I am not sure if "enable" is the right term here; it is a requirement from the 802.11ax-2021 amendment:   ----- snip ----- The following apply to a STA operating in the 6 GHz band: - The STA shall not use the following pre-RSNA security methods:   ...   - Open System authentication without encryption   ... ----- snap ----- and  ----- snip ----- The STA should use Opportunistic Wireless Encryption, as specified in IETF RFC 8110, when connecting in an infrastructure BSS without authentication (as a replacement for Open System authentication without encryption). ----- snap ----- ... View more

No, it's still a whole mess. My strategy is: One SSID "Guest-Fast" with OWE in 5 and 6 GHz One SSID "Guest" with Open in 2.4 GHz and 5 GHz   The guests will try the "Fast" SSID, and if that doesn't work, they typically go to the "normal" SSID and don't complain. ... View more

This is a real problem with the Meraki platform. It just hides too much important information from the admin. It's just not possible to easily spot if, for example, all clients are WPA3 and the transition mode is not needed anymore.   My advice: Don't use Transition mode. Use a new SSID for WPA3 and move compatible devices into this SSID.   Or, as Stephen Orr (Distinguished Systems Engineer at Cisco) says: "With regards to security: nothing good ever comes out of transition modes (ever)" ... View more

If you enable OWE, all clients have to support it, and all client traffic will be encrypted. The "best effort" approach, where only supported clients use OWE and clients that don't support it use the open mode, is the OWE-Transition mode, which is not supported in the stable MR release yet. I heard it is implemented in a recent MR32.x version. ... View more

Und wenn man es besonders gut machen will, dann integriert man Cisco Duo als MFA und hat im Duo-Dashboard noch viele bessere Ansichten.   Viele Grüße aus dem Norden, Karsten ... View more

Not the org name, but the network name: https://cyber-fi.net/index.php/2022/08/17/tuning-the-cisco-ise-for-meraki-networks/ ... View more

If you change the Network/Site name, make sure you don't reference that in the policies on your RADIUS server (if you use that). ... View more

There really should be a documentation of all these "can be enabled by support" gems. Knowing of this option enables some new opportunities for me. ... View more

If you have to renew now because of budget reasons, I would buy MR-Upgrade licenses that change your license level to Advanced, and depending on the purchased length, it also extends the end of the co-term. And you get many great new features for your wireless. ... View more

Ok, I'll come back on the 29th of October ... 😁 ... View more

Yes, this combination also worked for me. But I would monitor every Windows update if they changed the behavior. I consider it a bug to allow the connection, but I assume that Apple and Microsoft disagree. IMO, only Android does it correctly. ... View more

And for the SSID slots: All my WPA3-192bit SSIDs run on lower numbers. I read the document as indicating that this change is only for Wi-Fi 7. ... View more

Regarding the certificate requirements: Yes, all certs have to be at least EC-384 or RSA-3072. However, for my tests, only Android failed the connection when this requirement was not met. All the others didn't complain.   Some more Info on 192-bit mode: https://cyber-fi.net/index.php/2024/11/03/wpa3-192-bit-mode/ ... View more

This „Problem“ will luckily not limit your clients. They all work with RNR and are not dependent on PSCs while scanning.  This is especially important for Europe as the typical channel width is 40 or even 20 and half or even 3/4 if the channels are not on PSCs. ... View more

Important to mention that EasyPSK will not work with WPA3-SAE.   ... View more

On which channels are you running? I am not sure if it is still the case, but some time ago, the Sidekick2 only found SSIDs on PSCs. ... View more

Congratulations, to ... to ... TO ME!!! Welcome back to "Amy's Twelve"! 🤣 ... View more

He would need 80 MHz channels on the Dual-5 to break the 1 Gig-barrier. I would be highly relaxed with 1Gig, but monitor it. ... View more

This request doesn't make any sense at all. The data rate is highly dynamic and can even change on a frame-by-frame basis. To get 1200 MBit/s, you typically need 80 MHz channel width and perfect conditions. On my PC, where I am working at the moment, it shows me 1200 MBit/s, but I am sitting directly under the AP. The moment I leave the room, the data rate decreases. ... View more

I think at least your port profile is ok as it is "1 (additional) port and USB". ... View more

Unrelated to this problem, but it shows that IPS has false positives: The MX-IPS (balanced) dropped traffic when I tried to add a Cisco ISE to Windows AD. Something triggered the Snort rule in this traffic. ... View more

Continue collecting the Kudos; more badges are coming! ... View more

Welcome back @alemabrahao and welcome to this most prestigious club @Mloraditch! 🙂 ... View more

In general, it's the decision of the client. There can be multiple reasons for the client to do that. The first important question is how the APs are "heard" at the client location. Perhaps the AP farer away has a higher transmit power? And a classic: Is your client only 802.11n and the AP is using channel 144? The old client won't hear this AP on that channel. ... View more