Meraki

thomasthomsen · ‎Jan 2 2024

I think there is a bug in MR30 when in survey mode for 6Ghz. When switching to survey mode, I very briefly see the 6Ghz survey ssid from the AP when using a tool like WiFi Explorer Lite. But I NEVER see it using Ekahau SK2. My speculation is that the AP simply does not do FILS or Unsolicited probe response when in surveymode, and WiFi Exploere Lite only "found it" because the Intel NIC in my laptop did a passive scan. - This is bad, it has to do FILS or Unsolicited probe response in order for us to use it as a survey AP. (Im fairly certain it did in MR29 software, because I had a 9164 running in with that software for a long time in survey mode without issue).

thomasthomsen · ‎Jan 2 2024

Just for good measure ( measure, survey, pun intended ? 🙂 ), I created a case for "6Ghz not working in survey mode". I have yet to have any useful feedback on it.

thomasthomsen · ‎Dec 27 2023

This could work : https://documentation.meraki.com/MR/Encryption_and_Authentication/Meraki_Local_Authentication_-_MR_802.1X As long as you can speak "LDAP" with your Azure AD.

thomasthomsen · ‎Dec 27 2023

Being a positive person, Im sure it will happen at some point 🙂 - Just give it a little time 🙂

thomasthomsen · ‎Dec 27 2023

I would recommend setting the channel-width to something static, instead of auto (from the picture though, all your APs are running the same channel-width , so no worries) - But, from experience, some clients prefer wider channels, so for example, if an AP is running 80 Mhz but far away, and a much closer AP is running 20, some clients will still prefer the wide (but far away) AP 😕 And while you are "playing" why not enable more 5Ghz channels, looks like you are only using the non-DFS ones (depending on reg-domain of course). If worried about DFS I recommend enabling the Auto RF / AI channel planning. That actually seems to be ok, when in a DFS environment (again only from personal experience). Also , from experience, remember to disable "Client balancing", I think it's still enabled by default on Meraki RF profiles. To me "Client balancing" is very useful for high density, like lecture halls and so on, but for a normal office environment, I always disable it, because historically, it has only caused trouble.

thomasthomsen · ‎Dec 20 2023

I see that the documentation for this has been updated (Last updatedApr 13, 2023). Now it does not mention any special , ehhh, "conditions" for different models. Will it now work, across all switches regardless of port density ? - do anyone know ?

thomasthomsen · ‎Dec 15 2023

Perfect this looks like the (for now, until the 9300X is introduced in an "-M" SKU) answer I was looking for. Thank you.

thomasthomsen · ‎Dec 15 2023

Hi all. I cant seem to find any document describing what license I should buy for the dashboard when converting a C9300X to "meraki mode". I know these license SKUs for the "normal" switches: Catalyst 9300-M License Structure 24-Port 48-portAdvanced FeaturesEnterprise Features LIC-C9300-24A LIC-C9300-48A LIC-C9300-24E LIC-C9300-48E But what about the 12Y and 24Y 9300X ? Do anyone know ? Thanks Thomas

thomasthomsen · ‎Dec 13 2023

Perhaps somewhat off-topic. Do anyone know if Meraki will support WPA3 iPSK with Radius ? Its possible to do on the 9800 WLC, as far as I can tell.

thomasthomsen · ‎Dec 13 2023

Looking at the CS switches, we are currently missing some "ease of use" features that are currently on the MS switches. Do anyone know if these are in development ? and what is the expected ETA ? Im here specifically thinking about features like - SecurePort and Switch Port Profiles. Both features that are really useful, and "customer friendly". Thanks Thomas

thomasthomsen · ‎Nov 26 2023

Well the though was that when you utilize Guest VLAN, then the client would be put into that VLAN on an access-reject. And I would just like to return some more config to that Guest access. https://documentation.meraki.com/@api/deki/files/3974/MS_802.1X_auth_flow_chart.png?revision=1&size=bestfit&width=436&height=599

thomasthomsen · ‎Nov 21 2023

So the answer is no. It can only apply GP on accept.

