I don't believe that the sort of loss you are seeing is that surprising. The RF signals drop off really quickly close to the antenna. In the first 2 meters (@ 5.1GHz) you'll see loss of abut 52dB, extending this out to 4 meters and the loss is only 58dB. Think of a circle one centimetre away from the antenna, and consider its circumference. Now consider the circumference of a circle two meters away from the antenna - there is a huge difference.   The power transmitted from the antenna is distributed roughly evenly around that circumference at 1cm radius, and the same power is distributed roughly evenly around the circumference at 2m radius. The circumferences are 0.062m and 12.56m respectively - it is a huge difference.   Now some of the features we have in wireless access points, especially maximal radio combining (MRC), allow us to receive multiple signals and combine them to achieve a better overall signal, but ultimately the losses close to the wireless access point are huge.   I know I haven't really answered your question, but I hope it helps in understanding that the losses you are seeing are not really surprising (in fact I'd say only 70% is good). ... View more

@ww, yep, it’s a nice new way to do LDAP auth. Discovered it a little while ago, and can see where it fits into the mix, but the ‘standard’ RADIUS is going to provide more flexibility as you can return a Filter-ID to apply a group policy. But the Local Auth option should be good where the link back to the user identity store isn’t reliable since it’s designed to cache credentials.   Hopefully Meraki can find a way to extend this using some other protocol (ROPC?) to Azure AD, for those people who use native Azure only. ... View more

That’s for if you configure it up with a Splash Page (captive portal), you don’t need to do authentication via a Splash Page as you can do it using WPA2-Enterprise within an organisation. Under Wireless -> Access Control, for the association requirements, select ‘Enterprise with’ and then change the drop down to ‘my RADIUS server’. That’s the start of configuring Enterprise authentication.   Then further down that page you enter the RADIUS server details. ... View more

The only way to achieve this style of ‘automated’ logon is with the Enterprise class of authentication (e.g. WPA2-Enterprise), which uses 802.1x, which in turn requires a RADIUS server.   You don’t need to be punching holes in the firewall for your RADIUS server, it runs inside your network (most likely Microsoft NPS on a Windows Server), and when the EAP Method/Tunnels are correctly configured it is secure. You can authenticate either users, or domain joined machines using username/password.   Using WPA2 all your WiFi connections will be encrypted, that’s part of the standard, it uses AES encryption.   Have a look through these documents to get you started, https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS%3A_WPA2-Enterprise_With_EAP-TLS_Using_Microsoft_NPS and https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise.  ... View more

Just in case you still need a hand....   WAN interfaces can either use only their dedicated WAN IP address (in routed/NAT mode), or you can create a virtual IP address that moves between the primary and standby MX when failover occurs LAN interfaces only have a single IP address that is configured on the primary MX. This IP address is passed to the standby MX when failover occurs (so you only need one IP address on the LAN for two MXs) VRRP messages only occur between the primary and secondary MX appliances on LAN interfaces - but they occur on all configured VLANs (be aware of this if you have multiple connections between the MXs) VRRP messages occur at Layer 2, hence why you don't need a separate IP address on each of the MXs on the LAN side (this is confusing for anyone who has used HSRP) ... View more

I assume you've tried all the basic stuff.... From the computer on Site 2 - check that you have the DNS nameservers set as the domain controller IP address in the DHCP options (that's how Windows clients find the Domain Controller) try pinging the Domain controller by IP address (login with a local account), this will prove you have connectivity try pinging the Domain controller by hostname, this will prove you have DNS working and DNS suffix or search domains try pinging the Domain controller by FQDN, this proves DNS is working (even if the suffix/search domains aren't) ... View more

Routes over non-Meraki VPNs are built through the configuration of the VPN (the remote subnets), and you can’t configure static routes to a VPN as the next hop. And you can’t have two remote subnets that are the same, which makes it difficult to have a backup and a spare IPSec tunnel (although you may be able achieve this if you can arrange your IP address scheme so you can have a /23 and a /24 that overlap - haven’t tried it myself).   So you can have multiple non-Meraki VPN peers, they just need to be to different IP subnets. ... View more

I know it’s not directly related, but only a vendor’s AP will connect to a vendor’s controller. I’m sure there are exceptions, but they’ll be few. So for Aruba APs you need an Aruba controller, for Cisco APs a Cisco controller, for a Meraki AP the Meraki controller, which is in the Meraki cloud.   So far as your choice of AP, one of the things you mention is size. How small is small? The Meraki APs may all be too big. Is the protective case you talk about an IP67 rated case to keep the AP ‘healthy’ or are you talking about the case round plant machinery? Based on the way you describe the environment I’d be leaning to the outdoor range of APs these are IP67 rated so should survive, and if you don’t need much through put then the cheapest possible.   If you’re planning a wireless bridge to the device then you need two, one for each end. It should work reasonably easily, one MR plugged into the plant equipment, one located within RF sight on the wired network.   Hope this helps. ... View more

