Meraki

KarstenI

@DarrenOC All of them??? 😥

KarstenI

It's what Meraki's documentation suggests. But you are no Network Admin if you never brought down a network due to STP misconfiguration ... 😉 The other option can be more stable as it doesn't rely on STP to disable ports on the internal switch. All ports to the MX are active and forwarding.

KarstenI

If you ask me, yes. If you ask @PhilipDAth he would suggest a solution that doesn't need STP to disable a port. https://cyber-fi.net/index.php/2022/03/13/how-to-connect-the-meraki-mx-to-ms-switches/

KarstenI

An Ethernet-cable is more secure than a switch. 🙂

KarstenI

That would be the best, as it also removes one point of failure. But, to my experience, most ISPs don't do that. Why doesn't the customer like it?

KarstenI

The dashboard doesn't like seeing the same flow on both sides of the firewall. It's no problem if the traffic behind the firewall is on a switch in a separate dashboard network.

KarstenI

I am a big believer in having dedicated WAN switches. Connecting the Firewall to the ISP on the LAN side introduced a physical bypass around the firewall, which is a no-go for me. I typically use non-Meraki switches with 8 or 16 ports for that: CBS350 Catalyst1000, 1300 Mikrotik But sometimes also Meraki MS (in a separate Dashboard network due to client sampling). These WAN-Switches connect to a Firewall DMZ for management.

KarstenI

I just learned something new today in the Enterprise Networking Webex group: https://documentation.meraki.com/Platform_Management/Product_Information/Licensing/Meraki_Licensing/Cisco_Cloud_Entitlement_for_DNA No extra license needed for Catalyst Cloud management until 2029.

KarstenI

@r2kat explained the two most common cases. There is one more: If you add an older MR to an existing network, it gets the last supported version for this model also if it's older that the network version. For example: A newly added MR52 will run 30.7.1 even if the network runs 32.1.x

KarstenI

One very important piece of information is missing in the documentation: What happens when no logging destination is reachable? Will forwarding on the MX stop the same way as the default behavior on the ASA when TCP is used?

KarstenI

It all depends on how do you want to connect them. But having a client and a printer on one port is at least very uncommon. Having a telephone and a client behind the phone is used quite often. But not printers. Typically they have their dedicated ports.

KarstenI · ‎Feb 17 2026

Oh yes, I am also waiting for an improvement for this. Anyone remembers what "Meraki" initially stood for?

KarstenI · ‎Feb 17 2026

The main question is how you want to have it? When you write "MS-Chapv2", I assume that you are using 802.1X with PEAP here. The best way would be to go paswordless with certificates. With username/password there are multiple options how your supplicant can be configured: Ask for credentials on every connect (which is likely what you have now) Use Single Sign On with the AD credentials which can be cached for later authentications Use stored credentials for the Authentication. How should it be?

KarstenI · ‎Feb 16 2026

Best is to ask your Cisco partner that sold this to you for a quote. He knows what you need for renewal. If something doesn't work as expected, you have a grace period of one month.

KarstenI · ‎Feb 8 2026

Yes, quite stable. I just have to ignore that the update to 19.1 bricked my MX75 ... 😎

KarstenI · ‎Feb 6 2026

You have 3288 critical networks??? 😱

KarstenI · ‎Feb 6 2026

I am not really sure about that one. Group15 should be much slower than the already available Group14, and for Gr21, I am not sure about availability on other platforms. I had hoped for Group19, which is the de facto standard everywhere else. And it is only for key exchange; throughput will likely remain unchanged unless there are additional optimizations.

KarstenI · ‎Feb 3 2026

The public IP is only the IP which is used to reach the internet. This can easily be behind a CGNAT. What is the device in front if your MX? Can you login to that device? If there is a public IP on the WAN and you can setup port forwarding rules, then Remote Access should work.

KarstenI · ‎Feb 3 2026

Not sure about other countries, but in Germany, I see much more RFC1918 than 100.64/10 on the WAN side. They didn't really adapt to that range yet. But most are in the 10-network and not 192.168-network. And 192.168.1.x/24 is really quite unususal as it will too often overlap with the customers internal addresses.

KarstenI · ‎Feb 2 2026

it's shown under "Other available versions" on my dashboard.

KarstenI · ‎Jan 27 2026

Using the same license is possible while you are still in tzhe CoTerm licensing model. The moment you move to Subscription, these APs need different Licenses. For your coverage Area: Yes, different APs have different radiation patterns. That's the reason a new wireless design should ideally be done for the new intended AP model.

KarstenI · ‎Jan 26 2026

@Tony-Sydney-AU: Bring back Miles! 😉 And congratulations everyone.

KarstenI · ‎Jan 26 2026

Oh, good point. Easy to forget when you have never seen 99% of the devices you manage. 🙂

KarstenI · ‎Jan 26 2026

Actually, I was thinking about going from one MR model to another, like you had the MR32 and go to MR36. Same procedere. For MR-Enterprise, do you mean CoTerm Licensing? Then everything stays the same for the licensing.

KarstenI · ‎Jan 26 2026

The most important thing is that CW917x needs a different license when you are already on Meraki Subscription. That's a real Pita. Other than that, just swap them as before with MR-X -> MR-Y.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges