About GIdenJoe

GIdenJoe

I tested it using MS authenticator and it seems to work fine with the OTP it generates every time. Now I can make a wish and have them support face-id 🙂

GIdenJoe

Hey Philip, I'm from Belgium 🙂 But would you know by chance this would also work on Microsoft Authenticator? I already use that app because my company is heavy into Microsoft and all 2 factor auth's run via that app.

GIdenJoe

Nice! We did have to work with a European reseller though.

GIdenJoe

Welcome Mike the vocalist! Don't drop the mike before you're done talking 😉 You'll indeed find some stuff being different than regular Cisco and it's important to know when to not follow the Cisco guidelines because there are some huge cultural differences between the two product stacks.

GIdenJoe

I was following the Meraki documentation where I first made a mistake but now it saw my error and fixed it! So if you know the IP of the host you wish to track. Go into Organization -> Settings and NOT Network -> General, that was my mistake btw 😛 There you need to add a custom PIE chart. There you fill in the desired name of the application and choose IP range.... and then fill in just the IP of the host. Once that is saved you will find the application under custom in the add webapp dialog.

GIdenJoe

It seems that today after logging in with my password I get stuck on a server error, so I don't receive met text message to do the two factor.

GIdenJoe

Heh, I have the same problem with the WiFi stand not being wide enough to support MR46 and above without mounting it diagonally on the bracket. 🙂

GIdenJoe

I usually make less use of the per client limit function unless it is a really slow link, or perhaps a strictly policed link. I do concentrate more on the 8 traffic matching rules you can define and make sure each goes into the correct queue. If you do severely limit per client, then the speedburst alone is not enough, you'd need to match certain traffic types and let them go beyond the limit.

GIdenJoe

Well you don't want to see any Meraki setup SSID's broadcasting anyway since that means something is botched up 😉 Just don't contain that SSID 😜

GIdenJoe

This is why I extensively use the "virtual stacking" feature. In every org I always apply tags to ports with identical configuration (except name ofcourse) and always use the tag to filter the correct ports so I always have consistent configuration across the board. Ports to end users have the access tag and a descriptive tag for the VLAN used. Ports between switches always have the trunk and isl tag. Ports between switch and ap always have the trunk and ap tag, and so forth. Also make sure you make some good filters before tagging is applied to the new switches. Learning to use the stack:part of name port:1-12 always helps to quickly select correct ports.

GIdenJoe

Your vMX will have it's own IP in an Azure network and you'll need to route packets from the Pa towards the IP of the vMX towards all spoke networks. You can achieve this using a few static supernet routes or using BGP if it is possible to peer with the Pa to exchange routes that way.

GIdenJoe

You can't apply group policies just to an SSID. It's on an SSID per device type (and the MR needs to see HTTP traffic before applying said policy) or you can apply it using dot1x, sentry policies or manual assignment.

GIdenJoe

Like Bruce mentioned your VLAN config on your phone needs to match the design. It is very possible the phone is statically configured with a voice tagged VLAN which has not been configured on the switchport. If using CDP or LLDP then the phone should receive the voice vlan through these protocols.

GIdenJoe

I believe those are inner workings of the software on the switches themselves. Not something we would know. The only info I do know is: LLDP frames are sent every 30 seconds with a ttl of 120 seconds CDP frames are sent every 60 seconds with a ttl of 180 seconds The switches should catch on quite quickly if a new entry comes up in the switch. But they do seem to keep old entries on for a while and the change is not reflected on the dashboard immediately.

GIdenJoe

He still fits between the rails! 😛

GIdenJoe

Go to your room!! 😛 Just kidding. In the RF profile you just showed you can just put the maximum power level to 14 dBm instead of the current 21. Then all AP's using this profile will lower their transmit level. Make sure all the AP's have the correct RF profile set. If the auto channel does not do a good job then you can manually change the channel on an AP. In the radio settings page you can just click on the current channel of an AP and then you can change from auto to static and select the channel.

GIdenJoe

That person that configured loop guard on endpoint ports does not understand STP. It only makes sense to use BPDU guard on access ports to endpoints. Since I haven't seen any Meraki network using OOB cloud access I have never been able to implement loop guard because dashboard configuration does not allow it.

GIdenJoe

If you have a Tx power of 21 on your AP and you're only 4 meters away and your RSSI reads -69 then there must be a big fat concrete wall between you and that AP. No way you can have this low of an RSSI in open air at 4 meters. Secondly when I look at your screenshots I see that both AP's are on the same channel 36. There must be a reason why his pc won't connect to this one like airtime utilization while client balancing is on. First before continuing troubleshooting make sure both AP's are on non overlapping channels and your transmit power is closer to what your clients can use like 14 dBm.

GIdenJoe

Maintaining fewer major releases is easier I guess 😉

GIdenJoe

IIRC the older AP's themselves should remain at their maximum supported firmware even if the network goes beyond it. The new MR performance information tabs will not receive any information from the MR32 AP.

GIdenJoe

Oh, that's a little different. That reminds me of the Catalyst instant access switches, they also had that limitation. Well in that case perhaps MS switches do support actual high number of VLAN's and they haven't found a way to translate that onto the Catalyst. Funny how architectures can differ so much. And no the 9300 is a highend access switch. Seeing that the regular MS switches do have fewer hardware features/options than Catalyst switches I believe the CAM/TCAM space is formatted differently. If you don't need that many features you can focus on having a huge number of VLANs. There is also the reason you only have 1 ACL set on an MS switch and it can only carry 100 or so entries. On Catalyst for example you can do ACL's per port, per VLAN, in dynamic sessions, for matching other features, MAC ACL's, so I do believe you lose alot of TCAM space to support those features.

GIdenJoe

The all setting is simply defines the allowed list. The allowed list is not the same as the actual number of VLANs that exist in your network. On Catalyst switches you can also allow ALL VLAN's but you can't define more than a couple hundred of VLANs simultaneously on lower end switches. I'm not sure internally Meraki also has to create those VLANs if you explicitly allow them on trunks or make access ports inside your network with specified VLAN's, but all other switches do, even HP and other brands. I'm pretty sure if you would have a large L2 network and you define each access port in another VLAN you could run into trouble.

GIdenJoe

Why on earth would you have 1000 VLANs in the same L3 domain? The switch does support the VLAN numbers from 1 to 4094 but you can only define up to 1000 VLAN's in total which is a normal limitation of the CAM/TCAM space. And it uses 802.1q to make trunks to other switches so yes it does support it.

GIdenJoe

The issue was that the firewall didn't work anymore and you at least had to fact reset the device to make it work again.

GIdenJoe

I haven't gotten any strange issues like that. The deployments we are having though usually have a radius server on the LAN or at least a close SD WAN site close so the chance of lost packets is smaller.

GIdenJoe

Community Record

Badges