Meraki

Ryan_Miles · ‎Oct 17 2023

The traffic is proportional to the amount of clients on the APs. The more clients you have the more 61111 traffic you'll see. From a pcap they look to be 66 bytes in size. Pretty insignificant IMO. And as you mention limiting broadcast domain size is part of core networking fundamentals. There's not a single right and wrong answer/design for every deployment. Just seeing blocks in a firewall log doesn't indicate a problem or mean something isn't working as it should. And if this is a high density network you can always disable client balancing altogether. It's off by default in newly created wireless networks/rf profiles.

Ryan_Miles · ‎Oct 17 2023

https://documentation.meraki.com/MR/Other_Topics/Client_Balancing#Information_Exchange Each AP has a local database that stores clients' metrics, both associated and not associated. This information is shared between each AP on the LAN via broadcast messages with an encrypted payload. Note that this message encryption is dynamically configured and secured by the Meraki cloud. Note: Broadcast frames for this information use UDP port 61111 and are sent over the LAN infrastructure.

Ryan_Miles · ‎Oct 17 2023

Wired power is only different/required on the MT14 when you enable high sampling mode. On all other sensors wired power offers no difference vs. battery power with regards to functionality. And to be clear the MT15 is wired power only. No batteries. And high sampling is always on/the default for the MT15. https://documentation.meraki.com/MT/MT_General_Articles/MT15_FAQ#What_metrics_does_MT15_sample.3F_How_often.3F

Ryan_Miles · ‎Oct 17 2023

Many of them already are https://meraki.cisco.com/product/sensors/sensors-accessories/usb-c-to-ethernet-adapter/

Ryan_Miles · ‎Oct 13 2023

Each tunneled SSID from an AP is a VPN tunnel. So, in your example of 200 APs and assuming each AP only has 1 SSID that is tunneled it would be 200 tunnels total and the minimum MX to support 200 site to site VPN tunnels is the MX85 per the MX Sizing Guide. My advice would be to go larger and not choose the MX85 which would be running at the max tunnel count right out of the gate. The other parameter to be aware of is VPN throughput of the MX. The MX85 is rated for 500Mbps. If you think your deployment will require higher throughput choose something larger than the MX85.

Ryan_Miles · ‎Oct 13 2023

It was present in 17.x. And 16.x. And everything before it. Every version of release notes mentions.

Ryan_Miles · ‎Oct 12 2023

Lots of Meraki services use 443 and it's the direction all devices are moving to for control/mgmt traffic vs. UDP 7351. See https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Meraki_Device_to_Cloud_Connectivity_-_FIPS

Ryan_Miles · ‎Oct 12 2023

158.115.128.0/19 is not just for Camera Proxy. It's listed for many various services on the Firewall Info page. https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity It can also be the source for inbound when SNMP is enabled. I would expect most if not all of your Meraki devices would be communicating with that IP and others in the various ranges listed on the Firewall Info page. Did the amount of traffic to this IP or range dramatically increase as of late?

Ryan_Miles · ‎Oct 12 2023

You're describing this unsupported topology https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Extending_the_LAN_with_a_Wireless_Mesh_Link#Unsupported_Topology_Example:_Additional_MR_on_Remote_Side The only supported option in this instance is for the remote switch to be a L3 switch as shown here https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Extending_the_LAN_with_a_Wireless_Mesh_Link#Example_Topology_2

Ryan_Miles · ‎Oct 11 2023

It's hardware based and AFAIK will never change

Ryan_Miles · ‎Oct 11 2023

It sounds like the above posters got your question covered. But in case you need some visual aids or a walkthrough video I created this deck sometime ago https://docs.google.com/presentation/d/1fFjA-HCNB7KE03bUgCGINoNqVMVSumlF4Tjo-bUH9aE/edit?usp=sharing

Ryan_Miles · ‎Oct 9 2023

The SSID tags VLAN 840, but the switch has 840 untagged?

Ryan_Miles · ‎Oct 6 2023

I make no rules and only abide by the ones in place. The MX64 end of support date is July 26th, 2027. EoX doc here. Our official End-of-Life (EOL) Policy is located here.

Ryan_Miles · ‎Oct 6 2023

Roadmap info is never going to be published here (or anywhere else). Your best option is speak with your Meraki Sales team.

Ryan_Miles · ‎Oct 6 2023

No problem. There's already acknowledgment/awareness about the numbering confusion and it's being addressed soon we hope.

Ryan_Miles · ‎Oct 6 2023

The numbering scheme is wonky at the moment and hopefully will be more intuitive soon. Today 18.1 = 18.10x.x train 18.2 = 18.2xx.x train

Ryan_Miles · ‎Oct 6 2023

Is VLAN 1 the native VLAN for the switch port connected to the gateway AP? If yes your SSID config is invalid as that config would instruct it to tag VLAN 1 when it's native/untagged,

Ryan_Miles · ‎Oct 6 2023

This info has been added to documentation https://documentation.meraki.com/General_Administration/Firmware_Upgrades/Product_Firmware_Version_Restrictions#MX There have been previous banners for older models like MX60, MX400/600, etc.

Ryan_Miles · ‎Oct 5 2023

I'd recommend engaging Meraki Support. It's impossible to know what's happening without direct visibility to your Org for deeper troubleshooting. DHCP failures could be misconfigured switch ports, DHCP server issues, something else.

Ryan_Miles · ‎Oct 5 2023

☝️This is 100% the correct answer

Ryan_Miles · ‎Oct 5 2023

Appears your uplink from the stack is sw3 port 43? That's showing a UDLD neighbor mismatch alert and claiming to be connected to sw5 port 38? Sw5 port 38 is blocking reporting seeing BPDUs from multiple senders. What is the physical topology of this stack with regards to its uplinks to presumably the MX250?

Ryan_Miles · ‎Oct 5 2023

A Z or MX can reside "inside" a network with a private IP. As long as it can reach dashboard and if using AutoVPN the proper ports are open it can form a VPN tunnel, etc.

Ryan_Miles · ‎Oct 5 2023

I tested this topology and the remote switch goes offline as soon as the second repeater is added. It might work if some VLAN pruning were put in place based on some other past testing I've done to get repeaters behind repeaters to work. But I didn't continue testing this because even if I cobbled together a solution it's completely unsupported from an official standpoint.

Ryan_Miles · ‎Oct 4 2023

Do the wired MAC and BSSID MAC meet these requirements? When we detect an SSID being broadcast, we compare it to other known MAC addresses on the LAN. The criteria for a match are as follows: If a wired MAC and the broadcasted BSSID MAC match on the 3rd and 4th bytes of the MAC (starting with the 0th byte on the left, ending on the 5th byte on the right) AND if the rest of the bytes differ by 5 bits or less (except for the 4 least significant [rightmost] bits of the 5th byte, which are masked out), it is classified as a Rogue SSID. If it does then you may want to work with Meraki Support to see why it's not being detected.

Ryan_Miles · ‎Oct 3 2023

My apologies. I didn't catch the part about this being for Postman Flows. I've never used the Flows piece. Maybe someone else here as experience with it.

About Ryan_Miles

Ryan_Miles

Ryan Miles

Community Record

Badges