Meraki

GIdenJoe · ‎Dec 3 2023

You don't have any direct interfaces on the LAN side of an MX. However defining a VLAN and having that VLAN on an access port on the firewall or as native and only VLAN on a port is basically the same as defining an "interface" on the other types of firewalls. Do mind that indeed some needed features are missing like the spanning-tree support and port-channel/LACP support as alemabrahao mentioned.

GIdenJoe · ‎Dec 3 2023

@networkingat20the Meraki official stacking cables come in 50cm,1 meter and 3 meter variants. I have found that the 50 cm stacking cables can be connected between two switches on the back ports if you have no more than 4U between them. So if you for example have a rack with a few switches and each switch is no more than 4U apart you can stack them by using 50cm between each switch. In case of maximum 8U you can use the 1 meter cables. However you still need to complete the loop by connecting the bottom switch with the top one again and usually you need a 3 meter cable for this.

GIdenJoe · ‎Dec 3 2023

Virtual stacking is a dashboard convenience feature. It does not do anything on the backplane of the device. So in essence the MS225 only does physical stacking with the 40G DAC cables on the back.

GIdenJoe · ‎Dec 3 2023

It's quite easy actually. The MR76 has two sets of ports. The two on the top are for 2.4 GHz and the two on the bottom are for 5 GHz. The Meraki antennas themselves are the following (you also have single band antennas but we will focus on the dual band ones since you can use them on any antenna port. MA-ANT-20: This partnumber contains 2 stick antennas that screw directly on the N-type connectors on the AP and provide the typical 360 degree donut horizontal coverage if you wall or pole mount the AP. This antenna has the least range but provides the full circle. MA-ANT-25: This partnumber contains 1 patch antenna with 2 short coax leads that connect to or both 2.4 GHz connectors or both 5 GHz connectors. Do not connect one antenna to one 2.4 GHz connector and one 5 GHz connector!! This antenna provides 180 degree coverage with moderate distance. If the intention is to provide both bands you should order 2x this partnumber and connect one antenna to both 2.4 ports and the other to the 5 ports. Aim them in the same direction. MA-ANT-27: this is roughly the same as the previous as far as cables and connections go. However this antenna has a 120 degree coverage and significantly higher range than the previous one. In normal use cases where each outdoor AP is wired to the network you usually chose 2x the same antenna partnumber per AP and install them like this. If you only want to serve one band you can omit one of the parts but you will need to buy weatherproof N-type caps to prevent moisture ingress. In a specialized use case for example the AP will not be wired directly to the network but will be used as a mesh AP then you could have one MA-ANT-27 aimed at the root AP on one band and provide client coverage on the other band using MA-ANT-20 instead.

GIdenJoe · ‎Dec 3 2023

Hmm, you'll have to check if your method lists (specifically aaa authorization method lists are still matching). So check if you still have aaa authorization exec default group <ISE-group>

GIdenJoe · ‎Dec 3 2023

Good luck to all! I hope quality is graded higher than quantity though 😉

GIdenJoe · ‎Dec 3 2023

On the wireless front we have only seen new models being supported with both persona's. I believe both development teams need input in the hardware to create a fully compatible model with software support.

GIdenJoe · ‎Nov 29 2023

If you want to use the classic co-term licensing or the per device licensing you buy the SKU's per model of MS switch or MX appliance. Only access points and camera's each have a SKU that is independent of the model of device. For the MX you need to choose a license tier for your entire dashboard org. (exceptions are vMX and Z3/4 appliances). For AP's you can mix and match. So a network can have an MX with advanced security with switches that are enterprise and AP's that are enterprise. In per device licensing you can mix and match between networks. So you can have 1 network with MR advanced and another with MR enterprise. There is however the all new subscription license feature which binds everything per network. However this is quite new and I need to have a good read at that documentation. 😉

GIdenJoe · ‎Nov 29 2023

- The RF profiles section should definitely include basic topics like how much a typical client can transmit and how you should plan according to your client capabilities. - When you should use client balancing and when not to. - How to use AP neighbors to see if you have atleast another AP with enough power to be able to roam between those two AP's and segway into roaming analytics. - The importance of importing floorplans and placing your AP's on them. - Multiple SSID management frame overhead and it's effects on airtime. - Why 5 GHz transmission is required in a 6 GHz deployment to have the out of band discovery of the network on 6 GHz. - What 6 GHz requires to work with. (WPA3)

GIdenJoe · ‎Nov 24 2023

Looks like a false positive then. Perhaps it can be that the MX does not reach dashboard fully via WAN2 but the rest of the internet works fine causing the VPN traffic to work too.

GIdenJoe · ‎Nov 24 2023

Nope alas it only supports regular SPAN. If you want short captures remotely than you can go via the dashboard. Else you will need a local device on the switch for capturing the normal SPAN session.

GIdenJoe · ‎Nov 24 2023

A device behind an MX will be NAT'ed unless it is in concentrator mode. In that last case you will not be able to support it. Otherwise in the normal routed mode your ESP endpoint will just encapsulate ESP inside UDP port 4500. The MX itself when making IPsec VPN's will always use ESP for encapsulation. AutoVPN is proprietary and does not use standards based IPsec.

