You're supposed to do a packet capture on the switchport leading to the NPS server while filtering on UDP port 1812 just to see if the access-request message is even reaching the NPS server and if a response is sent back. If you have to do a dashboard capture then you will have to coordinate a test while capturing. ... View more

That's strange because the whole reason the UDP/4500 header is added in front of the ESP header is to get through NAT since NAT on most devices only supports TCP, UDP and ICMP.  The only reason you would get an ESP header right behind an IP header if the two VPN endpoints can reach each other without NAT unless for some reason NAT-T was disabled but then it would not be able to pass through a NAT.   So if you had an MX without NAT then you would never be able to match purely on ip protocol 50 or 51 since that is not supported on the MX.  You would have to allow all IP traffic towards that destination. ... View more

If a device is behind the MX it would be NAT'ed which means the IKE negotiation is done with UDP/500 and the ESP would be encapsulated within a UDP/4500.  So you could match this. However if you would have disabled NAT for this specific then it would send direct ESP behind the IP header and would only match in a rule with Any as protocol. ... View more

When you do a packet capture on port 1812 you should see access-request packets being sent from the switch and access-challenge back from the NPS server. So first make sure the messages reach the NPS server and see if the server responds. If the server does not respond then you will need to look purely at the server (are the switches present in the radius clients configuration?). If you are seeing access-reject messages from the NPS server then you are probably not matching an access rule. There are many more issues but at least start with the basics. ... View more

As of now the tunnels are policy-based VPN tunnels, so no VTI. Tag based failover is the only way for the moment. ... View more

You can use BXD SFP's on Meraki managed/monitored Catalyst switches but on native MS switches it is NOT supported.  The choice of switch is not fitting for this requirement. ... View more

You should be able to have a rough estimate how much bandwidth you could have using 20 MHz by using a taking the average PHY rate of all clients you expect to be connected to the AP and then taking about 2/3 to 1/2 of that as actual goodput. However the best thing you can do is allow for a few testing days of normal usage and just check the AP's of interest what their average airtime is.  If you keep below 50% in heavy use you should be fine using 20 MHz. ... View more

Nuff said 😉 ... View more

You may have a bad cable or the QSFP is not seated 100% inside the slot. Maybe try switching around your cables and see if the problem follows the cable or not. The speed should also be 40 Gbps. ... View more

Jep that does look bad :s It does not make sense an AP would choose 40+44 or 44+40 since that effectively causes problems for channel 36 and 48.  This would only make sense if channel 36 is disabled in the RF profile but this does look like bad behavior in the algorithm. ... View more

It has to do with the way the channels are displayed. When you select your channels in the RF profile you get like "in between" channels if you look at the 40 MHz and the 80 MHz lines. However what happens in effect that your have a primary 20 MHz channel + a secondary channels.  So 36+40, 44+48 etc etc.  Primary channels are used for all mgmt and ctrl frames and only the full 40 MHz is only used during datatransfers if your client supports it. The problem you do have to look at is that you don't have any overlapping areas where the primary channel is swapped.  You would risk more collisions when you have 2 BSS'es where one is 44+48 and the other is 48+44.  This will cause issues because channel looks clear during mgmt and ctrl frames and then collide during the data frame transmission. I also found that the auto-rf sometimes still uses a channel that has been used even within range so while it is working it is not perfect and needs checking into.  I'm hoping the new AI-RRM with the use of NDP will improve this. ... View more

I would still push the support engineer to escalate internally. This is too big of an issue to just leave it alone. I'm also curious what the technical reason would be since those switches still are regular C9300L's. As an engineer for an MSP I'm always looking for detailed information. I also recently had to ask the question about cross compatibility between BXD SFP's and C9300-M and regular MS switches.  Luckily I got an answer there before committing to a buy. I do feel your pain, damn... ... View more

If you're using a cloud based radius having a few failed auth's in between happens quite alot.  It's best to look at the logs of your radius service to see why it rejected that auth. ... View more

Yes I also found it strange that the multigig modules did not get a -M variant. ... View more

Bump.  Good question. Unless someone has a working ISE installation and a splash page going, to be able to test and capture this one is going to be hard. I suggest by starting a case.  The Meraki internals should know an answer to this.  It is a CWA like another so there should be a way to do this. ... View more

Not native on the local MX'es but I do believe in the secure connect solution you do have a form of dividing the users up into different datacenters.  Not sure if nearest is supported though. Maybe if you use the users own country you could give them the profile with the URL closest to them or just provide them all with aliases that contain a country code. ... View more

Err, hello..., new routers are called Catalyst 8000 and were released in 2020.  They were ISR and ASR and the new models now are named Catalyst.  I think it has been a while since you went onto the Cisco site my friend 😉 Here is one model for example: https://www.cisco.com/c/en/us/support/routers/catalyst-edge-ce8500-12x-router/model.html And they also have 8200 and 8300 models.   Financial apologies are accepted 😉 J/K. ... View more

The normal EIA/TIA 568.A or B should work. Normally in 802.3af and at only the blue and brown pairs are used to provide power.  So if your cables are fully wired up it should be ok. Can you show a screenshot of one port configuration and perhaps a picture of the front of your switch? ... View more

I know it's the default but check the port configs anyway 😉 Maybe even put them on PoE disabled and back on enabled after a minute. You should also check on the status of the switch to see the little lightning bolts on the switchports where you connected the AP's. ... View more

That means your MS130 is not supplying power to the AP's. Make sure PoE is enabled on the ports. ... View more

We do this all the time.  Setup a mock network to prep switches. Prep switches in our case is just bringing them online, making sure their firmware is updated, labelling and testing them. Then when they go onsite they immediately come online with their last known config and can resync with dashboard. ... View more

You're supposed to leave off the parts that are any.  I do believe there are limitations to this. A star can only be used to match anything in itself. So in your case you should match on outlook.com not *.outlook.com You can even have a / in your matching criterium something.com/something ... View more