Meraki

thomasthomsen

So ... on the Classic Cisco solution you can set "metal" QoS policies, that, more or less, sets the max allowed AC for that SSID. But what about Meraki MR / Catalyst AP in "Meraki persona" ? The only information I can find is that the Meraki solution honours the DSCP marking of the packet, and puts it into one of the 4 AC's. For example in this document : https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/Wireless_VoIP_QoS_Best_Practices (Scroll down until you get to PCP, DSCP, and WMM mapping). This is all well and fine, but what I do not know, or what is not mentioned anywhere, is if it always does this ? If, for example, I do not set any traffic shaping rules on the SSID, will it still honour DSCP marking, and put those packets into the right AC's ? What I "fear", and it is for now an unfounded fear, because I do not know, is that if I do not set any shaping rule, it will not and set everything to "BE_AC". And then also an interesting question, is it possible to set a "max" AC on an SSID like on a Cisco Classic solution ? Do anyone know ? Thanks Thomas PS: Yes ... I could just go "do a test" ... but I feel like Im missing this from the documentation.

thomasthomsen

Sorry, I have not seen that issue on 17.x. I have only experienced "fun" things with Smart Port Automation and trunk ports. Where the port, after being set to trunk by the Port Automation, seemingly stops forwarding packets on non-native vlans. The switch however says that there are clients on that port, in tagged vlans on the port, when looking at the mac address table.

thomasthomsen

I think we are all waiting for the native tunnel to be used for monitoring as well 🙂 Then things will get better ... right ? 🙂 I mean the command is kinda already there - if anyone has tried and been to impatient with waiting for the switch to reset when adding it do a network using the "cloud native" IOS-XE versions. test platform software config mode managed <- starts the conversion to "meraki mode" with the new software. But : test platform software config mode ? - tells you that there are options for "monitored" and I seem to remember the last one was called "catalyst" , Im guessing that last one is what Meraki supports sends to the switch in order to revert it back to "catalyst persona".

thomasthomsen

Testing right now 🙂 Laptop running Intel AX211 Running driver 23.90.0.2 seems just fine. Desktop PC running some Asus branded Realtek USB Wireless NIC also seems just fine. And finally I have a Samsung Galaxy S24 , everything also seems fine here. I did .... see just once, 4 to 5 packets on the desktop with a high latency. But I have been running it now for 20 mins, and all packets seems just fine.

thomasthomsen

In the beginning I actually thought it was more things that caused this, like changing / adding / removing an ACL and so on. But it seems to only be when I change a DHCP setting. It happens when I change DNS settings, when i reserve an IP in a scope, and so on. I created a case, just to check my sanity 🙂 And I only discovered it because I was setting up this new network for a customer, and of course, in that process, where changing "a lot" of settings. And my network connection was , ehhh, wonky. Initially I thought sure, I was connected to a switch or AP that was just connected and needed a firmware upgrade, but I have now narrowed it down to this.

thomasthomsen

Me from a normal Cisco switch on "one side" of the MX, pinging a C9300-M on the "other side" of the MX, and then changing the DNS server of a unrelated VLAN on the MX from Umbrella To Google. (some output omitted). !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!...............................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Success rate is 99 percent (9969/10000), round-trip min/avg/max = 1/2/44 ms Ok those timeouts are of course not a whole minute, but it feels like a LONG time. 😕

thomasthomsen

"Fun" issue on MX250 HA pair. Everytime I did a change (what seemed like any change at the start), the network just freezes up for a minute. 😕 I have narrowed it down to DHCP.

thomasthomsen · ‎Dec 10 2024

You are right. You can only use the MR-SUB with old APs, and the Wireless Network-SUB with new WiFi7 APs. - I just learned this. But co-term licenses are "free for all". BUT .... If you acquire WIFi7 APs during your MR-SUBs lifetime you can get your MR-SUB licenses converted to Wireless Network-SUB (I just read a very long document about it). But whats really dumb is that you cannot, up front, when aquiring a new sub use the Wireless Network-SUB for old APs, why not just let me buy those ? I dont get it, at all. @GIdenJoe - I just PM'ed you a "thing" 🙂 Hope it helps. But still as I say right now about these licenses : "Alright, this has become far too silly, let's end this before it becomes sillier" - Monty Python

thomasthomsen · ‎Dec 10 2024

Just learned that everything is now Cisco-network-sub on CCW (and thats just fine). If you have old APs you still select the MR in the Meraki part of the SUB, and then you can convert later to "Network-SUB" if you acquire WIFi7 AP. - and this, at a glance of course seems fine. But..... what you CANNOT do is selecting the NEW Network-SUB (that inclused Spaces) for wireless, for old APs, even when you are renewing or creating a new SUB, because the "new" one does not "work" with old APs. To quote Python : "Alright, this has become far too silly, let's end this before it becomes sillier".

