450,000 hours for the MR42 (and most other models) and 300,000 hours for the power injectors.   ... View more

A few thoughts, in no particular order. Correct that "co-existence" has to do with Bluetooth and wifi co-existing in the 2.4GHz spectrum, however I would suspect a windows driver issue or something similar that's causing the machine to run 1x1 (if it even is).  The existence of Bluetooth (especially newer devices) is not very impactful anymore and there are good interference avoidance mechanisms.  Plus it's only going to have an impact (even if only minor) in the 2.4GHz band, not the 5GHz band.    What is the machine capable of, 2x2 or 3x3?  What gets reported (maybe the same output) running that command when associated to other wireless networks or APs?  Every time I've ever run that command I usually see "Unknown". for coexistence support     Also check what throughput results you get if you connect to the AP from the machine directly, using the local status page by pointing a browser to ap.meraki.com and running a speed test, and see if it's indicative of how many spatial streams the client device is capable of.   Also check what you see on the Network Wide > Clients page for that client, and open the "details" link under device capabilities and see if more than one SS is detected.  Or on the Clients page, turn on the "capabilities" and channel width columns.  Also look at the MR53's AP page where it lists current connected clients and you'll see what channel it's on.  Turn on band steering and see if you can get the client to connect on a 5GHz channel, and if/when it is, run your netsh command again, and if it still shows that same output, I'd disregard it, not an issue.   Also, I'd assume the MR53 is running in full PoE power mode (802.3at)?  If it's running on legacy 802.3af power, it will disable a spatial stream plus the 3rd dedicated scanning radio in order to run in low power mode.   ... View more

Hi @MerakiTexan Just noticed this unanswered post from a couple weeks ago.  Correct that this setting is not templatized and is not (at least not yet) accessible via the Dashboard API.  Every use case is different but generally speaking most customers choose to NOT auto-contain rogues, but instead send alerts when rogues are detected and investigate if/when needed.  Auto-containment can be problematic and very disruptive depending on the use case.  Rogues can be on the LAN without being related to actual active attacks.  Think of things like wireless printers that are typically on the wired LAN but also broadcast a "hey I'm a printer" SSID by default.  While that can certainly pose a possible risk and attack surface into your infrastructure, it's not an active attacker plugging in a rogue AP to your network, and it may be better to get alerted versus run active containment against those devices.  The rogue SSIDs typically need to be classified manually anyway on the AirMarshal page.  More info here: https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal   ... View more

Agreed, you'd probably be better off with Bridge Mode for that reason.  In the guest case, when it does scale very high, that's when you might see that Guest SSID also use Bridge mode, but leveraging a dedicated Guest VLAN on the wired side.   Since it was a pro/con type question, one thing I left out was the basic adult content filtering that's there when running in NAT mode, you wouldn't have that in Bridge mode.  But as you mentioned if you have an MX appliance that's the ideal way to have full content filtering and traffic shaping (plus FW, IDS/IPS, AMP, VPN).  On a larger scale, you have that option of a distributed traffic shaping solution by enforcing those rules right at the edge of the network on the APs, sparing the wired infrastructure from traffic storms and placing all the traffic shaping and firewalling burden on the dedicated appliance.    I've yet to see a deployment where a very high number of either traffic shaping rules and/or firewall rules on the APs caused noticeable performance or latency problems for clients, so long as best & common practices were implemented.  Meraki APs generally have more CPU and memory packed into them than is necessary in order to accommodate future firmware versions with more features.  As things scale, I think you'd get administratively worn out first (quite a large Dashboard page with hundreds of rules) before the APs ran out of horsepower.  So yes, there's certainly additional processing happening if you've got several hundred firewall and traffic shaping rules, but in most cases when there's that many (I've only seen a few) the question is "why" and there's typically a much better way to consolidate rules down to a more manageable and reasonable level.  If you're on the scale of a few dozen rules at most (very common), I'd say the impact is minimal to negligible in most use cases.  ... View more

