Meraki

rhbirkelund

If you are able to reliably reproduce it, perhaps it would be a good idea to open a case, and demonstrate it to Meraki Support?

rhbirkelund

Likely it's not possible to stop the Mac Flappinng events. The Mac addresses that seem to be flapping, what do they belong to? Wireless Clients? If so, bad luck. It's most likely due to clients roaming between Access Points, faster than the entry in the mac address table expiring.

rhbirkelund

If it says -B on the back it’s in Catalyst mode. You can migrates it to Meraki mode, but you’ll need to have Meraki Support to initiate the migration. So you’ll need to log a case with Support.

rhbirkelund

Have a look at the packinglist. If it says CW9164I-M it’s the Meraki SKU, and thus it’ll be in Meraki Mode. if not, it is in Catalyst mode. You should also be able to see it on the label, on the backside of the AP. Based on your CLI output, I’d assume it’s in Catalyst mode.

rhbirkelund

About time. 😉

rhbirkelund

While it's a C9300 Cisco switch, and the supported SFP matrix from Cisco, says yes, I'd still rely on what the Meraki Datasheet says. This is to ensure support from Meraki, just in case. The C9300X-24Y-M datasheet says that it supports 10G twinax. https://documentation.meraki.com/MS/MS_Overview_and_Specifications/Catalyst_9300X-M_Datasheet If possible, I'd go with the Meraki SKU, so ensure compatibility and support.

rhbirkelund

Then you’ll need to upgrade to MR31.x in order to use WPA3 Enterprise Transition.

rhbirkelund

What firmware version are you running? If I remember correctly, you need MR31.x to get WPA3 Transition.

rhbirkelund

Go to Wireless -> Monitor -> Health. Click on the tap Connection log. Filter for the last 12 hours and filter for the specific client. At the time where the client is failing when connected, what does it say? Also what errors do you see in the logs on your Radius server? 8 out of 10, if others are able to authenticate with certificate expect for the one client, it is most likely a certificate error. Either it's expired or there's an error in the certificate. Or the client is being profiled incorrectly on your RADIUS server.

rhbirkelund

I think it's more general, when looking across vendors and seeing how fast they are going to market with WiFi7. If i remember correctly, the standard hadn't even been ratified before vendors such as Ubiquity or MiST began annoncing WiFi7 access points. Even before there were any WiFi7 clients. I recall that Cisco had the stance that they didn't really belive in WiFi7 and were expecting to jump over it. But I'm guessing because everyone else were putting devices on the market, they had to aswell, otherwise they'd be left behind. So it's merely to have a presence, rather than the lack thereof. I have the BE201 NIC from Intel in a Wlanpi, and eventhough is supports MLO and I have two links when connected to a WiFi7 AP, it's still only using one, because it's a Non-STR(?) device. But then again, I can't say for other 11be NICs.

rhbirkelund

You should be able to do so already, without RBAC. Go to the Switchport that you want your employee to be able to manage and tag it e.g. Facility. Notice the tag Facility in the screen shot. Then go to Network-wide -> Configure -> General Under port management privileges you can configure the tag to be used for port privileges. Then on Organization -> Administrators, you can create your employee as an administrator and target the employee to a network and select the tag Faclility. From then on, your employee should only be able to access ports only assiged Facility tag. Maybe he can view other ports - I can't remember. But he will not be able to edit ports that are not assigned the Facility tag.

rhbirkelund

All configuration is located on the Dashboard. If you replace a MX450 on the Meraki Dashboard with another MX450, the new device will have the configuration pushed by the Meraki Dashboard, so it will end up running the same configuration as the old device. If you switch over to the spare, power down the old primary and replace it with the new primary, as well as replace it on the Meraki Dashboard, I would expect it to come online again and begin synchronizing its configuration and upgrade to the current running firmware. Once that's done, I'd expect you to simply just beable to fall back to the primary again, unless it does so premptively.

rhbirkelund

Well... Based on what I'm hearing and looking at how vendors are integrating WiFi7, I think WiFi7 looks more like the next iteration of AC Wave 1. Basically just getting the standard supported by using off-the-shelf technology, without putting real development into it. The way Cisco supported AC Wave 1 was to use the Qualcom chipset, before introducing their own innovation with AC wave 2.

rhbirkelund · ‎Feb 18 2025

What mode is the MX100 in? You could simply bypass your MS390, and just create vlan2 on the ports, and create the vlan 2 SVI on the MX, incase it's in Routed Mode.

rhbirkelund · ‎Feb 13 2025

Good luck with the song and dance with Management. 🙂

rhbirkelund · ‎Feb 12 2025

While it serves many of the same purposes, it's not a replacement of ISE. From the Slideware I've seen it opens for more integration directly with EntraID in combination with differet EAP methods.

rhbirkelund · ‎Feb 12 2025

MR32 had End of Support last year, while MR44 still doesn't have an Announcement from the looks of it. That being said, as other say it really comes down to your client base and type of users. Typically for warehouses, these types of clients rarely see much innovation, so WiFi6E would most certainly be way out in the future. Even more so for WiFi7. However, for office and campus sites clients tend to be replaced more frequently and be updated faster. I can't speak for other vendors, but I recall that the next iteration of Macbook Pros, should support WiFi 7. iPhone 16 Pro already does, if memory serves me. For an office or campus, I'd look towards WiFi7 to have a ready and future proof network, for those that move towards WiFi7. For warehouses, perhaps WiFi6E would be worth doing.

rhbirkelund · ‎Feb 12 2025

If you go to Wireless -> Configure -> Firewall & Traffic Shaping, and select the SSID from the dropdown, on Outbound rules, is the SSID allowed Local LAN access? Is it set to Allow or Deny?

rhbirkelund · ‎Feb 12 2025

I don't think the 9172i is going to be mainstream yet, either. Like you say, people are still trying to catchup to WiFi6 and 6E. The 9172H however, is really interesting! Finally, a replacement for MR36H which is newer and modern.

rhbirkelund · ‎Feb 7 2025

I have yet to try it, so I don't have anything to share on how it takes. However, I imagine that if you open a case with Meraki Support, and call in, I'd expect it to be fairly quick.

rhbirkelund · ‎Feb 7 2025

Start by changing the allow list to something less than 1000 vlans in total, e.g. VLANs 1-200. Save the config. Then edit the ports again, and then add the VLANs to the list that you need.

rhbirkelund · ‎Feb 4 2025

Besides the one that Philip mentions, there's also two more free courses at the moment, which gives CE points. DEVNAE, Network Automation, which gives 16 CE points - https://u.cisco.com/paths/3 DCAIE, AI on Cisco, which gives 34 CE points - https://u.cisco.com/paths/288

rhbirkelund · ‎Feb 3 2025

Bridge mode, or configure your ISP router to open or forward 2223 to your MX.

rhbirkelund · ‎Feb 3 2025

Yes, if the Uplink IP is set to 10.1.10.97, that means it's being NAT'ed. Your WAN interface simply shows your public IP address in the same way as if you'd use any tool on the internet to view your public ip, from your PC. You'll need to put the ISP device into Bridge Mode.

rhbirkelund · ‎Feb 3 2025

For good measure, could you try and replace your external IP on the Forwarding rule with "Any"? Allow the MX to update it's config, and then try to SSH to port 2223, then. Also, you mention that the MX has a Public IP on it's WAN. Is that also what you see when browsing to Appliance Status and clicking on the Uplink tab?

About rhbirkelund

rhbirkelund

Community Record

Badges