- About GIdenJoe
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
GIdenJoe
Building a reputation
Member since Mar 5, 2019
Tuesday
Community Record
84
Posts
33
Kudos
2
Solutions
Badges
3 weeks ago
1 Kudo
In the EU you follow the ETSI rules and these are as following: For the 2.4 GHz ISM band you are allowed 20 dBm EIRP. For the 5 GHz bands it's a little more complicated: UNII-1 and UNII-2 (channels 36 through 64) are allowed 23 dBm EIRP. UNII-2e (channels 100 through 140) are allowed 30 dBm EIRP. The power levels you configure in Meraki and Cisco gear for that matter are the IR values (intentional radiator) so the antenna gain is not added to it to come to the EIRP. So in case of a MR45 which has in 2.4 GHz a gain of 5.4 dBi, you would be able to go no higher than 14 dBm Tx power. And for 5 GHz there is a gain of 6 dBi so if your channel is below 100 you would not be able to set it higher than 17 dBm TX but go up to 24 dBm if using channels 100 and above. However in a good Wi-Fi design you should keep your AP Tx power as close as possible to the Tx power most of the Wi-Fi clients have which usually varies between 12 and 14 dBm for 5 GHz clients. And since you want 2.4 GHz to be less desirable you usually keep that one at least 5 dB lower so 8 dBm is a good value there.
... View more
09-07-2019
05:06 AM
No problem. It's the one thing I find annoying in my country (Belgium) where ISP's only want to use their own routers and manage the config themselves you always lose end to end visibility and having to e-mail back and forth for information and having to rely on their insights.
... View more
09-04-2019
11:29 PM
Hmm I don't want to throw a brick on that support guy but he's clearly unqualified to handle wireless cases then. There is no 4-way handshake on an open SSID so 802.11r can't be used.
... View more
09-04-2019
11:02 PM
Enterprise access points usually have a rogue AP feature. In your case you'll have access points with exactly the same SSID and on the same wired network. This will be seen as a true malicious rogue AP because someone could impersonate the SSID to do man in the middle attacks. Because in your case you just want extra connectivity you'll have to make sure to 'whitelist' the ubiquiti AP's on the Meraki side and do the same for the Meraki AP on the ubiquiti side. Also for good roaming you won't be able to use 802.11r because of two vendors so you WPA2-Personal as security option in this case.
... View more
09-04-2019
10:56 PM
1 Kudo
- First thing to check is if the VLAN is configured correctly on both sides. Does the native VLAN match on BOTH sides? So you'll have to ask how they setup their trunk. If none of the VLANs are native from the provider you'll have to provide a dummy VLAN on your MX or set drop untagged traffic(usually dangerous if you run an HA pair because STP creates potential loops) - Second is of course viewing the DHCP configuration on your MX. - Then you could try to capture traffic on the dashboard (use capture filter (port 67 or port 68)). - Finally it could be a problem on the provider switch with DHCP snooping if enabled blocking your DHCP server.
... View more
08-26-2019
10:46 AM
The Cisco Aironet AP's with WLC do support wireless mesh with ethernet bridging and VLANs.
... View more
08-20-2019
11:47 PM
Funny thing I'd like to mention. We have a customer with multiple sites where one site has a server that hosts RDP sessions for employees scattered thoughout the other sites. On the MX'es on the branches the MX perfectly recognizes Remote desktop traffic and uses the correct uplink selection and DSCP tagging. However at the site where the RDP host is at it does not recognize the traffic flowing back to the other sites. So I ended up adding a rule matching on source port 3389 for the uplink policy and even localnet:ip for the DSCP tagging.
... View more
08-20-2019
11:30 PM
Follow up question: If the traffic on the MR is allowed through the allow any rule, does it still fail to process the L7 rules? Or does it have to be an explicit match on a custom rule? I couldn't imagine the L7 rules ever getting hit like that if even the implicit would allow all traffic.
... View more
08-17-2019
08:04 AM
If you look at the 2.4GHz graphic you’ll see that channel 6 RF output seems to be centered around channel 5 instead. Also it’s unclear if signals from the same AP are ignored or not. Since it uses a separate radio to scan it should also see it’s own transmitted signal. Simply put we need Info how the scanning works exactly What It uses to project It onto the graph A much higher resolution
... View more
08-05-2019
12:38 AM
I think you'll need to fetch all your devices and then look at the action batches so you can add all your entries in there and POST the action batch with all the renames. Maybe some good ol' text edit edit/replace will be required.
... View more
08-05-2019
12:24 AM
I wish I had an Ekahau sidekick so I could also verify what dashboard is saying about interference is actually correct. The graph is surely wrong because the center channels are always wrong especially in the 2.4 GHz band. There can of course be non-WiFi interferers on your channel and if they have a high duty cycle then yes, you could have a 'jammed' warning even with no WiFi clients in that area. I've also complained to Meraki for almost two years now that they should fix the spectrum analyser page and include the damn UNII-2 bands.
... View more
08-04-2019
11:38 PM
I find it strange you can even enable this feature on non-fiber ports. Normally UDLD is a feature only used between switchlinks to avoid unidirection communication causing spanning-tree to erroneously put a discarding port into designated forwarding due to no longer receiving bpdu's. This error state usually only exists if one fiber of the pair no longer transmits due to optics error or cable error. So if you want to enable this feature, only do it on trunks that connect two switches, since only switches support the protocol. Never enable it between switches and hosts/AP's/Firewalls unless they specifically support the feature and have it enabled. You should also start with alert mode ( = normal mode ) before you do aggressive mode which actually blocks a link in case of a unidirectional link.
... View more
07-31-2019
07:16 AM
Compare clients. Are they like clients or all sorts of clients that experience the same? In case of like clients: check the firmwares of the clients. In case of all clients: check the wireless health, spectrum analysis of the AP's and the airtime utilization. Also an over the air packet capture on the channel of the most troublesome channels could show who initiates the disassoc frames client or AP. Also look for excessive retransmissions and the radiotap header if it shows deterioration of the signal.
... View more
07-31-2019
06:56 AM
1 Kudo
Not only apple devices use Bonjour. Most windows clients also run the bonjour service to discover mDNS services on the local LAN. If you're running mDNS services (like printers or video stuff) you can easily detect that by running a packet capture and look for link local multicast 224.0.0.0/24 and it would actually say mDNS. If that happens you can very easily forward those messages to the user VLANs by enabling this feature.
... View more
07-31-2019
06:51 AM
@Kenneth , I haven't seen the possibility to do that. When configuring as spoke you need to define a hub of it doesn't take the config.
... View more
07-31-2019
06:49 AM
Can you remotely login to the AP via SSH and run a debug when this happens? That depends if SSH is allowed on the individual AP's.
... View more
07-31-2019
06:40 AM
2 Kudos
I think it rather has to do with the fact that the Meraki MX is not the hub site but rather a spoke. But in the VPN config you need to at least enable one MX as a hub and let every other MX connect to at least one hub. So you're forced to have that extra VPN connection even though you don't have the intention of using it. So it's rather an architectural issue because you can't really enable autoVPN unless support has a way to do this?
... View more
07-31-2019
06:36 AM
Funny thing today. I had to go out to a customer with two stacked MS225-48FP's which were the noisy ones to have them replaced under the proactive replacement program. I came into the room with the closet and said, man! It's quiet in here compared to last time. When opening the closet I noticed the fans had already failed but the switches were still running, but hotter than usual. I could hear the fans slightly starting and directly stopping. It went from an aeroplane to an old woman groaning sound.
