About alemabrahao

alemabrahao

It's new for me, because I've never seen a customer using a Secure SD-WAN Plus license. 🙂

alemabrahao

You can try Yagna: https://rf.yagnaiq.com/Login/

alemabrahao

Unfortunately not, just IP or CIDR.

alemabrahao

Maybe it can help you: https://www.youtube.com/watch?v=7F2WBFs2a9E https://documentation.meraki.com/MV/Processing_Video/Sharing_Video#Export_Video

alemabrahao

Well there is some considerations: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Global_Bandwidth_Limit_Considerations#:~:text=In%20the%20example%20that%20is,between%20VLANs%20on%20the%20MX. https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Traffic_and_Bandwidth_Shaping I like this part: " To provide a better user experience when using bandwidth shaping, an administrator can enable SpeedBurst using the checkbox in the Bandwidth Limits section on the Firewall and Traffic Shaping page. SpeedBurst allows each client to exceed their assigned limit in a “burst” for a short period of time, making their experience feel snappier while still preventing any one user from using more than their fair share of bandwidth over the longer term. A user is allowed up to four times their allotted bandwidth limit for a period of up to five seconds."

alemabrahao

You can create a Group policy and apply it by VLAN. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

alemabrahao

You need to open a support case.

alemabrahao

I'm pretty sure that it will include all client discovered on the network including wireless clients. Have you checked with Meraki support?

alemabrahao

This issue was solved on version 17.10.4

alemabrahao

You can create a Group policy and apply it on a specific VLAN. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies#By_VLAN

alemabrahao

As informed by Meraki support It's not supported. I think that the best solution for your case is the Cisco ISE. https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/sponsor_portal/b_spons_sponsorportluserguide_3_1/b_spons_SponsorPortalUserGuide_31_chapter_01.html

alemabrahao

Why don't you create a rule allowing only local networks?

alemabrahao

https://meraki.cisco.com/wp-content/uploads/2020/10/meraki_datasheet_ms120_compact.pdf

alemabrahao

Have you checked the datasheet?

alemabrahao

Warning: Care should be taken when configuring SSID block list policies as these policies will apply to SSIDs seen on the LAN as well as off of the LAN from neighboring WiFi deployments. Containment can have legal implications when launched against neighbor networks, and it may harm your own network by increasing channel utilization and potential disrupt clients connecting to your APs. Ensure that the rogue device is within your network and poses a security risk before you launch the containment. Review the section Overview of Air Marshal Containment to understand how the APs may block the configured SSIDs.

alemabrahao

In fact this is a resource that should be used if in fact there is someone who wants to do some kind of spoofing or DDOS, otherwise you can respond legally.

alemabrahao

A Rogue Ssid is all Ssid that does not belong to its Wireless infrastructure but does not mean it is a malicious SSID, for example, a neighboring company is considered a Rogue Ssid, I don't know if you understand. Follow the documentation to complement. https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal

alemabrahao

I assume the DHCP mode on the SSID is set to bridge. In that case, you have to configure the VLAN Tag in the SSID for the VLAN you want. https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/VLAN_Tagging_on_MR_Access_Points

alemabrahao

You can try enabling 802.11w as @ww suggested, But in my opinion, It does not make sense. I've been working with Meraki wireless for a long, and I have never enabled 802.11w to solve this kind of issue.

alemabrahao

Have you tried updating Android?

alemabrahao

By the way, do you have any firewall rules applied to this SSID?

alemabrahao

Take a look at the documentation: https://documentation.meraki.com/SM/Device_Enrollment/SM_Enrollment_Authentication https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Certificate-based_Wi-Fi_authentication_with_Systems_Manager_and_Meraki_APs I recommend you ask your Meraki sales representative consultant.

alemabrahao

What type of authentication are you using? Have you opened a support case?

alemabrahao

Why don't you create a separate VLAN for this SSID, when you use NAT the client connection will use the AP IP to access the network. In my opinion, the best option is to use a different VLAN for this case. https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/VLAN_Tagging_on_MR_Access_Points

alemabrahao

And how about your firewall? I have never heard of or experienced a slow network when the SSID is configured for NAT.

alemabrahao

Alessandro Abrahao

Community Record

Badges