thomasthomsen · ‎Nov 21 2023

Behind the subject is the thought: If I return a group policy (filter-id) in the access-reject message from my radius server will the switch honor this, and apply the GP to the client ? The thought is to apply a GP, with additional ACLs, to clients being placed in the guest network for an access-policy. Thanks /Thomas

thomasthomsen · ‎Nov 21 2023

100% correct. Meraki has made a big "gab" in their switch portfolio here and now. The MS130 takes the low end (with mGig, but no SecurePort , and thats really too bad 🙂 ) - And the Merakified Cat9300 takes the highend from MS300 and the MS400 series. But where does that leave the MS200 series. No mGig and the , as far as I remember, longest living current switch. Will there be a Merakified Cat9200 with mGig and secureport that can take over ?

thomasthomsen · ‎Nov 19 2023

Do anyone have some numbers on those : "Significant performance improvements for MX250, MX450, and MX75 appliances." ? Because the numbers for the MX250 and MX450 with all security features enabled, are lower on the current Sizing guide then the one before that.

thomasthomsen · ‎Nov 19 2023

Sorry for the late reply. No - we kinda abandoned the troubleshooting on this point, because the prime problem was low signal strength for the current posistion of the MG. I do not have one in my lab, so I had no way of doing additional testing.

thomasthomsen · ‎Nov 6 2023

Perhaps we will get lucky at Enterprise Networking PVT in Amsterdam next week ? 🙂 (I still remember when everyone got a 3560CX wayyyy back .. fun times at security check-in in Schiphol that last day 🙂 )

thomasthomsen · ‎Oct 25 2023

Yeah. I might open a case. I just want to be sure everything is connected correctly first (also a damm shame that there is no interface counters on the MX, its on my wishlist 🙂 )

thomasthomsen · ‎Oct 25 2023

MG 3.100 MX 17.10.9 - MX68

thomasthomsen · ‎Oct 25 2023

I would completely agree. But Im just wondering why they seem to match up with the : "Primary uplink status change" of the MG also. This seems strange to me. Why would the cellular interface change when the ethernet link goes down on an MG (not PoE powered of course).

thomasthomsen · ‎Oct 25 2023

This is the MX log for ethernet port carrier change: Oct 25 14:19:06 Status Ethernet port carrier change device: port0, carrier: true Oct 25 14:19:02 Status Ethernet port carrier change device: port0, carrier: false Oct 25 14:17:49 Status Ethernet port carrier change device: port0, carrier: true Oct 25 14:17:23 Status Ethernet port carrier change device: port0, carrier: false Oct 25 14:08:25 Status Ethernet port carrier change device: port0, carrier: true Oct 25 14:08:20 Status Ethernet port carrier change device: port0, carrier: false Oct 25 14:03:37 Status Ethernet port carrier change device: port0, carrier: true Oct 25 14:03:34 Status Ethernet port carrier change device: port0, carrier: false Oct 25 12:02:25 Status Ethernet port carrier change device: port0, carrier: true Oct 25 12:02:22 Status Ethernet port carrier change device: port0, carrier: false Oct 25 12:01:03 Status Ethernet port carrier change device: port0, carrier: true Oct 25 12:00:28 Status Ethernet port carrier change device: port0, carrier: false Oct 25 11:57:32 Status Ethernet port carrier change device: port0, carrier: true Oct 25 11:57:30 Status Ethernet port carrier change device: port0, carrier: false Oct 25 09:35:24 Status Ethernet port carrier change device: port0, carrier: true Oct 25 09:35:21 Status Ethernet port carrier change device: port0, carrier: false Oct 25 09:34:08 Status Ethernet port carrier change device: port0, carrier: true Oct 25 09:34:03 Status Ethernet port carrier change device: port0, carrier: false Oct 25 09:33:59 Status Ethernet port carrier change device: port0, carrier: true Oct 25 09:33:42 Status Ethernet port carrier change device: port0, carrier: false Oct 25 09:32:21 Status Ethernet port carrier change device: port0, carrier: true Oct 25 09:32:18 Status Ethernet port carrier change device: port0, carrier: false Oct 25 07:34:31 Status Ethernet port carrier change device: port0, carrier: true Oct 25 07:34:27 Status Ethernet port carrier change device: port0, carrier: false Oct 25 07:33:16 Status Ethernet port carrier change device: port0, carrier: true Oct 25 07:32:22 Status Ethernet port carrier change device: port0, carrier: false Oct 25 07:30:35 Status Ethernet port carrier change device: port0, carrier: true Oct 25 07:30:32 Status Ethernet port carrier change device: port0, carrier: false

thomasthomsen · ‎Oct 25 2023

Im trying to figure out whats going on here in this eventlog (see below). The MG actually have to sims from different providers. Auto failover is enabled. SIM1 (as you can see) is TeliaDK SIM2 is TDC MG is getting power from PSU, not PoE In Denmark we have a very good idea of what ISP is where (mastedatabasen.dk will tell you) When we look at this customers site, they are sitting, "more or less", in the middle of 3 different TeliaDK cells. Only 1 TDC cell is nearby This site looses connection throughout the day, and it matches pretty well with the below log. So I was wondering, does the below log show roaming between these cells ? Because it never fails over to the secondary SIM. But why does the ethernet connection go up and down ? This is very strange behaviour I think. Oct 25 14:22:28 Cellular Cellular connection up local: 100.83.124.240, remote: 100.83.124.241, provider: TeliaDk, connection: AUTO Oct 25 14:18:46 Status Ethernet port carrier change device: port1, carrier: true Oct 25 14:18:29 Status Ethernet port carrier change device: port1, carrier: false Oct 25 14:18:27 Appliance status Primary uplink status change is_cellular: 2 Oct 25 14:17:51 Status Ethernet port carrier change device: port1, carrier: true Oct 25 12:05:18 Cellular Cellular connection up local: 100.83.162.83, remote: 100.83.162.84, provider: TeliaDk, connection: AUTO Oct 25 12:02:37 Status Ethernet port carrier change device: port1, carrier: true Oct 25 12:02:20 Status Ethernet port carrier change device: port1, carrier: false Oct 25 12:02:18 Appliance status Primary uplink status change is_cellular: 2 Oct 25 12:01:43 Status Ethernet port carrier change device: port1, carrier: true Oct 25 09:38:17 Cellular Cellular connection up local: 100.83.217.186, remote: 100.83.217.185, provider: TeliaDk, connection: AUTO Oct 25 09:35:41 Status Ethernet port carrier change device: port1, carrier: true Oct 25 09:35:19 Status Ethernet port carrier change device: port1, carrier: false Oct 25 09:35:17 Appliance status Primary uplink status change is_cellular: 2 Oct 25 09:34:41 Status Ethernet port carrier change device: port1, carrier: true Oct 25 07:37:24 Cellular Cellular connection up local: 100.67.153.179, remote: 100.67.153.180, provider: TeliaDk, connection: AUTO Oct 25 07:34:48 Status Ethernet port carrier change device: port1, carrier: true Oct 25 07:34:26 Status Ethernet port carrier change device: port1, carrier: false Oct 25 07:34:24 Appliance status Primary uplink status change is_cellular: 2 Oct 25 07:33:49 Status Ethernet port carrier change device: port1, carrier: true

thomasthomsen · ‎Oct 24 2023

I would say "yes" based on their docs : https://jumpcloud.com/support/authenticate-to-radius-with-azure-ad

thomasthomsen · ‎Oct 23 2023

Its here 🙂 Or ... something like it 🙂

thomasthomsen · ‎Oct 17 2023

So far ... nothing broken ... BUUUUTT .. on the other hand ... a lot of (some) stuff seems to be missing.

About thomasthomsen

thomasthomsen

Thomas Obbekær Thomsen

Community Record

Badges