802.11r is meant to be used in enterprise wireless LANs typically using WPA2/Enterprise although you can also leverage it with WPA2/Personal.  Regardless the SSIDs need to be running Bridge Mode to support fast secure roaming.  You'll notice the 802.11r option disappear and reappear on the Access Control page by toggling between NAT mode and Bridge mode.  If you need to leverage 802.11r, run in bridge mode and probably leverage VLAN tagging.  If you have a Guest SSID, that's where you can leverage NAT mode, that way there's also client isolation (all guests will get a seemingly random 10.x.x.x address and be firewalled off from one another) and also firewall the Guest SSID from local LAN resources, as well as set a per-client bandwidth limit on the Firewall & Traffic Shaping page.    One disadvantage with NAT mode is with roaming.  Roaming to new APs on a NAT-mode SSID will be disruptive to the connection, one reason being that everything will be NATted to the management address of the AP itself so when a client roams they reauthenticate and reassociate from the top like a full L3 roam.  So that's right in line with the 11r option disappearing when you've got NAT mode selected.  Consider running your main/internal SSID in Bridge mode.   One other possible disadvantage with NAT mode might come up in really large networks, if you have thousands of users on multiple NAT mode SSIDs, that's an awful lot of NAT processing and DHCP operations on the APs.  I haven't come across an upper limit yet, and I've seen this scale very high in enterprise deployments, but I'd imagine multiple SSIDs running in NAT mode supporting thousands of clients, there could be a performance degradation at some point.    Some links for more info: https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/802.11k_and_802.11r_Overview https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment   ... View more

Understood @Mr_IT_Guy and good point.  And I'm going to float the idea for more advanced webinars with that team.  Glad to hear the SD-WAN webinar was a better experience.  Since the MX is such a full-featured product and there's much to talk about, it hard to NOT take 20 minutes to do an MX overview.  But I hear you, the bulk of an SD-WAN preso should be 90% focused on SD-WAN.  And we don't want experienced Meraki customers (and regular webinar attendees) to sit through a 20-minute overview every time.  Instead of squeezing in 20 minutes of "overview" material that takes time away from specific advanced topics and Q&A, perhaps we could offer more regular "Advanced Webinars" that take all the baseline knowledge for granted and dive right in.  Consider this your "Make a wish" and I'll get this in the suggestion box. ... View more

Hi Gary, I don't think there's a simple way to see that natively in Dashboard.  On the Network Wide > Clients page you can turn on columns for "Channel Width" and "Capabilities" and if you sort by those 2 columns you could quickly pick out which clients are single band versus dual band, 11n versus 11ac, and what channel widths they're capable of.  But no data there on if they might be WPA/TKIP versus WPA2/CCMP.  Same in the event log, you can go to Network Wide > Event Log and filter on "All WPA" but there too, it'll show you every WPA association, disassociation and auth/deauth, but doesn't differentiate TKIP/RC4 versus CCMP/AES.     One thing that can tip you off might be the data rates, if everything's following and staying true to the standard, then data rates over 54Mbps won't be supported on TKIP clients, so devices getting the HT and VHT data rates would be your CCMP devices.  But you may need to check those one by one.  Never done it, sounds cumbersome.   Are you sure you even have legacy TKIP devices on the network?  If so, I would think it would be minimal.  So there's always the old fashioned method of forcing your SSID to be WPA2 Only and see which users complain!  Ok, I'm half joking, but half serious, I've seen customers actually do that, depends on the size of the deployment and mission critical nature of their work.  Perhaps a more gentle migration is setting up a new SSID as WPA2, perhaps even use AP tags and SSID availability to control which APs are broadcasting it, and plan a phased migration to the new WPA2 SSID before turning down the old SSID.  Then you can monitor the Network Wide > Clients page and turn on and sort by the SSID column as users are directed to the new SSID, might be a good way to weed out the few TKIP clients that can't make the association to the new SSID. ... View more

Yes, this is fairly simple with Meraki, you would configure your Guest SSID to provide access after clicking through a splash page, then be firewalled off from the local LAN so they would only be able to egress via the Internet path and have no access to local LAN resources, and also run in NAT mode so that every guest client will get a seemingly random 10.x.x.x IP address and will also be firewalled/isolated from other guest devices (called client isolation).  Also be sure on the Firewall & Traffic Shaping page to set a per-client bandwidth limit like maybe 5Mbps per client so no single device can hog too much bandwidth.  You could also set a per-SSID bandwidth limit for the entire guest SSID, so for example if you only have 100Mbps of Internet, you could set the SSID limit at 20Mbps, so all guests combined could not take away more than 20% of your overall Internet bandwidth.  And if you'd also like to do some basic adult site content filtering, that is also supported when the Guest SSID is running in NAT mode.  This Support doc should help get you going and you can always open a support ticket if something doesn't seem to be working as expected. https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Configuring_Simple_Guest_and_Internal_Wireless_Networks and there's also a blog post that walks through the basics here https://meraki.cisco.com/blog/2013/09/secure-guest-access-in-3-steps/     ... View more

