@PhilipDAth, small correction Indeed mGig ports do not support 10Mbps anymore but they do support 100Mbps just like the mGig Catalyst switches do. Also from the datasheet: Multi-gigabit (mGig) ports support 100M/1/2.5/5/10G of bandwidth over copper cabling ... View more

Both Cisco and Meraki AP's display their power level as being the IR, not the EIRP. So you can only set your power level up to max EIRP minus antenna gain. So for 2.4 usually for most Meraki AP's you'll be around max 14 to 15 dBm. However I have found that survey mode does not always take this into account.   Also Survey mode is very buggy if you're not using an MR33. Alot of AP's in survey mode suddenly start claiming they never connected to the cloud and disallow you to change the config or they simply crash. ... View more

Hey guys, I'm really excited about these fully certified 802.11ax (Wi-Fi 6 AP's) and I can't wait to have the antenna patterns in Ekahau.   However I saw a few chart errors in the datasheets. The MR36 is missing the 5 GHz XY plane chart is missing. And the drawing on the right with the AP and the colored X Y Z is wrong. The AP inside the chart itself is correct. X points up and should only point sideways of the you look at the shortest edge (sideview) of the AP not the longest edge (bottom)  And this error is on all three datasheets. ... View more

Group policies calling other group policies could be a nice feature. Say you want to authorize a user on your network and give a filter-id, but some of the rules only apply timebased. It would be handy to call child policies that have different timeranges or additive blocking or allowing rules. ... View more

- QoS priority queue - NBAR also for better matching traffic classes in QoS policy and netflow export - Full MSTP support - PACL, RACL, MACACL, dACL, per user ACL (not just VACL's like we have now) - Static etherchannel support - Local feature debugging and status of protocols!!! (STP and STP guard states, UDLD,...) - Trunk ports as STP edge ports - Better control over SPAN session(s) like ingress traffic and dot1q replication Just to name a few. ... View more

These are not span sessions like you have on catalyst switches but only temporary mirrors. I'm not even sure if the destination port even replicates the encapsulation or not or if it keeps it untagged or tags it always depending on the source VLAN. At the moment you can only use netflow data to send to your security collector.   Maybe in the future the MS390 will support encrypted traffic analytics like Catalyst does and that could be a better way to support your case. ... View more

Yes your picture is completely correct in terms of HA setup and STP behavior. In a stack only have four uplinks where two will be blocked because the BPDU's leave 1/0/1 and 1/0/2 with a lower Port-ID than 2/0/1 and 2/0/2 and the MX just forwards the STP messages since it does not participate in it. ... View more

@cmrif the link of SW02 to the warm spare fails or SW02 itself fails you get a dual active scenario because the warm spare mx no longer receives VRRP heartbeats.  In this case you can only save yourself by downlinking the WAN links from both MX'es each to their respective SW they are connected to on the LAN side so the WAN also goes down for the warmspare.  Else you get two MX'es that claim ownership of the upstream IP!! ... View more

No you actually should connect two stacked switches with 4 links to a HA pair MX'es. You will have two links blocked but you will have full redundancy if one stackmember fails or one MX fails or a link between them. So example: 2 MX appliances and 2 MS250's; Connect MX active port 3 to SW01 on port 47 and port 4 to SW02 port 48. Then connect MX warm spare port 3 to SW02 port 47 and port 4 to SW01 port 48. Make sure you DO NOT SELECT drop untagged packets on the MX trunk going downstream but use a DATA VLAN as native so STP packets will flow. You should see an STP block on SW02 ports 47 and 48. ... View more

To be considered compliant with 802.3af or at, the midspan must deliver between 48 and 57 Volts. ... View more

There are plenty of different approaches but simple MAC filtering is dirty on Meraki. In that case you need to enable splash login without valid users and just whitelist certain devices (based on MAC address) or give them a group policy that bypasses the splash screen.  Other people will be able to join the SSID but will get a splash page where they can't login to. Else you need a radius server, or Meraki MDM if all your endpoints are Windows, MacOS,iOS or android. I think you'll need to do some extra homework on this 😕 ... View more

I'd recommend two access points for that amount of users. MR74 if most of your end devices have no more than 2x2 radios.  MR84 if you want more speed and you have devices with 3x3 or better radios. Antenna choice will depend on your coverage area. In most cases you can get way with 2x a set of MA-ANT-20 per AP.  If your AP is mounted on a pole in more centrally in your coverage area this would be the way to go.  However if your AP's will be mounted against a building you could use a semi-directional patch antenna MA-ANT25 to have the coverage point away from the building. (1 per AP) There is MAC authentication possible but the builtin solution is not sufficient.  You'd need an external radius server where you can point your AP's to where the MAC addresses are stored. ... View more

So if I read this correctly you won't need an SM enrolled devices only access SSID but you can change this to a WPA2-Enterprise SSID. And with Sentry coupling you can still enforce the correct authorization on each user based on the pushed security tags. Basically it's a mini ISE 😛 ... View more

You need to first connect the MR to the internet. Then make a NAT SSID. Then using NAT SSID connect to the local status page and put the AP in site survey mode.   The AP will reboot and broadcast site-survey:MACADDRESS   You can now do range testing. ... View more

It depends on a few factors. First how wide is your channel on the AP (20, 40, 80)? Then how many spatial streams does your AP support? Then how many spatial streams does your client support? The lowest of the two previous questions counts and are you indoor with enough reflections so you actually can use those spatial streams? How clear is your channel? All that will amount on a certain MCS your client will have (on windows this is translated to a PHY rate eg: 867Mbps) If you have that and completely clear channels (80 MHz clear) and your pc does not have any slow downs due to disk reads and writes and the actual sending to the WiFi NIC then you should be able to get a topspeed of around 500 Mbps. That ideal situation however usually is out of bounds for most deployments. ... View more

The L3 header should get the marking but I haven't that the chance to test it. But it should be normal that this is implemented. The whole reason a company would choose a WAN solution instead of a public internet connection (like an MPLS connection with QoS queues from the SP) is to have that differentiated service. ... View more

You would need a full solution like Cisco ISE to profile your clients before letting them onto the network. It at least merits investigation if you can completely profile clients on OS version. ... View more

They are actually:  the 2802I or E are Aironet models. ... View more

There is a difference in how Catalyst switches enforce UDLD than the Meraki MS switches.   It is possible that when the port comes up after your reboot the Meraki switch is possibly waiting too long to begin transmitting it's own UDLD hello's and the Catalyst has already had it's multiple timeouts or the MS is transmitting UDLD hellos but not using the correct identifier.  A SPAN capture on the catalyst side (when it operates normally and when your MS had a reboot) could show more info. According to the Cisco documentation the default udld message interval is 15 seconds and the link is deemed unidirectional and shut down after 3x this so 45 seconds. So if you can't live with the 30 seconds wait time before the errdisable recovery I could suggest following workaround. Put the catalyst switch on normal mode instead of aggressive and put the MS on enforce mode. As I can read from the Meraki documentation an MS switch still checks for udld messages after the expiry so the Catalyst side would not block the link but the MS would block all other traffic but still listen for udld so it can re-enable the port at the first receipt of an udld message. ... View more

Thanks, so if I understand you correctly you don't have any control over it.  It's the app developers that choose to send their own markings. Merry Christmas back! ... View more

While we're on the subject. Is there a way you can customly push policy to apps to let their traffic be tagged a certain way on mobile devices like an iOS device? Like in windows you have a QoS policy under gpedit. Or are you completely at the mercy of the app writers? ... View more