Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Danut
Danut
Getting noticed
Member since Nov 20, 2018
Feb 21 2020
Community Record
24
Posts
5
Kudos
0
Solutions
Badges
I went a bit further and I taught I found a solution, but I ended up to the same scenario. I was thinking to host the splash page locally with hope that the RADIUS request will eventually be sent through the splash page to the internal RADIUS servers avoiding clear-text messages over the internet. Unfortunately the documentation makes it clear that the RADIUS messages will be sent to the Meraki first, then to the public RADIUS server. Source: https://meraki.cisco.com/lib/pdf/meraki_whitepaper_captive_portal.pdf Unfortunately I was not able to find a workaround to this. Currently this is a blocker in our network and we are force to use the WPA2 with pre-shared key authentication model. I was really hoping to use an enterprise model for WiFi authentication. Not sure if its worth opening a case, but I wanted to post these messages in case anyone else has this problems.
... View more
I know the AP can't host pages, but I was thinking of a handover done by the AP. Still struggling to find a solution to my initial problem.
... View more
Thank you for your reply @PhilipDAth It's to much work to do to implement EAP-TTLS. And as you mentioned, not all devices supports it. I was hoping to be able to push the Splash page to the AP somehow and configure the AP to do the authentication via the RADIUS protocol. I've noticed that the communication between the client and the Splash page hosted in the Meraki Cloud is encrypted via TLS1.2 and I taught it will be possible to have the page hosted on the AP to avoid the RADIUS protocol originating from Cloud and going to my RADIUS servers over the internet. In the image below I created a flowchart with the actual behaviour (in a very very simple way and not detailed). The lines in red are the RADIUS protocol communicating over the internet with cleartext data. In the second figure I was thinking of an alternative scenario if possible to implement. The change here would be the Splash page hosted on AP. The AP shall pull the page from cloud with an encrypted protocol (TLS1.2) and the RADIUS request for authentication shall be sent from Meraki AP to the RADIUS server (blue lines). This way, the cleartext data from RADIUS protocol would only travel through the private network which is more secure and prevents unauthorised people of "peeking" at this data. I hope it makes sense for what I wanted to say, since I excluded some details to make this post shorter. Also if the scenario I proposed is valid and is possible to implement, is there a document that describe the How-To? Thank you in advance
... View more
Hello everyone, I've made great progress into implementing the RADIUS servers into our network especially to be able to authenticate users connecting to the WiFi network. Everything works great and all the functionality test have passed with little or no problems. After the functionality tests, I started a few penetration tests to check how well the security is in place and I've got some bad results. I've solved many of this security problems and I am left with one problem that I have no idea how to workaround so far, and that problem is the RADIUS protocol itself, which sends data in clear-text. (I know I should have taught this from the beginning but I didn't know I would get to sent the RADIUS authentication packets to the cloud). To be more specific, I have made some packet sniffing on UDP coming from the Meraki Cloud towards our internal RADIUS servers and found those clear text information there: SSID name, AP MAC address, calling endpoint MAC address, AP IP address, username and other less relevant information. The user password hash is also there, but is hashed using SSHA512 which is secure enough to be sent over the Internet. As a security mechanism I didn't expose the RADIUS servers to the public side, I have just made some port forwarding on our gateways which allows only packets coming from the Meraki cloud to access those servers. I have also change the ports to obfuscate the sniffers a bit. But still, the packets (datagrams) are traveling across the Internet containing a lot of information which I am concern someone could use in the process of a reconnaissance attack. I've looked many ways to secure this problem but I didn't found a solution so far. I saw this problem was previously discussed here, but it has no solution: https://community.meraki.com/t5/Wireless-LAN/Sign-on-splash-page-with-radius-server-communication-not/m-p/48757#M7499 Also, changing the Network access to WPA2-Enterprise with my RADIUS server won't help much, as that will raise other problems I encountered and solved based on my previous post: https://community.meraki.com/t5/Wireless-LAN/Second-RADIUS-Server-not-Contacted-for-Authentication/m-p/70221#M10747 Has anyone come to a workaround to this problem? Is Meraki giving some security solution that I am no aware of? Thank you in advance! P.S.: I am using FreeRADIUS as a RADIUS service.