thomasthomsen · ‎Dec 10 2024

No no .. Meraki licenses (even Subscription) is still one license to one AP, even with the new WiFi7 ones, no difference. Its only Cisco on-prem with 9800 WLCs that has a problem with DNA licenses versus Subscription (that is now required here for WiFi7 APs).

thomasthomsen · ‎Dec 9 2024

Now we just need the same for MX and the switches. (I know we kinda have it for MX, but still, on the appliance page would be nice).

thomasthomsen · ‎Dec 9 2024

What I have learned from watching videos, and presentations, about the new licensing for the new APs in the previous weeks. 1: Meraki stays the same (more or less). You want subscription , no worries, here is a subscription, and you can perhaps save a little money on the "essential" license, versus co-term (a good offer to go to advantage perhaps ?). You are still on co-term, no worries as well, you can just continue here if you like. Its all good, and everyone is happy. 2: Current Cisco on-prem. customers, unfortunatly, *frelled* - Imagine having bought DNA licenses for 5 or 7+ years, then, before this, still just changing APs, because the license is the same in your smart-account. Now, if you want Wi-Fi7 AP , buy new licenses (aka. subscription). There does not seem have been any though put into giving these customers anything (a upgrade path, a 1:1 conversion, anything). That is gonna be one awkward conversation with those customers. (I have already started to create memes for our sales support). The best one involves the "two buttons meme", as a current Cisco DNA license holder, to convert your licenses to Meraki Co-term, or buy new licenses. "Funny" stuff.

thomasthomsen · ‎Dec 9 2024

I havent actually tested the wireless connection of my MR36H APs with this software (wired works just fine). Ill try, to see if I can verify.

thomasthomsen · ‎Dec 9 2024

Hmm fun thing happened. The software was "reposted" / promoted to stable. Then ... a short while after I got the firmwarebot mail, the first CW917x in the lab rebooted, then 10 mins later the second one..... The reason "firmware upgrade". And the network was already on 31.1.5.1, and nothing happened to the MR APs in the lab, how strange. Was I the only one this happened to ?

thomasthomsen · ‎Dec 4 2024

When I see such strange things, I always quote Timmy Turner : "uhh Internet ?" 🙂

thomasthomsen · ‎Dec 4 2024

Yeah, no issues here as well (MX85)

thomasthomsen · ‎Dec 3 2024

Thanks. No not a particular challenge (that we cannot work around). There are other more pressing things, as you mention, on the MX 🙂

thomasthomsen · ‎Dec 3 2024

I do wonder why this is mentioned under "other": "MX appliances will now use the IP address of their highest number VLAN as the NAS-IP in RADIUS Access-Request messages." ? Was this changed to something else ? has this not always been the case (and we are still waiting for the feature where we can actually change this 🙂 ).

thomasthomsen · ‎Dec 2 2024

Yes, Im fairly certain I have heard that this will require the advanced wireless license. But sure, ok, I dont see a problem with that.

thomasthomsen · ‎Nov 22 2024

Just checked , there is no "Mobility domain" in the beacons, and I think that means no 802.11r

thomasthomsen · ‎Nov 22 2024

I have not done that yet ( but of course I will ), what Im saying is that its disabled on the config page of the dashboard 🙂

thomasthomsen · ‎Nov 22 2024

So I have a site where we see a LOT of Challange failures. But What do these cover ? When looking at the "performance" of some of the clients that apparently has this issue, I mostly (only?) see "4-way handshake timeout" as an issue. Is the 4-way handshake considered Association ? ( Since it is after the EAP exchange should this not be an Authentication problem ?) Or am I missing something that the client does (or in this case does not, or fails) on association ? Or could this be because the client had a valid authentication, and then at some point timed out, perhaps during "transit" where it might be in "sleepmode", and it then tried to associate to a new AP, and use that timedout session again ? Another strange thing (different question). Why do I see clients failures on 802.11r when it is not enabled on the SSID ? That is just too strange / spooky for me, unless the clients are trying it, even though it is not enabled. Do anyone know ? Thanks Thomas

thomasthomsen · ‎Nov 9 2024

Fingers crossed if I can now get Smart Port Automation to configure a trunk port correctly to an AP. Not on the bug fix list, but one can hope. Will test later.

thomasthomsen · ‎Nov 8 2024

By doing as you did "unhide" the SSID ? Wireless -> SSID availability -> Visibility = Advertise this SSID publicly. Or perhaps I do not fully understand your question ?

thomasthomsen · ‎Nov 7 2024

I got the answer through other channels. (I dont think Im allowed to share here). But Ill just mark @Inderdeep's answer as the solution. 🙂

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges