Meraki

PhilipDAth

Are the APs management interfaces in the same VLAN (they broadcast data about roaming movements to each other)? Another thing you can try - disable MAC address randomisation on the client and see if that makes any difference.

PhilipDAth

I'll take a punt - it might be mac address randomisation. If you disable this, so clients always use the same MAC address - does it solve the problem?

PhilipDAth

Smells like an MTU squeeze. On the server with the issue, find out the name of the Ethernet adaptor: netsh interface ipv4 show subinterface Then try temporarily changing the MTU with: netsh interface ipv4 set subinterface “Ethernet” mtu=1300 Where Ethernet is the name of the adaptor displayed in step 1. If it works, make the change permanent with: netsh interface ipv4 set subinterface “Ethernet” mtu=1300 store=persistent

PhilipDAth

Google found a lot of people having the same issue, but I did not see any consistent set of answers on how to address it.

PhilipDAth

WiFi devices have two main modes of operation: CAM - Constantly Awake Mode. The WiFi NIC is permanently powered up. It has the highest throughput and the lowest latency. PSP - Power Save Polling. The WiFi NIC turns on and off regularly (say every 100ms). The AP buffers all the WiFi clients traffic in this mode, and only delivers it when the WiFi NIC polls for the traffic. Muhc lowe throughput, latency jumps all over the place, but the battery life is much better. Your iPads will be operating in PSP mode.

PhilipDAth

Meraki can't tell you what your requirements are. You have to form them based on what applications you need to run and what they require.

PhilipDAth

This. You need to enable QoS in Teams first. Afer you do that, there isn't much to do if you have Meraki's default traffic shaping enabled.

PhilipDAth

Have you looked at the org-wide RADIUS feature? https://community.meraki.com/t5/Feature-Announcements/Public-Preview-Org-level-RADIUS-Server/ba-p/214187

PhilipDAth

I would like to be able to reset an SSID to factory defaults. It is just nice to be able to be sure that all of the settings are removed and "clean". I would probably only use this feature 1 or 2 times a year.

PhilipDAth

>What is the best way to securely connect the MS-130-8 to the Meraki dashboard without using a public IP address? Personally, I'd give it a static public IP address and have no connection to the internal network. I would also disable the local status page. In addition to what others have mentioned, if the swtch can only connect to the Meraki cloud via an internal path that ultimately connects through itself, and you have a mis-configuration, you wont be able to fix it via the Meraki cloud as it will have cut its own in-direct access off. If it can connect to the Meraki cloud directly then there is no risk of human error bringing everything down.

PhilipDAth

If I understand the issue, the core problem you are trying to solve is you don't want to pay for licences for some of the devices? I presume these devices are no longer required? If this is the case, then all you have to do is remove them from the network they are in. Then a licence is no longer required (when you next do a renewal). https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Adding_and_Removing_Devices_from_Dashboard_Networks#Removing_Devices_from_Networks

PhilipDAth

You have posted this in "Secure Connect". Are you trying to do this from an MX or from the SecureConnect cloud? I'm going to assume MX for the moment. You might be able to do this on MX using route tracking. https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior#Static_Route_Tracking I am assuming you are using a static route to expressway at the moment. Just make it a tracked route. Find a target for it to ping. The route will be withdrawn if the ping fails. If the tracked route goes down, then the VPN should kick in. Or perhaps you are using BGP already over Expressway? If so, let us know. That is a different solution.

PhilipDAth

Is this AutoVPN, client VPN, AnyConnect, or a non-Meraki site-to-site VPN?

PhilipDAth

It is usually not an issue these days because pretty much every platform has a built-in test to retrieve a special URL to determine whether it is behind a guest portal. For example, Windows uses: http://www.msftconnecttest.com/connecttest.txt Apple uses: http://captive.apple.com There are also mechanisms like the "venue-info-url" that a device can use to get info about the captive portal it is attached to. https://developer.android.com/about/versions/11/features/captive-portal

PhilipDAth

If you have a specific VPN you want to block - I usually do a packet capture on port 53. Look at the DNS entries it tries to use when the user is logging in - and block them.

PhilipDAth

The newer train of IOS-XE 17.15.x now has Meraki support that is natively built in. Before this it has to use a container running on top. Perhaps trying the newer version of IOS-XE? https://community.meraki.com/t5/Switching/CS-Firmware-Version-IOS-XE-17-15-1-9-First-IOS-XE-Native-Release/m-p/249873 https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Cloud-Native_IOS_XE_Overview

PhilipDAth

You need an Internet connection to configure and monitor it. Once it is configured, it will run without an Internet connection for a while. I don't know, but if you have no Internet connection, then it couldn't check its licence, so I suspect there might be some upper time limit before it shuts down.

PhilipDAth

SNMP polls, such as every 5 minutes. You should be able to do this, realtime to the extent of your polling frequency.

PhilipDAth

>Shiny new All-Star badge Call me a magpie.

PhilipDAth

The information is shared between the APs using layer 2 broadcasts. https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Roaming_Technologies#Client_Tracking If the APs are at different sites they wont see each others broadcasts.

PhilipDAth

They support HA.

PhilipDAth · ‎Jan 22 2025

If Comcast has claimed the devices in their Meraki Dashboard then only they can unclaim them. You could try creating a Meraki account and seeing if you can claim the devices INTO A NETWORK (not just inventory). You won't be able to claim the devices if Comcast has still claimed them. If you can claim them, then you can unclaim them, and someone else will be able to use them (they will need to buy licneces to make them work). https://documentation.meraki.com/Getting_Started_with_Meraki

PhilipDAth · ‎Jan 22 2025

Major issues should also be notified here: https://status.meraki.net/ You can also sign up for notifications on this page.

PhilipDAth · ‎Jan 22 2025

@GeorgeB is back! You were instrumental in the MV and IoT product development, and now you can exercise even greater oversight. What is your YouTube channel?

PhilipDAth · ‎Jan 21 2025

I do, but I can't release them. They were paid for by a client, but no harm in asking.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges