Wasn't there a technical issue what the entire 9500H series with UADP chips to be doing client analytics on?  Usually the clients live on the 9400/9300/9200 and those platforms should fully support the clients traffic analytics. ... View more

You will need to stop conflating the two in your mind or you won't be able to grasp the concept.   The bandwidth limit (either obey or custom) will apply to the traffic matching the rule or matching no rules and just uses the configured per client limit.  This applies bi-directionally.  So less desired downstream traffic can be throttled this way. The high medium low queue is only applying when you have traffic stuck in buffer waiting for it to be emptied.  Usually this will only apply to upstream internet traffic since the bandwidth of the WAN circuit is usually lower than the link between the MX and the LAN. The only scenario you could have where you for some weird reason configured a high priority but low bandwidth limit to certain traffic you could have that the buffer will not be fully used for the high traffic if it is limited due to the bw limit configured.  So in that case the rules will apply normally.  The high queue will not fully use it's bw and leave some for the lower queue unless you have more high prio traffic from another client at the same time. ... View more

They are always based on the value set on the WAN interface. So to clarify further: the 4/7, 2/7, 1/7 are minimal guarantees.  So if a lower class traffic needs more and upper classes don't the upper bw will be yielded to a lower class. So in case of no congestion, the priority values will not have any effect but the bw limitations will. From a logic standpoint you will have to look at it this way. Only when there are packets buffered and waiting to be sent over the WAN connection due to a lower upload speed the packest will be serviced according to their queues.  So realtime queue gets serviced first until empty.  Then the bandwidth queues start with first high queue.  If that queue doesn't need 4/7th of the bw to be serviced fully then it will yield the rest to the medium queue.  Then the medium queue gets the 2/7 + extra it got from the high queue.  If that isn't necessary, all the rest goes down to the low queue which then has 1/7 + what it received from the medium queue. I don't think there are formal best practices on Meraki perse but Cisco itself has documents explaning the 4, 8 and 12 class documents and associated design guides if you want to geek out.   What I personally use in Meraki MX are the following: My first rule is matching in the Category Voice and Video conferencing but matching each AUDIO category inside.  And set that one to ignore bw limit + DSCP EF.  (Btw WiFi also has a traffic shaping page and there you can also set the L2 PCP tag which whould be set to 6). My second rule is matching ALL Voice and Video conferencing.  Setting that prio to high, ignore bw limit and giving it AF41.   If you want to allow fluent streaming video like Youtube then my next rule matches on streaming where I set prio to high, limit to either per client limit or custom limit and DSCP to AF31. Then I match all business relevant traffic like databases, work apps, also remote management for us networking guys 😉  That gets medium, ignore bw and AF21.   Then we get to bulk data where email, filetransfers are put.  There you can optionally set bw limit but priority is medium or low with AF11.   Then finally we get the undesired category that contains advertising, online filetransfers etc.  Those also get low prio, have a strict bw limit and get the CS1 tag. ... View more

Right above your matching rules you have the per-client limit.  In your matching rule you can either obey that limit, ignore it (so go over it)  or set a custom limit. ... View more

Hello, For these configurations you will indeed find everything you need on the traffic shaping page on the Security & SD-WAN menu. The per client bw limit does not directly impact the priority.  You can configure them both on one matching rule but the effects don't impact each other directly. You will find that the bandwith you set on your uplink in that page is actually being enforced in the form of traffic shaping.  So if you have 50 Mbps uplink but you configure 25 Mbps uplink then the MX will limit upload to 25 Mbps.  And yes the calculations for High, Medium, Low are made directly of the bandwidth you have set. Keep in mind that with priority you can definitely influence upstream traffic but downstream traffic is coming from the internet will come at your firewall depending on the bandwidth over the internet.  Meaning you can't really influence incoming packets. This is why throttling less desired or bulk latency insensitive traffic to a lower per client limit is desirable. There is also a hidden realtime queue, which is automatically applied to traffic that has been marked as DSCP PHB -> EF.  So while you can match on voice traffic you cannot choose realtime but you can set the DSCP value accordingly to enforce it that way. ... View more

For me the most annoying thing is that due to the setup to make everything too "simple" we have too many hard coupled configurations. It would be so handy to be able to attach L7 rules to individual L3/4 rules instead of always applying them globally.  The best example of this is if you want to block some countries like China, but then some elektrician comes with a few camera's that just have to be able to talk to Chinese IP's to work.  Then you have to open bidirection communcation to China for EVERYTHING. Similar problem in the IPsec VPN configuration where local networks are tied to the AutoVPN local networks which shouldn't be the same. ... View more