Just looking back on your comment around the MX sending the subnets as three packets, and NSX expecting them as one, have you tried just a single subnet? ... View more

Are they consistently occurring every six hours? Maybe it’s a VRRP timer of some sort kicking in, but you’re correct, there doesn’t seem to be any uplink state changes. The easiest was to solve it is like has been said, remove the HA configuration if you’re not using it. Otherwise you could log a support case and see if they come up with anything. ... View more

There is an exception to the channel change not occurring when a client is connected. If you are using one of the channels covered by the DFS regulations, and a DFS event occurs then the AP has to change channel immediately, which does disconnect clients.   If your setup is anywhere near an airport, weather radar, (or anywhere else that potentially uses radar) or if there are DFS events reported in the event log for the network, then it’s probably worth excluding the channels covered by DFS to see if that improves things. ... View more

I’ve never come across such a curtain in a building before, but a quick Google revealed this, https://www.strongwell.com/wp-content/uploads/2013/10/why-fiberglass-flyer.pdf, which suggests it’s RF transparent.   I’d suggest that it’s going to have very little impact based on this, but to be sure you’d want to do some testing. Obviously that’s going to be a tough one given the environment/location. ... View more

I’ve seen clients with about 20 AutoVPN spokes pushing about 150Mbps of traffic through a MX84 configured as a concentrator. The worst the MX performance was hitting was around the 50 mark, so still headroom in it. ... View more

The biggest downside with the solution is that you can’t configure WAN2 on the secondary MX in a different manner to the primary, but usually that’s a small price to pay, and may not be an issue. For instance WAN2 on the primary may be a 100/40Mbps internet circuit, and on the secondary it may be a Cat6 LTE - which may give a similar performance. ... View more

I don’t believe you are going to be able to easily manipulate the default route the way that you want. You need to be aware of this:   Note that if an MX-Z device is configured with a default route (0.0.0.0/0) to a Non-Meraki VPN peer, traffic will not fail over to the WAN, even if the connection goes down. Which comes from this document, https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings, under non-Meraki VPN peers. You may be able to achieve something with API and scripting as per the link Philip posted, but I believe that will be the closest you can get. ... View more

Great idea @cmr, we can all make our own 😀 ... View more

What about a Meraki hoodie... there were some MX one’s around for a short while, but maybe we need an API one for the scripters. ... View more

If you’ve still got HA configured then the VRRP process is still running on the MX, even if the secondary is offline. A primary unit will drop its priority to 75 if it has no uplinks (WAN 1 and WAN 2) available, is this what you are seeing? Do the priority changes coincide with events on your uplinks? ... View more

@earl_m, like @DarrenOC said, I’d be very surprised if your TFTP server was running on the VG - it’s a lot of effort to setup and maintain - although it’s not impossible. However, the VG is responding with ICMP that UDP port 69 is up reachable, which suggests to me that the TFTP server isn’t there.   it’s possible there are other servers in the CUCM cluster running the TFTP service, which may not be the call processing servers. Do you have access to a working phone that you can look the TFTP details up on? Or a subnet that already has the correct DHCP options configured? ... View more

On your access policy is the Host Mode set to Multi-Domain - sounds like you are doing 802.1x on both the voice and data networks. It should be refusing the second auth attempt if it’s not in multi-domain mode, but I’m wondering if there is some weirdness occurring. ... View more

If you’re in ‘VLANs’ mode (rather than’Single VLAN’) then you should be able to do it through the Addressing & VLANs page by editing the port. In single VLAN mode I don’t believe it’s possible - one of those oddities.   EDIT: you may need to use this link for mapping of template ports to the actual model, https://documentation.meraki.com/MX/Other_Topics/MX_Cold_Swap_Replacing_an_Existing_MX_with_a_Different_MX#Port_Mapping_for_different_MXs_models  ... View more

Yep, connect one ANT-25 antenna to both the top ports, and another ANT-25 antenna to both the bottom ports. The difference with the MR84 (being a 4x4 access point) is that all the ports are dual band (so both 2.4GHz and 5GHz) and you want to have the antennas covering the same area so that all the smarts of 802.11ac Wave 2 work as expected. ... View more

The only way I could think of doing that is to get creative with a script and an API, and see what can be done there. Something along the lines of alerting via a Webhook on movement, then have a script to a trigger a number of snapshots on the camera, that you then post somewhere. It’s a basic outline, but should be achievable. ... View more