... View more
Dec 10 2019
5:28 AM
Thank you for your answer @SoCalRacer Somehow I did not found that page. I've read many pages but that one I didn't saw for some reason. Following the instructions and notes from that page I was able to find what I was looking for. Now I have to decide if I want to do port forwarding or if I actually want to assign public IPs to my RADIUS servers. Thanks again for helping me!
... View more
Dec 9 2019
6:55 AM
Hello everyone, I have configured two separate RADIUS server with the same setting and I want to integrate my Wireless device to be authenticated agains those servers. The reason I have configured two separate RADIUS servers is to have high availability in case the primary server do not respond. However, I have tested the scenario in a testing environment and the results didn't go as expected: - Firstly I have tried to authenticate using my primary RADIUS server and everything worked well. I saw the messages on the server side as expected. After the first successful attempt I have disabled the RADIUS service on the primary server and try to re-authenticate again. The expectation was that after the authentication messages would time-out on the first server, the AP would use the second server, but it never happens. Using TCPDUMP I've notice the request packets go to the primary but never to the second server. Has anyone encountered similar problem using two RADIUS servers for high availability ? Thank you in advance! P.S.1: I am unable to use the testing method from the dashboard. That method uses ms-chap while I am using LDAP in the backend. P.S.2: Picture of the RADIUS setting attached.
... View more
I have Hostname Visibility enabled, but unfortunately it doesn't provide much info. I only see gigs of traffic coming from iTunes without any additional informations. Thank you for tour answer !
... View more
I will definitely do some tests to check any possibility to improve the Wireless Network overall. Thank you for your answer!
... View more
Thanks for your answer @Nash Yes, most of our devices are Apple. I was a bit suspicious that the traffic I saw was downloaded, not uploaded. The iCloud traffic is marked as iTunes traffic and that was a bit unexpected for me, and moreover most traffic coming from Apple is marked as iTunes traffic. For anyone interested in this topic, I want to point out that apps downloaded from AppStore, documents, pictures, messages from desktop stored in iCloud will be marked as iTunes traffic. Thank you for your indication, it helped me understand how some settings/accounts work on Apple devices. Most probably I will create some rules to shape this traffic and optimise the Wireless overall. Thank you!
... View more
Hello everyone, Due to a high number of clients connected to my Meraki MR42 APs, I had to set a bandwidth limit for different applications to avoid congestion. Most of these application include OS updates and video streaming. Since few weeks ago, I got lots of alerts telling me that the network usage is very high. Upon checking I noticed that most of the traffic is marked as iTunes traffic. Further investigations reveal that this traffic has nothing to do with iTunes, yet is the already filtered traffic masked under this App. None of the users from which I got traffic alerts use iTunes or tried to bypass the traffic filter, so it comes to my mind that the AP is not filtering the traffic well. Is there anything I can do to improve this kind of behaviour? P.S.: I don't want to filter the iTunes traffic for now, since I may filter important traffic that is marked incorrectly as iTunes data.
... View more
Thank you for your answer! Indeed the authentication with certification on both server and client using the EAP-TLS framework is the best security model. Unfortunately is the hardest to manage and it is not scaling well with my network. As a temporary solution I will create users for all the devices, which will allow me to monitor them for suspicious activity easily.
... View more
Thank you for your answer! After thinking more about my question, I have realised that I may have thought of the problem less than I should. As the SSID is configured to be secured with WPA Enterprise, all the devices will expect to login using authentication credentials. Thant's how the WPA Enterprise works by it's very nature. Creating a separate SSID could solve this problem easily, but I do not want to do that since there are a lot of interferences already. I think the best solution for my case will be to create users for devices. This will also enable device monitoring for suspicious activity.
... View more
Hello everyone, I want to implement the RADIUS protocol over my WiFi network as part of AAA framework. The radius servers are deployed, as well as a testing SSID. The authentication on WiFi is based on EAP-TTLS-GTC framework with an LDAP database as a backend, and everything works fine and smooth for testing. The problem I have is with the devices that do not use a user from the database for authentication, such as printers and TVs. It is possible to bypass the EAP authentication and allow these devices to connect based on their MAC address only? I have tried to create a group policy which bypass the splash page, but the devices in that group still require EAP authentication. Thank you in advance!
... View more
Mar 15 2019
1:26 AM
Back again with some results. I set the 2 Wireshark instances to collect data from LAN and WLAN. After 6 hours of collecting data I filtered the output and found no CDP messages over WLAN but found a lot of them over LAN. I am not sure what generate the CDP messages over the WLAN, but it seems they are not send anymore. I still don't understand why these messages are send via LAN? are they required in a mesh mode, or can they be disabled? Thou they can only be captured inside the LAN (everywhere in the LAN, since they are broadcasted/multicasted), and they don't seem to contain critical information I would like to reduce the number of messages that can be used to gather network information. I know these messages represent a low/minimal risk, but if they can be stopped I would like mitigate the risk. I know I started this thread to let you know I saw the CDP messages on WLAN. It looks like the scan I did over a work shift didn't reveal any CDP frames over the WLAN. I would do further scans and I intend to let the Wireshark capture packets from WLAN for a week and I will analyse the results. Below, I attached a picture with the result I collected from LAN with private data hidden. The source of these messages are the Meraki APs: Wireshark CDP packets captured
... View more
Mar 14 2019
1:59 AM
Yes, we used them in bridge/mesh mode. I wanted to post an example but I forgot to save the pcap file before I went home from work. I did some brief tests again today and I didn't saw any CDP or LLDP messages, but I am sure they existed. On the time I saw the messages I started to investigate the source and it turned out there were from the Meraki APs. If someone can do some test and tell me if they can see similar messages I would really appreciate. I will try to do some extended captures over longer periods of time and check if they send CDP messages again. P.S.: When I did the initial scan and saw the CDP messages I was connected to a Meraki MR33 AP. There were about 6 CDP messages which contained information about all the access points (Firmware, Version, Model, etc.). I was connected wirelessly only and that is when I started to became sceptical and investigate further the source and cause.
... View more
Mar 13 2019
6:12 AM
1 Kudo
The problem with CDP packets is that they are sent over the network wirelessly and can be used for network discovery. If the CDP and LLDP protocols are used to provide info for the dashboard, I think the messages should be send over the LAN (since all the APs are in AP mode, not Repeater). If the messages are send over the LAN I would not have a problem with them, but since they are also send wirelessly I would like to stop them (on the wireless medium, of course) Also, Cisco best practices for security suggest to disable CDP and LLDP protocols when not used.
... View more
Mar 13 2019
4:38 AM
Hi, I am sorry if this is a duplicate question, but I was not able to find the answer I am looking for, just similar topics which don't answer my question. So, my question is simple. Can you disable CDP protocol on Meraki APs? especially for MR42 and MR33; which we got in our enterprise. During some tests of a new protocol, using Wireshark I discovered that the APs send CDP messages. I checked the source of the messages and they are the Meraki APs indeed. We do have other Cisco devices in the network, but all of them are CDP disabled for security reasons. Thank you in advance ! P.S.: All of the devices are use the latest firmware.