Hey, when running 80 MHz channels, you could be able to achieve a PHY rate of 1200 but only if you are within a high receive strength. If you are using 40 MHz channels then you will most likely get up to PHY up to 570. You have to take into account that most clients have 1x1 or 2x2 antenna configurations. The question of course is: does your application require those high speeds or are you just doing it for kicks/speedtests? ... View more

That's a tough one. In the switchports page you can filter both switches out and port numbers. So you could do (switch:SWMS225 OR switch:SWC9200) AND port:1 Or have two tabs open with each switch's ports filtered and just change the settings for each identical group of ports at a time. Alternatively if you are versed with the dashboard API you could read the ports out that way and use an action batch to port config over. ... View more

A meraki AP will only go to repeater mode if the cable that it is connected to does not provide a link to the internet. This usually means a bad cable that is good enough to provide PoE but no connectivity. If you do have a valid ethernet connection but can't get an IP on the AP due to no static that is valid and no DHCP server on the segment, then your AP will blink orange. ... View more

We also had some issues with distributors not really having mastered the whole Meraki-Sub and Cisco-Sub thing and we had customers that were at risk of being disabled.  So in those cases I had to make a Meraki support case to extend the period before finally adding the new subscription type licenses. ... View more

@KarstenI question: Since iPSK without radius cannot work due to the fact SAE is made to prevent bruteforcing. However iPSK with radius, do you see that as a possibility for SAE or does the whole authentication frame already cause issues for that? ... View more

How are you handling your licensing? Was your 3 year dna license finished and did you get a separate Meraki license or did you have to buy double? ... View more

Do the new cisco claim codes actually work? I found since they are using cisco claim codes (no longer the  handy 5S or 4C numbers) that these weren't being accepted and I have to add all serials one per line... ... View more

You should do an snmpwalk to see what number in the OID is being used as the index like @alemabrahao has said. Then you can reference those OID's in your software of choice. ... View more

RSSI is the received signal strength indicator. A client that is at or past the edge of the designed coverage cel will have a low RSSI (-72 or below). Since bumping up the power on the access point will only provide further reach downstream, your client will not be able to send back at a higher power since that device is usually limited by it's capabilities.  So this means you probably are having coverage holes and need to measure this in a site survey to resolve. ... View more

If you want to support multiple vlans it might have some challenges. I do know there is some form of vlan support on the meshing since last year but it does come with some limitations. You might want to look into the Cisco URWB solution instead for a point to point connection. There you can use IW9165D's that also support an external antenna type but the internal antenna has a 15 dB gain which is awesome for longer distances.  These can be bought standalone and I'm not 100% sure but if you use them in a point to point manner you either need essentials licensing or none at all. ... View more

Oh really, I didn't know you had to prune all those vlans before joining it to dashboard. Normally if they start out in vlan 1 you can then just use the vlan database function inside the vlan profiles on dashboard to limit the vlans. ... View more

In the EU we have the new RED directive which causes long delays on previous WiFi generations so ordering WiFi 7 hardware is faster. However since outdoor models (with the exception of the stadium model which costs quite a bit more) it might be a possible reason to either delay the outdoor deployment or keep with 6E. I also take into account lifecycle management and try to buy the newer stuff when possible to have a longer life on the AP's. ... View more

That one is kinda... expensive 😜 ... View more

In policy based IPsec VPN you would also need to have directly connected VPN from the spokes to the other hub and spoke to be able to reach those subnets. The whole hub and spoke thing only kinds within AutoVPN inside the same org. But you can just start VPNs from spokes to networks in the other org. ... View more

If you only route internal subnets over your SD-WAN (exit hub is NOT configured) then you will route directly from site 4 to site 1 if the destination is at site 1. If you are talking about an internet application in this first case the traffic will directly go to the internet at site 4. However if you DO configure an exit hub, then all your traffic from all your sites will be to that exit hub before going to the internet. ... View more

How are you routing from your MX105 to your Huawei cloud environment?  Do you use directly connected VLANs or do you use a transit with either static routes or BGP peering session? In case of local VLANs, just enable them for AutoVPN routing in the site to site VPN page. In case of static routes you can also just enable them. In case of BGP dynamic routing, you have to make sure your eBGP session between the MX and your Huawei next hop is in an established states and you received and set prefixes. ... View more