I would say that's uncharacteristic of typical Meraki presentations, which are usually the opposite, much less slides and much more demo.  Then again, depending on who was in the audience (always a mix) you may have some highly experienced Meraki customers, some who have never even heard of Meraki or seen Dashboard, and all other levels in between.  I've given plenty of presos to larger groups where it was tough to strike a good balance of sales pitch versus technical depth, and beginner versus advanced levels.  I (and most audiences) much prefer to talk less to slides about what we CAN do, and spend more time in live demos showing and explaining how we actually do it on a live network.  Then again, SD-WAN can get a bit involved, so certainly some slides and background is in order.  Maybe what you ended up was more of an overview of the MX platform with just a few minutes demo on SD-WAN.  Sorry to hear that was a bummer and came off too salesy.   Anyway, keep in mind you can also engage with your local Meraki field reps (or their inside rep counterparts) to arrange a Meraki Minilab event, and we do have hands on labs specific to SD-WAN among many others.  Perhaps that is one option to only get a handful of technical-only slides followed by hands on labs on a variety of topics including SD-WAN.    Also, you may have seen it, and it might be a little higher level, but there is a webinar from Meraki's webinar series that was focused on SD-WAN (first 20 minutes is MX overview, the rest is SD-WAN):  https://www.youtube.com/watch?v=zRgIMaNZDlY   ... View more

I wouldn't necessarily deploy an MX as a proxy.  The MX does have HTTP caching available in the Web Cache options, but only supported in models with a physical disk (where the cache lives) and only works on static HTTP content, and is meant more for sites with low Internet bandwidth (like  under 10Mbps) and the need to cache the static content.   The MX is using Squid in the background, looking in the HTTP header to see if the content is cacheable or not, and if not, it won't.  So much more of the common Internet traffic is now dynamic in nature, serves up content from many different URLs, and is all generally marked as non-cacheable.    But do you really need to cache dynamic content (probably complex and expensive) and/or deploy an actual proxy server (becoming antiquated except in certain use cases), or can you deploy the appropriate content filtering, L7 firewalling, IDS/IPS and traffic shaping rules (all simple and included with any MX Adv Sec license) to address the requirements? ... View more

I'm not sure if it's a browser limitation, that could have something to do with it, but it's also a function of the hardware where you're viewing the video.  I've seen up to 3 browser tabs open in Chrome showing 3 different video walls with 12 cameras each, so it was simultaneously streaming 36 MV camera feeds.  This was on a higher-end Macbook laptop and ran smoothly.    I understand your ask and thanks for sharing your use case.  Note that Meraki Community is not the formal mechanism for making feature requests, but I've noted it and will bring it up with the team, and please also make this known to your local Meraki reps or Meraki Partner reps so they can add that input and the MV team can review and prioritize it.    For the time being, would a tab rotation tool (I use one called Revolver in Chrome) work for the time being to automatically rotate through the open browser tabs?  Or as @PhilipDAth pointed out, maybe have 2 instances of Chrome running side by side with a minimal skin and sized appropriately? ... View more

Correct on calling Support to provide AP reboot timestamps and reason codes which may not be in the event log.  @jameshottinger I'd also get with Support to help investigate, while the first thing to troubleshoot is the possible layer 1 issues, this certainly doesn't sound like your typical L1 issue, because you have a mix of 33s, 42s and a 74 and only the 42s stay online consistently.  The chances are pretty much zero that those exact 16 switch ports would have a common L1 issue while the 9 ports connecting the 42s do not.  One possible exception would be in PoE overload situations where a switch can methodically shut down ports for load shedding.  But that's also not happening here as you indicated, they are not losing power, just falling offline.  And it wouldn't seem to be an upstream issue because 1) the MR42s stay solidly online and 2) it randomly occurs when nothing upstream in the environment has changed.  Support can also scrub your firmware versions on the APs and the MS225, assist running pcaps, as well as see some lower level troubleshooting info that might shed light on the root cause.    ... View more