... View more
Thanks for your response I made a wish for that column in the dashboard and I'll wait for their response. Also I have enabled SNMP for monitoring hoping I'll find there an OID for system uptime, but I just found these: SNMPv2-MIB::sysORUpTime.1 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.2 = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::sysORUpTime.3 = Timeticks: (2) 0:00:00.02 SNMPv2-MIB::sysORUpTime.4 = Timeticks: (2) 0:00:00.02 These metrics are not helpful at all. Also I think I found a bug on SNMPv3, where it says "Decryption error" even thou I place every password correct in the snmpwalk. And yes, the system uptime is an essential metric for every equipment, especially network equipment. Thanks
... View more
If I do that, it just says no connectivity and the time interval which is usually 1 minute. I have a complete isolate AP, with no neighbours so I don't think the clients roam. Thankfully, with the community help I solved the roaming problem here: https://community.meraki.com/t5/Wireless-LAN/Meraki-MR42-client-jumps-to-distant-AP/m-p/32253#M5106
... View more
Thank you for your answer I looked through all the logs and everything looks normal. I have checked the logs from the Meraki dashboard for each AP, and I also looked through the logs sent to the logging server but everything looks as usual. Will the SNMP monitoring give more detailed information about what is happening? Thank you
... View more
Hello everyone, I have noticed a problem, and I am not sure how to explain it very well, but maybe someone else know this and may help me or at least explain me what is happening. If I go to the Wireless -> Access Points Dashboard, I see on the connectivity row some red lines (no connectivity time). Thou, if I check devices that are connected to that specific AP, I see that they are associated for days, or even weeks. You may say that those devices are connected to the AP, but the AP can't get to the internet and that is a fair point of view, but I have a device which constantly pings an IP outside the local network and graphs the results. The result shows no interruptions while the Meraki dashboards shows 2 minutes of no connectivity. Does someone else saw this kind of issue or know why is happening? Thank you! P.S.: I have attached 2 images representing the Meraki status and my network result status to understand better the situation. My network results Meraki dashboard status
... View more
Nov 20 2018
7:57 AM
Thank you for your reply, I have checked the radio profile as suggested, and the client balancing option was turned on indeed. I just used the default indoor profile for radio settings. The AP was indeed a bit more busy than usual when the "random roaming" happened, but it had only a maximum of 39 clients. From the official documentation I understood that this model of AP can easily support 50 clients. Also during that period I have checked the channels utilisations and it was no more the 50% on 2.4GHz and 30% on 5GHz. I will look closely to this option and maybe disable it, but I am also interested in the actual metrics of the APs. Thank you!
... View more
Nov 20 2018
7:43 AM
Thank you for your reply, Yes, the client/s with the problem are MacBooks. They switch between AP's with the same radio (5GHz to 5GHz), rarely they switch between APs and radios. The "Dual band operation with Band Steering" option is also enabled as it is very useful and I use a minimum bitrate of 36 Mbps. The transmission power is set to 15dB, but I do not really want to set it any lower, as some distant clients may have connectivity problems after. Is there any way to export more detailed logs about what is happening on OSI Layer 2? (Will SNMP do this?) And can you force a client from the Meraki dashboard to connect to a specific AP from the WLAN? Thank you
... View more
Nov 20 2018
7:00 AM
Hello, I currently use 3 Meraki MR42 APs for our enterprise WLAN network, one on the first floor of the building, and the others on 3rd floor and 4th floor. The problem is that some clients from the first floor AP jumps to the 3rd floor AP or even the 4th one. The signal of those client goes from 40-50dB (when connected to the closest AP) to 13-17dB (when connected to distant APs). If I look through the log of the clients that report the problem, I just see that they roam between APs even thou they don't move they're equipment at all. The logs just tell me: WPA authentication Multiple DHCP servers detected 802.11 association 802.11 disassociation WPA deauthentication And the loop continues couple of times I always keep the APs up-to-date but the problem still persisted for couple of months. Also the equipment (MacBook-Pro) has the OS freshly installed. Does anyone have any idea why are the clients roaming from the closest AP to the distant ones? Or it is possible to enable more layer2 logging?
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 3163 | |
| 1 | 3230 | |
| 1 | 3879 | |
| 1 | 4408 | |
| 1 | 5892 |
© 2024 Cisco Systems, Inc.
