@konarktriv7 wrote: I've got a ThinkPad X220 that doesn't have a wireless WAN PCI-E card inside it, or the antennae (I can only see the WiFi antennae when I open it up). It does have a SIM card port underneath the battery, though. Can I add wireless WAN to it? If you have good contacts, you might be able to find an original part, but the X220 is an old model and I doubt that many replacement components are still stocked. You might get lucky.   In your shoes, I'd consider using a LTE modem that would plug into a USB or Ethernet port. This would be easier to acquire, and would potentially offer higher throughput than you would get from comparatively aged technology.   Otherwise, tether a smartphone to the X220 and share the phone's connection. ... View more

@PhilipDAth wrote: Dumb question - any reason why your home devices can't just plug into the Virgin router? Apparently the OP wants to remove an existing Netgear switch from the cabinet, because the MX84 is so large.  ... View more

Most things are possible, if you have management access to the MX. However, do you really want to run all your domestic traffic through the work security appliance? If the space the MX84 occupies is too great, ask for a Z3 or MX64. In any event, the MX has issues with certain types of multicast IP-TV. I would simply uplink the MX to the existing router. ... View more

@swifty  Because the MX does not handle multicast IPTV properly, I have put another gateway device ahead of the MX and the MX now uplinks to a LAN port on that gateway, so the config I currently have on the MX WAN port is not helpful.   However, I use a Vigor 130 modem configured as below: VDSL 2 enabled (Tag value 101 - Priority 0) PPPoE/PPPoA disabled MPoA (RFC1483/2684) enabled (Bridge mode enabled) PPPoE/PPPoA only needs to be disabled if using multicast IPTV (eg BT Sport), similarly MPoA is only enabled to assist with smooth multicast operation. It works perfectly.   The gateway appliance ahead of the MX has its WAN port configured: Connection type: PPPoE User name: bthomehub@btbroadband.com Password: BT Smart Queues: Disabled The public IP address of the MX is passed through from the appliance it is connected to.   Before I had to put the additional gateway device ahead of the MX, it connected to the Internet in exactly same manner as the connection I have described above.   Most BT FTTC cabinets can handle Jumbo Packets, but BT PPPoE maxes out at 1520, so make sure Baby Jumbo Packets are enabled   ... View more

How have you configured the uplink to the BT modem? ... View more

@cmr  Please see - https://docs.microsoft.com/en-us/Office365/Enterprise/office-365-vpn-split-tunnel    This explains how to identify the O365 traffic, which is why I posted it as "helpful" rather than the solution . . .    MS explains how to select the relevant traffic, specifically "to mitigate the risk of VPN infrastructure saturation", it makes sense to use the same logic to route the O365 traffic to a specific WAN port.🤓😷     ... View more

More explanations https://community.meraki.com/t5/Security-SD-WAN/Client-VPN-split-tunneling/m-p/15593/highlight/true#M3755 https://docs.microsoft.com/en-us/Office365/Enterprise/office-365-vpn-implement-split-tunnel ... View more

As this involves both MS and Meraki, you may find the following helpful: Enhancing VPN Performance At Microsoft Implementing VPN split tunneling for Office 365 https://community.meraki.com/t5/Security-SD-WAN/Office365-VPN-Split-Tunnel-For-Remote-Users/m-p/83055#M20920     ... View more

As the move to smart devices has gathered pace, there have been a surprising number of unintended consequences, some of which are not so unexpected when the commercial origins of many of the "smart" device vendors is considered.   One these unintended but not unexpected consequences results from the reasonable attempts by electronic goods vendors to improve energy efficiency whilst maintaining usability. So TVs and audio systems often enter a "sleep" period during the night. It is more complex that it might appear at first sight, there is sleep, light sleep, deep sleep and then, ultimately, turn the power off. To add to the complication, many devices also have some form of Wake-on-LAN capability, or send a packet indicating that they are available.   Currently, some Chromecast capable audio devices from Sony appear to go up and down several times each night, as far as error reporting is concerned. Meraki doesn't feel a need to do anything about this, nor does Sony.   Sky devices show similar behavioural characteristics, and some switches don't handle it very well. Problems disappear when the sleep function is reconfigured. In extremis, turn off the Sky kit.   Network manufacturers need to get together with the smart device vendors and explain how to play nice, and, incidentally, stop cheaping out on Wi-Fi components. ... View more