... View more
07-31-2019
06:31 AM
1 Kudo
I'll have to make a test setup if the time and gear permits. In this situation the public IP was owned by a oneACCESS router in front of the MX pair instead of having the pub IP on the MX itself. The hairpin did not work on the oneACCESS router. I captured the traffic and saw the outbound TCP connection but no packets back downstream. The TCP handshake was succesful but followed by a reset short after. So I can only assume the oneACCESS responded itself to the TCP syn. There is a DMZ host feature implemented on the oneACCESS but the ISP manages that router and they couldn't fix it. So I had to implement my workaround by sending traffic destined to that public IP out the other WAN interface so the internet just circled it back downstream.
... View more
07-30-2019
12:53 AM
We have the following situation: On the main site of a customer we have an MX84 with an MPLS connection on WAN1 and a public internetconnection on WAN2. There is a local webserver in the private LAN that has port TCP/80,443 forwarded from WAN2 (public) towards it. Local LAN users can get the private IP address through local DNS and that works just dandy. However professional visitors who only get Guest WiFi access with a public DNS server also need to reach that webserver. Their traffic is of course egressed on WAN2 (public). So for them to reach the local webserver they get the public WAN2 address because I do not wish to give them access to the local DNS server so we expose internal addresses to them. Does the MX support NAT hairpin? And how does it implement it if it does? If it is not supported I could of course try to route traffic towards that destination out WAN 1 (MPLS) and let them circle the internet back in WAN2. But it would be nice if someone could confirm support for the hairpin. At this time it's not working, but I want to do some packet captures locally before calling support 🙂
... View more
07-29-2019
12:12 PM
@Raj66, I found a problem with this behavior. What if you need to define WAN 2 as primary to have the bulk internet traffic leave that way but you want that time sensitive VPN traffic not only to leave your WAN1 MPLS and enter the other side via WAN1 MPLS but the other side also has WAN2 as primary for the same reason. I believe downlink saturation on WAN2 on the other side may very well starve your incoming delay and loss sensitive traffic. Is there a way to escalate this in Meraki to make this behavior configurable outside of using the non-feedback make a wish button?
... View more
07-28-2019
12:23 AM
I understand your argument for the simplicity. But would you want car manufacturers to take away the possibility to change your own tires if you have a flat somewhere on the road and you have to wait for a technician from them to get you back on the road? That the config usually should be simple OK, that's true. But for real troubleshooting you need an 'expert' mode. Like when building VPN's to non-meraki peers it would be a great plus to actually see what's going on because a packet capture can't always see everytning (like the contents of the 3rd exchange in main mode IKE). Cisco itself also introduces simplicity with DNA center but they still allow console access. Just saying...
... View more
07-26-2019
11:53 PM
This is exactly my main beef with Meraki that when real problems occur you only have a green led and a limited log to troubleshoot and no real control over the inner workings. Basically you have a steering wheel and a clutch. With Cisco “Classic” you have a cockpit with loads of buttons and switches. I wish they would have an expert mode on dashboard or a cli/API interpreter where you input commands or code and see direct results.
... View more
07-23-2019
05:33 AM
The funny thing is that for example airmagnet survey pro gives the antenna patterns like they are on the datasheet. However like the AP is depicted on them (internal antenna models) it gives the horizontal pattern as if the AP was on the floor pointing upwards. However in usual ceiling mounts the azimuth (horizontal pattern) should be mirrored! Btw very important: If you have a little part that is inwards 6 dB, that means it reaches HALF the distance in that direction.
... View more
Your subnet should not contain mask/prefix length but rather prefix/prefix length: 192.168.96.0/22 That is the first interface you make and should have next hop set towards the internet. For your DHCP scope option, it's like on a Cisco router. The scope automatically encompasses your entire subnet and you need to define excluded ranges (dhcp reserved ranges).
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 105 | 09-04-2019 10:56 PM | |
| 275 | 07-31-2019 06:40 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 3 | 548 | |
| 2 | 275 | |
| 2 | 432 | |
| 2 | 277 | |
| 2 | 169 |