Agreed let's open a ticket to confirm and they'll have deeper visibility and can confirm the timeout period.  I believe the devices will always proceed through their "normal/preferred" method of establishing cloud connectivity.  There's no way to alter that via Dashboard or the local status/config page, so I don't believe there's a way to force it to use 80/443 by default, that's always going to be considered the backup connection.  ... View more

You'll have to open a Meraki Support case for this.  Pretty sure it's because that old/wrong email address was the very first one registered within your Dashboard Organization, and even though all traces of it have been removed from the Organization > Administrators page and it doesn't show up under any of the Network Wide > Alerts pages as an additional address, it may still there as the original "parent" Org owner email address associated with the Dashboard Org and still gets those maintenance alerts.  Support should be able to update that on the back end for you.   ... View more

Usually it's plug and play since almost every firewall rule is going to be outbound in nature, unless there's a restrictive firewall ruleset that even blocks outbound traffic.  If outbound UDP/7351 to the Meraki data centers is blocked, that's the primary Meraki Cloud Communications mechanism, and with that blocked the devices (if they're up an running normally) should have fallen back to ports 80/443 to establish a backup cloud controller connection.    Was the AP previously up and running normally using the primary cloud connection and subsequently UDP/7351 was blocked?  I'd consider rebooting the AP and allowing it to proceed through its normal connectivity and health checks to see if it is in fact using the backup cloud connection.  Also run a packet capture on the wired side of the AP and look for traffic on UDP/7351 for example and see if it's matched by any return traffic, as opposed to seeing traffic on 80/443 between the AP and the destination IPs on your FW rules page.    If the weirdness continues, open a ticket with Meraki Support, they'll have some lower level visibility into the pass/fail state of specific firewall tests.  Hope that helps! ... View more

I would suggest opening a case with Meraki Support for configuration assistance.  Not sure if I understood your exact design requirement, but sounds like may want to configure the MX in NAT mode as an Internet-facing firewall and then have a DMZ VLAN configured with public-facing machines like a web server perhaps, along with internal VLAN(s) and some 1:1 NAT rules.  Perhaps this Support doc might be useful.  https://documentation.meraki.com/MX-Z/Firewall_and_Traffic_Shaping/Creating_a_DMZ_with_the_MX_Security_Appliance  But I'd suggest opening a case with Support and include a network diagram with your addressing and describe the pings that are failing to you public IPs.  If applicable, also check out the separate support docs on 1:1 NAT and port forwarding. https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Configuring_1%3A1_NAT and https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX Hope that helps!   ... View more

I am guessing that if you do not have an Organization > License Info option, as you have shown in your screenshot, that this may be a "Legacy" Systems Manager license in a Systems Manager only Network with no other Meraki devices/licenses.  But regardless which license type you have, let's consider it "unlicensed", otherwise you should see a License Info page.  Call into the Meraki Support team to confirm.  Even if you are unable to technically receive Support (on an unsupported version) they'll be able to confirm for you.  Do you have any other piece of Meraki hardware?  I'm guessing you have no physical devices in your inventory if you look under Organization > Inventory.  If you do have even a single piece of equipment (even a free AP you got from attending a webinar) that you can add to your organization inventory, you'll get that License Info page to show up.  And at that point you should also be eligible for email support.     It is correct that with the latest licensing, Meraki offers a customer-initiated Free Trial, fully featured for as many devices as you need (even over 100) for 30 days with full support, and it's very simple to convert that to paid licensing model if purchased.  I'd agree with other posts (here and on other forums) that Meraki has understandably evolved the licensing model (to the only two options today, temporary free trial or paid version) as Systems Manager popularity grew along with the development and support teams.  If this is going to be for home/personal use for just a few devices, unfortunately there's really no SOHO (free) license option at this time.  Keep in mind while the only version is ultimately a paid one, it it one of the most full featured enterprise EMM products available, is 100% software so requires no on-site appliances, works with any vendor’s network infrastructure, there's no training required, and the licenses you do pay for are device agnostic, one license per any type of device with options for 1/3/5/7/10 year terms, and provides full email and phone support 24x7x365.     ... View more

Agree with @PhilipDAth and @WadeAlsup that if replacing the MX60 with an MX64 and all is well now, and perhaps you were loooking to re-deploy the MX60 elsewhere, if the appliance will still boot and come online, place it in a test network and open a Support ticket for them to take an in-depth look at its health/status.  If it won't even boot, or is otherwise in need of an RMA, it's covered by the lifetime warranty. ... View more