        What is there to debate? WiFi is not the only user of the 5GHz sector. WiFi manufacturers should be moving to the 60GHz sector, but they need to clear existing stock, and every day they delay, the more they develop 5GHz technology. Talk about ostriches. ... View more

I get pinged all the time by the Apaches, but I am deliberately trailing my coat-tails, as it amuses us all when they do the bee-dance.   I would suggest you try turning down the TX value as much as you can whilst maintaining adequate WiFi coverage, don't go looking for trouble, as it were. Also, if the signals don't reach the APs, they won't react.   Some wallboard has foil on one side, for insulation purposes, it blocks WiFi pretty effectively. ... View more

Originally, some effort was made to construct a channel numbering system that allowed bandwidth to be derived from the channel number selected. For reasons that remain obscure, many WiFi manufacturers did not take advantage of this relationship.🙄🤕👎 ... View more

You appear to be running foul of the CAC time, which under certain circumstances can extend to 240 minutes.   Excerpts from my working notes -    SPECTRUM MANAGEMENT SERVICES Because the 5 GHz spectrum used by Wi-Fi equipment is also used by others, defence, satellite communications, the maritime and aviation sectors, and weather stations when spectrum managers had anticipated they would move to other parts of the spectrum, steps had to be taken to allow this portion to be shared. Therefore regulations were introduced that require Wi-Fi access points to change channels if other users (weather radar) are detected (DFS) reduce transmit power if other users (satellite communications) are detected (TPC) check that an alternative channel is not being used before using or switching to it (CAC) make uniform use of the available channels (DFS) CHANNEL AVAILABILITY CHECKING (CAC) Before a device can commence operating on a channel which requires the Channel Availability Checking function to be active, it has to listen for a set period to ensure that the channel is not already in use.   PARAMETER  VALUE Channel Availability Check Time 60 seconds Minimum Off Channel CAC Time 6 minutes Maximum Off Channel CAC Time 4 hours Channel Move Time 10 seconds Channel Closing Transmission Time 1 second Non-Occupancy Period  30 minutes   NOTE 1 For channels whose nominal bandwidth falls completely or partly within the band 5 600 MHz to 5 650 MHz (Channels 120, 124 & 128) the Channel Availability Check Time shall be 10 minutes NOTE 2 For channels whose nominal bandwidth falls completely or partly within the band 5 600 MHz to 5 650 MHz the Off Channel CAC Time shall be within the range 1 hour to 24 hours Table 6 Channel Availability Check Parameters - ETSI EN 301 893 V1.8.0 (2015-01) In the event that an access point is required to switch channels, all devices communicating with the access point are supposed to stop transmitting until advised by the access point to resume transmissions on the new, and available, channel. This channel will continue to be used until a radar system using the channel is detected, in which case the access point will find another available channel that is free of radar signals. The access point uses the protocols set out in IEEE802.11h to advise the connected client devices (described as slave devices by the spectrum management organisations) that transmissions should cease and that they should not transmit until advised that a clear channel has been found.   I have pages of notes relating to this. There are good reasons to reassess use of 80MHz wide channels as not all client devices can make use of the additional bandwidth.   I don't know what domain you are in, but would suggest investigating legal use of the spectrum above the DFS affected channels. Life is going to get worse, not better. ... View more

@MerakiDave    Meraki seems to use ringlead  . . . . their cert is out of date and Bitdefender gets shouty.   I am trying to cobble together some Meraki/ Microsoft/ MacOS / Android / ANother documentation to add into a MS Teams group for discussing VPN issues, that interested parties can join, hopefully it will be ready at the end of the week, but there are too many words for for the Community and as it isn't exclusively Meraki, the blog isn't the place either . . . so I've gone with Teams   Which is how I noticed the non-displaying illustration. ... View more

@KarimB wrote: errr ... you lost me Uberseehandel. With "other security appliance", I assume you mean the Cisco 881 ? If well, I'm not aware of the "DNS Suffix of Sodor.CaithnessAnalytics.com".  Sorry, I should have made my self more clear.   By "other security appliance" I mean a router/gateway device that is not a Meraki product. Sodor.CaithnessAnalytics.com is the network controlled by an MX64, it is used for testing. ... View more

When a laptop is connected to the "other" security appliance via a switch, it receives a Connection Specific DNS Suffix of Sodor.CaithnessAnalytics.com When the same laptop is connected to the MX via a switch, it does not receive a Connection Specific DNS Suffix.   Is it possible that the MX is not DHCP15 aware as far as receiving an IP from another device? ... View more

Can you check the IP address handed out by the 881. Also which subnet mask is in use. It is possible that the laptop you are using to connect to the 881 has its port configured in a manner that allows it to interact with the 881. ... View more

@KarimB wrote: Can you elaborate on which type of policies conflicted ? I can't find what it was that was contributing to the problem. The skeleton that remains does not configure the uplink, and I'm not sure where I would configure the profile for SDN/WAN issues. In any event, SM is not appropriate in our situation, so we don't use them.   But I rather suspect that I/the profile had declared the untagged uplink as a tagged VLAN. ... View more

When I first uplinked a MX64 to a third part security appliance, I did have an issue that was caused by a policy that set the uplink type in a manner that conflicted with the way the MX64 needs to be configured to uplink to another security appliance. Once I removed/disabled the policy, then the MX behaved as intended.   It occurs to me that if you change LAN4 to WAN2 and use that for the uplink, you might get around the problem.🤓 ... View more

Make sure that the uplink from the MX to the 881 is an untagged LAN (eg 192.168.22.0/28) the MX should be configured to get an IP address from the DHCP server on the 881 the downlink port on the 881 has a DHCP server configured appropriately This works for me.   ... View more

Queue - Spice Girls   the future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1adthe future is 802.1ad   Got the message manufacturers of WiFi.   Manufacturers of WiFi APs and WiFi enabled devices are: living in silos burying their heads in the sand like ostriches ignoring the elephant in the room have a bunker mentality reluctant to invest in new technology all of the above   All joking apart - there are lots of other user groups that have a really strong case for more access to the 5GHz portion of the radio spectrum. Don't fight it switch. One of the benefits is that there is sufficient available spectrum to allow really efficient mesh networks with high bandwidth back haul. Plus it encourages the deployment of many non-interfering, low powered APs, so easier to scale out . . .   802.11ad - you know you want to do it     ... View more

@NolanHerring  Have you seen this - https://www.smallnetbuilder.com/wireless/wireless-features/33210-160-mhz-wi-fi-channels-friend-or-foe   I regularly use dual 80MHz channels, as I test what happens as the ever present radars cut in. Sometime the Apache helicopters pick up the signal and they turn and look at me, which sets the dogs off . . . Luckily, they have been told what I am doing. The weirdest stuff I pick up are the Antonovs flying overhead when they have livestock onboard and they are under 5,000 metres, they usually send trip the system, as do the Russian navy when they pass through the channel, going south.   Now is a good time for testing, almost no air activity. I have apps on the phone so checking what is causing problems is easier. ... View more

The reality is that for many domestic installations, another router/security appliance has to be placed ahead of the MX to handle such commonly used services as multicast IPTV and true IPv6. Effectively this diverts some of the used bandwidth away from the MX, which means the under-capacity is less obvious in practice than it is in theory.🤓 ... View more

@PhilipDAth  A dirty trick after my own heart! Thanks for that.   I don't know, but I more than suspect that serving up synthetic MACs is there, but nobody has thought to implement it, yet. Fixed MACs are an exploitable weakness, per my TLA gnomes. As far as I can tell, MACs are used as part of the authentication process by multicast premium video service suppliers, so they expect to be able to interrogate a port for its associated MAC. I can do this on the Cisco IoT switches, and I have seen them turning up in other manufacturer's hardware. ... View more