GIdenJoe · ‎Nov 24 2023

Since the posture check is on the endpoint itself ISE will decide what to send to the switch for network access. There is no other input needed than what the endpoint agent provides. So the switch will not need to use any special features for it to work.

GIdenJoe · ‎Nov 24 2023

What power are your AP's transmitting at? Do you have decent dual AP coverage on each floor individually. Are you using client balancing and if yes do you have alot of clients on your AP's? Is there interference? The Meraki dashboard has already given you clues that clients are doing suboptimal roams whichs means you probably have a combination of too many clients on single AP's and not enough secondary AP coverage causing your office clients to roam to AP's too far away. The best course of action now is to invest in a site survey from a professional that can measure primary signal strength, secondary, airtime and interference that will probably result in shifting some AP's around and tuning the channel plans and signalstrengths and perhaps remove AP's in some areas but add them in others.

GIdenJoe · ‎Nov 21 2023

You'll need to indeed use a syslog server and parse the firewall events in it. Don't forget to discard the flow_start and flow_end events. At the end of the firewall events you have a matching statement that should make it obvious which actual rule it is matching. The rule number or name is NOT in the log. Once you have filtered out the events you want you only need a linecount to get your counters.

GIdenJoe · ‎Nov 18 2023

I guess you won't technically be allowed to install this AP in ETSI area for now since it has external antenna ports.

GIdenJoe · ‎Nov 16 2023

You would be better off using a BGP peering between your Cisco devices and both Hubs and then redistribute those routes into your IGP. With the implementation of BGP on Meraki SD-WAN you can actually select a primary hub and then a lower priority secondary hub which will use AS-prepending to make that route less desirable. You can even have split where some sites use the left hub and other sites use the right hub. Your hubs need to be in concentrator mode though.

GIdenJoe · ‎Nov 16 2023

In dashboard you can go to Network wide -> packet capture. Then select for Access Points. Then tag the correct access point. Then below that you have the option to download the packet capture or view it on screen (download gives the option to view it in wireshark which is better). And a text box for CAPTURE filters (not display filters). In that box just put the filter: port 1812 and start capturing right before a client connects to the AP on the radius SSID and see the exchange of messages between AP and Radius server.

GIdenJoe · ‎Nov 16 2023

If you capture on the LAN side of the MX you should see the packets coming from a client in your MX network towards your MX (source MAC address client, dest MAC address Meraki MX). However on the WAN side you could only see ESP packets leaving your WAN IP towards the WAN IP of the SRX. Looking inside the site 2 site VPN is definitely possible with AutoVPN but I'm not exactly sure with IPsec VPN if this works. Should test it out 😉 In the logging you should make sure you have a CHILD_SA with all the necessary traffic selectors active before you can see traffic actually passing. The little green dot in the VPN status page is NOT enough. The last thing that could be wrong is if you have any IPsec VPN firewall rules on the VPN page.

GIdenJoe · ‎Nov 16 2023

alemabrahao is correct. CGNAT will stop any incoming connections. If you have an SD-WAN you could have the client VPN enter a different site (or even cloud site) and tunnel the client VPN subnet that way.

GIdenJoe · ‎Nov 16 2023

Make sure ALL your AP's have been added as Radius clients on your radius server and that their pre shared key is correct. Then you should be looking at your radius logs to see what is going on. You can also capture traffic leaving the AP on the wired port and filter on port 1812 to see the conversation between the AP and the radius server. You get at treasure trove of information like the AV pairs exchanged. Also you may be not matching the incoming session in your policy list. Wireless has a different NAS-port type than a switch.

GIdenJoe · ‎Nov 11 2023

Bad roams or suboptimal roams usually has to do with the client choosing the wrong AP to roam to. In the roaming analytics you should see the RSSI of the previous AP and the next AP. If the next AP has the same or lower RSSI than the old one the roam is suboptimal or bad. If that is the case your issue is wireless design, not wired network. The roaming analytics feature is quite new so you may not have had these messages before.

GIdenJoe · ‎Nov 11 2023

You are talking about auto VPN between an MX and a vMX. That means you can just choose 1 WAN or concurrently both WAN's. You don't need to do anything. That means you don't need an IPsec VPN as backup since the autoVPN is already redundant via your both WAN's.

GIdenJoe · ‎Nov 11 2023

Your AP's are storing all the PSK's and doing the brute force on each key to be able to come to the correct one to continue the 4 way handshake. If you are getting issues with certain clients using key 1 and other clients using the same key don't have the issue you could be running into a bug on the AP and maybe you should retry after rebooting the AP. Maybe check if you have a recent update.

GIdenJoe · ‎Nov 11 2023

If you are doing routed subnets on your MS switch then the first interface needs to be your upstream interface you use for routing to the internet. That's why the GUI is built this way. They make you do your upstream VLAN first that contains the 0.0.0.0/0 route. Only after you have done that you can create the other interfaces for local routing.

About GIdenJoe

GIdenJoe

Joey Debra

Community Record

Badges