Meraki

KarstenI · ‎Jul 8 2024

We all thank you for your effort to sort out all potential problems and to report on how to do it better! 😁

KarstenI · ‎Jul 8 2024

And for the switching line, they were only talking about Catalyst-M and not the "normal" MS line.

KarstenI · ‎Jul 8 2024

Yes, I am also waiting for them to offer the option to migrate to the new license. For nearly all customers it still is the "future" because co-term is far away.

KarstenI · ‎Jul 8 2024

In the future, the upcoming Subscription Licensing can cover both under the common "MS200 Medium" license.

KarstenI · ‎Jul 6 2024

So, you want us to do your homework? Ok, the problem is not related to Meraki. It's all on the RADIUS server. When the request comes in you need to compare the SSID to the user account. If it's a student and the SSID is "Staff", send an access reject. Same if it is Staff-member connecting to the "Student" SSID.

KarstenI · ‎Jul 5 2024

You have more than one IP network on either side of the VPN? Only the first will establish: https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#NOTE_For_IKEv2 Perhaps this is the problem here.

KarstenI · ‎Jul 5 2024

Put that request in the "Give your feedback" box on the dashboard and describe your use case. But don't hold your breath for this feature. I assume the "typical" Meraki customer doesn't need any VRFs.

KarstenI · ‎Jun 29 2024

And in Germany (ETSI-Land), we don’t even know if it will happen at all.

KarstenI · ‎Jun 28 2024

The goal of MX HA is to deal with hardware failures. As long as the spare receives any heartbeats, no failover happens. These heartbeats are L2 packets; the spare doesn't have an IP address. LAN devices always communicate with the device that holds the MX's LAN IP. Here is some more information: https://documentation.meraki.com/MX/Networks_and_Routing/Routed_HA_Failover_Behavior

KarstenI · ‎Jun 28 2024

With the private IP on your WAN interface, the ISP device needs to have a port-forward for TCP and UDP 443 to your MX WAN IP.

KarstenI · ‎Jun 28 2024

No, in case of a failure, the whole box will change the active state. There is no active-active operation on the MX.

KarstenI · ‎Jun 28 2024

A troubleshooting step for these types of problems is also to factory reset the device. Often, it starts to work again after that.

KarstenI · ‎Jun 28 2024

Remember that the free MDM option is retired. You will not be able to re-enroll the devices without buying licenses for these devices.

KarstenI · ‎Jun 27 2024

Yes, you could be right.

KarstenI · ‎Jun 27 2024

That's not the way it works with Meraki. Perhaps you can query the dashboard with the help of the API and compare the result against your compliance requirements.

KarstenI · ‎Jun 27 2024

Oh, and I realize that the BSSID Details in the dashboard are not correct. I am connected to a BSSID ...63:07:ee:dd, but based on the dashboard it should be ...63:07:ee:d0.

KarstenI · ‎Jun 27 2024

What do you want eventually to achieve? With the cloud-managed approach, there is no SSH/Telnet on the devices. Only the Webserver for the local status page.

KarstenI · ‎Jun 27 2024

No one here knows about your background regarding Meraki. And you also don’t say what you already have tested. With that, these questions are more than valid.

KarstenI · ‎Jun 27 2024

Don‘t be huffish … We all want to help; but your problem description is so vague that more information is needed.

KarstenI · ‎Jun 27 2024

Please also read lines two and three in the response. In addition to that: Do you see it in the dashboard with the same credentials?

KarstenI · ‎Jun 27 2024

This still needs to be correlated to WAN1 vs. WAN2. Taking the IPs from the Appliance-Page is much easier IMHO.

KarstenI · ‎Jun 27 2024

You likely got a contract mentioning which IPs are assigned to you by which ISP. In the Appliance Status page you see which public IP you have on which WAN port and that should tell you which ISP it is.

KarstenI · ‎Jun 26 2024

You can‘t have both 802.1X and PSK on the same SSID. It’s one or the other. Well, technically it could work. But most vendors prohibit it as clients get confused with that approach.

KarstenI · ‎Jun 26 2024

You are facing the most relevant shortcoming of the Meraki MX. For extranet VPNs, you can’t control what get’s into your network. For customers with more advanced extranet uses, I typically place an ASA/FTD parallel to the MX.

KarstenI · ‎Jun 26 2024

Code 12 is a RADIUS extension for clients to query the "liveliness" of a server. NPS hasn't received any development for ages, and that is likely the reason it doesn't understand this message.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges