ‎Mar 7 2022

I was able to test both endpoints and they are returning the correct info. Are you clients displayed in Network-Wide -> Clients ?

RaphaelL · ‎Mar 7 2022

No mention of clients being wireless in this post

RaphaelL · ‎Mar 4 2022

Awww I was 10 points away from the top 4 ! Better luck next month 🙂 Well done everyone !

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges