About PhilipDAth

PhilipDAth

I think I would use two SSIDs, one for client isolation and for for devices that are shared. I would stick to using bridge mode. You can read about client isolation here: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Wireless_Client_Isolation

PhilipDAth

Any chances the devices have recently had a manufacturer firmware update?

PhilipDAth

I think you could have figured this one out ... http://lmgtfy.com/?q=Meraki+MX+best+practice+guide http://lmgtfy.com/?q=Meraki+MS+Best+Pratice+Guide

PhilipDAth

I don't see why not - but its not a trivial effort. Collecting the location analytics will be the easy bit. Generating nice diagrams will be the hard bit.

PhilipDAth

I wonder if anyone else has run into this problem before. I have a client using a vMX in Azure and they are reporting 4% packet loss to all the VMs in Azure from the spokes. It doesn't matter which VM is being pinged, and it doesn't matter which spoke the ping is being done from. Spokes can ping other spokes with zero packet loss. The issue happens consistently 24x7. You do about 100 pings and you will loose about 4 of the packets. The packet loss tends to be spread out. If you do a ping within the Meraki dashboard there is zero packet loss between the vMX and any spoke that I test. There are no interesting events in the event viewer, and the status bar for the vMX and spokes is solid green. The VMs in Azure can ping the vMX with zero packet loss. The issue only happens when traffic is routed through the vMX to a remote spoke (or from a remote spoke being routed through the vMX to the Azure VMs). The vMX and all MX's are running 14.39. I have tried rebooting the vMX and a small selection of MX's. I have also had a small number of the Windows VMs rebooted. The VMs are running different versions of Windows Server as well (so there is nothing in common). Nothing has made a difference. Any one had issues with small amounts of packet loss to VMs in Azure connected via a vMX?

PhilipDAth

The Dashboard doesn't tend to update the device name very quickly after you change it. The easiest option is to click on the client, and then click on the pencil and type in a name you want to know it by.

PhilipDAth

What about an MX68 which has a 10 port LAN switch built in?

PhilipDAth

What about using the Scanning API to triangulate where users are?

PhilipDAth

If you swap out the MR62 for the MR74 swap the antennas over as well. You want everything matched. This is the datasheet for the MR62. https://meraki.cisco.com/lib/pdf/meraki_datasheet_MR62.pdf It lists compatible antennas as being: ANT-10 ANT-13 I would stick to using the correct antennas with each AP. Otherwise they might not be RF matched, and it could produce unpredictable results.

PhilipDAth

I'm with @jdsilva, try and old fashioned cross over cable.

PhilipDAth

I want to tell you the answer is "no". However if you enjoy a lot of grief it should be possible using a RADIUS proxy solution. I think Jump Cloud is quite well known in this space: https://jumpcloud.com/ But if it was me I would tell the person making the request "no". But that's me. I don't like lots of complexity and grief.

PhilipDAth

Splash access have an excellent retail splash page solution and is well priced. https://www.splashaccess.com/ They do support customised splash pages per AP.

PhilipDAth

The MR33 and MR42 have a "near" sphere coverage circle. Technically it is "slightly" better to roof mount them. Practically it makes no difference. I have done lots wall mounted and no one has complained.

PhilipDAth

In that case, here is the Windows 10 client VPN troubleshooting guide. https://documentation.meraki.com/MX/Client_VPN/Troubleshooting_Client_VPN

PhilipDAth

I'd replace the existing MR62 with the MR74 so you have the best AP at the centre of your network. Then re-locate the MR62 to the other location. Yes you will need two antennas, one for each band. When you first get the unit add it to your Meraki dashboard, place it in your network (in the Meraki Dashboard), and then leave it plugged into the Internet for 30 minutes. They need a bit of time to get their intial MESH configuration. This only ever needs to be be done once. People deploying the MESH technology often have a problem because they take it out of the box and have an expectation it will work immediately, spend some time trying to figure out why, and then half an hour of grief later it springs into life. You are also going to need a PoE injector to power the AP. There wont be one in the box. It sounds like you are in the US so you would need MA-INJ-4-US. Otherwise if you are in another country change the "US" to your country code. You definately want 802.11ac if possible over 802.11n. While your Internet circuit is not fast enough to sustain the higher speeds WiFi is a very chatty protocol. It sends lots of beacons and other frames. The problem gets worse with more SSIDs and clients. The faster you can send to clients the more RF spectrum is freed up for other clients. Correct - if you add a licence they will be combined so their is a single termination date. Have you looked at pricing to get a satellite connection as "well as/instead of" DSL? Your MX60 is getting pretty old now, but it is capable of taking dual Internet circuits. The latency is much higher for web browsing on satellite and you do notice it a bit - but then again if your DSL connection is not so flash it might not be a huge difference. But you should be able to get much faster satellite connections. More speed means being able to support more users. https://documentation.meraki.com/MX/Installation_Guides/MX_End_of_Sale/MX60_(EOS)_Installation_Guide#Setting_up_secondary_WAN_interface_(dual_WAN) I would also consider finding a local Cisco partner in your area and asking them for a price. You can ask for pricing for just the hardware and say you want to install it yourself. The Cisco Partner locator can be found here: https://locatr.cloudapps.cisco.com/WWChannels/LOCATR/openBasicSearch.do In the "Technology" field you can put "Meraki". There are lots of discount programs that apply to different kinds of Meraki technologies that Cisco partners have access to. I'm not saying it will be cheaper - but it could be so I think it is worth a shot.

PhilipDAth

The MR74 is a much better fit for your environment. Forget I mentioned the MR70.

PhilipDAth

Wow! What an opportunity. The first thing to note is that the AP licence is the same for all APs. So if you replaced your old MR62 with a newer AP you wouldn't need to re-purchase the licence for that AP. So that makes upgrading the main AP cheaper. The units you should probably be looking at are: MR74: https://meraki.cisco.com/products/wireless/mr74 MR70: https://meraki.cisco.com/products/wireless/mr70 What kind of antennas does your current MR62 have on it? It might have a model number on it. If you are not sure could you post a photo. How are the APs currently powered? Do they plug into a mains power point, or some kind of PoE injector or maybe even an PoE switch? You will get the best results if you only use Meraki APs and get rid of things like the TP-Link AP.

PhilipDAth

I agree with @BlakeRichardson . I have had no end of problems with older Macbook Pro's, especially around roaming when there are multiple APs.

PhilipDAth

ps. Are you only running OSPF? If you are also running BGP you could consider going the BGP Beta and BGP peering with the MX250 instead. The BGP has been around for a while in MX so should be pretty solid.

PhilipDAth

As @BlakeRichardson says, that will work fine. I would personally use OM3 or OM4 fibre.

PhilipDAth

Have you tried ClientVPN from a different Internet connection?

PhilipDAth

Are you sure you have enabled Client VPN on the vMX?

PhilipDAth

I don't see any issues with managing both, and I can't see it making any difference which one you do first.

PhilipDAth

What is the authentaction for? WPA2-Enterprise mode? Group policy assignment? Client VPN? Yes, I would also use two authentication servers where possible.

PhilipDAth

Back up again now.

PhilipDAth

Community Record

Badges