Congratulations @thomasthomsen ! ... View more

yeah it's a phuggin nightmare they've created for us.  fun fun fun. ... View more

Were you ever able to identify the cause and/or resolution to this. We are experiencing very very similar issues with very similar setups  ... View more

What do you mean with one system exactly? The thing that bugs me the most is the ETSI regulator and European countries putting ridiculous restrictions about not allowing outdoor AP's or external antennas on 6 GHz.  This is the reason why the CW916x line is so limited.  So you can have an SSID that is perfectly running on the indoor AP's on 6 GHz, but when you have an outdoor AP like the CW9163E, it will not enable 6 GHz because of the restrictions. ... View more

Thank you once again for all your help. I believe I’m all set now and will continue with what I’ve learned from you. ... View more

https://documentation.meraki.com/MX/Wireless/MX_and_Z-Series_Wireless_Settings#Adding_a_Z-Series_or_Wireless_MX_to_a_Wireless_Network_or_Mesh ... View more

I am not 100% confident that it would help as someone could get lost in the amount of text.   But here are my 20 cents (inflation) on this: I assume that this data is coming somehow from a database, and each entry is internally tagged to a software release and a model. In times of HTML5, I would like to have a button list at the top with all models where I can deselect all devices that are not important to me. These buttons could be preselected based on my inventory (either of the org or, which is likely more difficult, the inventory of all orgs the user has access to). ... View more

I guess they could sell some of their time to configure it for you.  Engineering time.   Otherwise, it's part of your licence that you pay for.  The only question is who will spend the time to make the configuration change. ... View more

I agree with @KarstenI , 802.1x is the way to go.   If your company is relatively small, you can use local Meraki accounts.  This is super easy to deploy. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring__WPA2-Enterprise_with_Meraki_Authentication   Another option, not as good, but still easy is to use iPSK.  Give each individual user their own PSK.  No more PSK sharing. https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_without_RADIUS   ... View more

Yes that will be the workflow Little annoying that when you read the schema definition most of the parameters are defined/explained. I used the same in my code basically just like you, create the basic and then update with specifics ... View more

Two features you can adjust gradually without breaking too much are to increase the min rate and reduce the transmit power. But better let someone do a validation who knows how this works. ... View more

According to the doc Meraki APs do appear to use TLS for RADSec.   And yes it appears ISE only support RADIUS over DTLS today and not TLS RADSec. Various docs don't seem to be all that clear on the topic. ... View more

Well let's call it WLPC UK/EU then.... ... View more

Congrats @sungod  I remember when I joined the community I thought there was no way I was ever going to achieve that level so congrats, it's an achievement well worth celebrating.  ... View more

I am seeing the same issue as of today with a Customer. Was there any resolve to this issue? They even have Ent Z3 in the environment today with no issues with ADV SEC MX's. Could be purely a Z4 thing, regardless of documentation. We do have a case in, though wanted to reach out as well. ... View more

Thank you so much for this. I knew there was issues going on and no one could help me. I even opened a ticket with Meraki about our laptop loosing Wi-Fi connection. They always keep saying, nothing is wrong on our end, its a domain issue.  Nice work.  ... View more

We are using approx. 400 Meraki devices in our organization. yes, but if cisco manager had done that, I wouldn't be discussing all this! ... View more

Can you not Deny at Layer 7 as below:   And add L3 Deny rules for teamviewer.com etc provided the MX has seen the DNS lookup, or if using internal DNS setup a teamviewer.com domain and resolve to 127.0.0.1 ?? ... View more

Yeah. This is nice feature to have if you have few (~20-50) vlans to manage but if you have more than 200 and its in rapidly changing environment (lab) this feature feels like unnecessary hiccup. Would be nice if it can be turn 'off' even if its 'on' by default.   ... View more

I must agree, I particularly do not like transition mode.   The answer to your question:   - All of the MRs that you mention support WPA3 and WPA3 transition mode in SSIDs with Preshared Key, Passphrase or WPA3-SAE (however you want to call just having a fix password for the SSID).  This is supported since version MR27.   - For transition mode with 802.1x (radius) based authentication SSID you need to have MRs that are capable of running version MR31.1.1 or above.  These are 802.11ax MRs so out of your original list only MR56 is capable of running this version.     ... View more

This is so secret that I didn't know it existed. I'll need to wait for a briefing from M!  😉    Giac007   ... View more

No vendor can support MAB and dot1x at the same time. In Wi-Fi you have a layer 2 security type: Open, WPAx-Peronsal, WPAx-Enterprise, Enhanced Open. You cannot mix these within the same SSID, so WPAx-Personal will always use a pre-shared key and WPAx-Personal will always be an 802.1X authentication method. However what you CAN do is in the L3 authentication part you can have a login form that uses a radius server in the background for logins or have some device based access policy. Usually in companies you have a single SSID with 802.1X authentication for use for corporate owned laptops and other devices supporting 802.1X and BYOD.  Then you have a second pre-shared key based SSID (can also be identity pre-shared key) for IoT devices that do not support 802.1X and a third Open/Enhanced Open for visitors where you can optionally have a portal page. In case of venues you can also have a fourth SSID based on some external system like Cisco's OpenRoaming, or in educations EduRoam. ... View more

Be aware that that C9300X-Ms have some missing features at the moment, despite the underlying hardware being more powerful.  With regard to the pricing we found them to be quite a bit cheaper than MS355Xs for the core switch, but if you need to add modules then the price is closer.  A future software rewrite is planned to fix this, but I'm surprised that they have EoLed the MS switches before it is out. ... View more

Interesting read. It is to be expected that Catalysts work on a different way there will be issues albeit sometimes cosmetic with the full integration. In this case however I haven't yet investigated if this is normal behavior on a Catalyst running in native DNA mode.  Normally IGMP snooping is enabled however I never heard that the IGMP querier feature would also be enabled at the same time by default.   If I get to a customer with native Catalysts I will try to capture this. ... View more