Meraki

KarstenI

Great, this seems to be what I am looking for!

KarstenI

Nothing can beat WiFi Explorer Pro from Intuitibits (IMO).

KarstenI

Hi all, I want to get all active (primary) MX devices from all networks. What would be the best endpoint for this? Happy Christmas, Karsten

KarstenI

Wat about iterating through all appliances of the org with a short delay between each query?

KarstenI

I am missing a detailed diagram to really understand the topology.

KarstenI

This Log is always UTC, as it combines Logs from all possible time zones.

KarstenI

What a year! It will be hard to raise the bar for 2025!

KarstenI

This will never happen with the actual WPA3 as the technology directly prohibits this way of matching the passphrase. Perhaps the next iteration in the wireless security standards.

KarstenI

No, the MT sensors don't even have an IP address. You can only query the dashboard and use things like MQTT to get the data.

KarstenI

My first advice would be to move all non-IoT devices to WPA3-Enterprise (802.1X). For PPSK (named iPSK in the Meraki World), I still hope that Meraki will implement "iPSK with RADIUS" with WPA3 on MR APs. All other vendors, including Catalyst Wireless, are capable of that. But typically, I keep IoT devices on an iPSK SSID on 2,4 and 5 with just WPA2. Many of these devices can't connect with WPA3 anyhow.

KarstenI

Yes, just replace it. The config "lives" in the cloud and gets pushed to the new device when you remove the old one and add the new one. You only have to adjust the VLAN-to-port mapping and re-enable AutoVPN.

KarstenI

This is my typical use case for the Tags: All APs have the Tag "Prod-AP". All 802.1X SSIDs are configured to only get broadcasted on APs that have the Tag "Prod-AP". What is the benefit? When I need to exchange an AP, the replacement AP will start with an IP that is not yet known to the RADIUS server. If a client would already connect to this AP, the connection would fail. But without the Tag, the SSID is not announced yet, and I have time to set the DHCP reservation for the new AP. After the AP gets its "correct" IP, I set the Tag, and the SSID gets broadcasted.

KarstenI

URL filters only work when there is a URL to look at in any form. For your task, the FQDN-rules is the feature of choice: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings#FQDN_Support

KarstenI

There, you configure the servers. But you can't use them for wireless yet.

KarstenI

Oh yes, there it is. What a pity that it's not in the "easy" SSO setup. Now I have to look up how to map each attribute. But I got the path I have to follow! 👍

KarstenI

I only found time today to test this. But where are these Role Attributes configured? I don't see anything in my Duo SSO-Config.

KarstenI

I am also so waiting for this! Please Meraki ...

KarstenI

I FOUND THE GNOME! https://community.meraki.com/t5/Smart-Cameras/rename-camera/m-p/254157#M3947

KarstenI

When you say the floors have different firmware versions, I assume you have one dashboard network per floor? A Meraki Dashboard Network defines the fast-roaming domain. If a station roams from an AP in network 1 to an AP in network 2, a slow roam is expected.

KarstenI

Stable as of yesterday.

KarstenI

You are late to the party ... 😉 https://community.meraki.com/t5/Wireless/Early-Access-AP-Device-Health/m-p/256735

KarstenI

Just found it, it's even documented:

KarstenI

I don't know for sure because I don't yet run 19.1. But at least all the options (like the /30 IPsec subnet) speak for a VTI-like implementation.

KarstenI

Directly enabled; looks good! 👍

KarstenI

Wohoo, Winner!!! 🙂 And big congratulations, especially to @AnthonyCho; what a great prize!

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges