The dynamic VLAN assignment through tunnel-private-group-id is a authorization result, not a matching criterium. I would assume you are matching your clients correctly but you should change the authorization result to a number instead of a name so the switches will then apply vlan id number instead of name. ... View more

In smaller network you can do L3 on the firewall instead of the coreswitch.  However in campus networks with multiple buildings or routed access designs you cannot have that and then you have to rely on switching to do the intervlan security OR you can use VRF's which is a feature that is missing on Meraki switches.  That is why the combination Catalyst in core/distribution and Meraki in the access layer is also a good design.  This is the whole reason we have Catalyst monitoring now. On small secret about Catalyst switches and "routed interfaces".  When you create a routed port on a Catalyst switch in the background the switch creates an internal VLAN which you cannot configure starting at 4094 (if internal vlan policy is descending) and only assigns it to the "routed interface" and disables some layer 2 protocols like STP on that port.  So in essence you can do the same on your Meraki switch.  You create an otherwise unused VLAN ID and assign it only on one port and then create an SVI with the correct IP.   About the DHCP thing.  You should do DHCP on the device that is routing or on a separate server(which is better).  If you want to do DHCP on your coreswtich you can only do that if your gateway lives on the coreswitch. ... View more

I believe you'll need to use the VLAN-ID instead of the VLAN-name on Meraki switches.  You could rewrite your access rule in NPS to reflect the number.  That will work on the 2960 switches too. ... View more

I would retract that statement 😉 802.11r is only out of favor in WPA2-Personal SSID's. For 802.1X WPA2-Enterprise it is standard to use 802.11r. I find this behavior @RaphaelL describes disturbing.  In regular Cisco AP's you have flexconnect and there these kinds of details are shared between all AP's in the same flex group(AireOS)/same site tag(IOS-XE) to have 802.11r work perfectly with CoA.  I would only ask if Meraki would do the same for AP's inside the same dashboard network...   So basically as it stands now: the moment you put that CoA button to enabled your SSID will not use 802.11r... ... View more

The issue was confined to downlinking to meraki switches.  The issue didn't occur if you connected directly to a provider router.  We had a test store with that issue so we avoided the release until it was fixed before upgrading. If you right now have two MX devices that don't work then it's tough to argue there is a hardware fault but it could be possible.  However do the usual checks like reseating the TX modules (there were some issues with those modules not fully clicking inside the SFP/SFP+ slot.) then the usual factory defaults, trying some other modules like SFP modules and link up to a switch with fiber just to get the upgrade going.  It's of course handy if you're a bigger Meraki shop and have some spare parts here and there.  Of course if you have multiple switches they should be double uplinked so you should have the ability to disable an uplink and use those SFP's in a switch and the MX. ... View more

I have customers running the MA-SFP-1GB-TX modules on the WAN ports without issue. There was a recent version however (16.16) that had issues with connecting to the switches. ... View more

Well I did a fun calculation and access point to access point traffic can reach very high distances with the MA-ANT-27 if you aim them well, have not much interference and can use both spatial streams (which is not easy outdoors).  Since AP to AP signals can be much higher than AP to client the distances really can be large. Free space path loss calculation MR76 bridge Goal throughput: +/- 200 Mbps Possible matching MCS values at 2x2:2 with channel width: 40 MHz MCS 6 = 270 PHY @ 3/4 = 202.5 Mbps throughput -> necessary RSSI -74 dBm @ 5 GHz 80 MHz MCS 4 = 390 PHY @ 3/4 = 292.5 Mbps throughput -> necessary RSSI -77 dBm @ 5 GHz MR76 + MA-ANT-27 gain 12 dBi @ 5 GHz ETSI EIRP 5 GHz (ch 100 = 30 dBm) Situation 1: 5 GHz channel 100@40 (HE40) (= free channels needed 100,104) Tx Power: 18 dBm Antenna gain: 12 dBi EIRP = 30 dBm Minimum needed power at antenna receiver: -86 dBm Free space path loss allowance (including antena gains): 116 dB Free space path loss allowance (excluding antena gains): 92 dB Distance = 2.7 km Situation 2: 5 GHz channel 100@80 (HE80) (= free channels needed 100,104,108,112) Tx Power: 18 dBm Antenna gain: 12 dBi EIRP = 30 dBm Minimum needed power at antenna receiver: -89 dBm Free space path loss allowance (including antena gains): 119 dBm Free space path loss allowance (excluding antena gains): 95 dB Distance = 3.8 km   I based the minimum needed RSSI values on the MR76 datasheet receive sensitivity values. If you need a calculation with 1x1 which is more common outdoor if you cannot have any reflections I can do that one too but I'm out of time now 😉 ... View more

I love it, those big honkin' panels 😉 ... View more

You have two ways to go about this.  The best way is to have MPLS or your WAN solution in front of the MX is primary WAN and an internet circuit as second WAN.  The considerations you need to make here is that both WAN's need an internet breakout so you can reach Meraki's VPN registries to report private and public WAN IP's and ports and that your traffic will be tunneled over the WAN circuit encrypted.  This solution is best because you can truly use SD-WAN and have very quick failover. The other way is when you can't have tunneling or an internet breakout and that is when you connect your WAN on a LAN ports of the MX and use static routing to other sites.  However you will need a provider private IP address you can continually ping and that does not appear in any of your own subnets so you can explicity point a /32 static route towards it.  Then you can make static routes towards other sites via the E-WAN solution but that are dependent of the success of the ping towards that provider IP.  If that starts to fail you will use the autoVPN route instead. ... View more

I second ww's answer.  Make sure in your RF profiles (wireless -> radio configuration) the disable ax button is not checked. If you are using a client that is also WiFi  rated then it will associate to the SSID using WiFi 6 tech. You can check by performing a wireless capture on a neighboring access pointt to see in the radiotap header if it is using HE instead of VHT. ... View more

If their static IP is configured in a specific VLAN and their uplink VLAN configuration does not match that VLAN it will take a DHCP address from the VLAN it is receiving. For example: your static IP is in VLAN 20 and you have set VLAN 20 as native in your uplink port, but the uplink switch/other appliance has a different VLAN as native, then you will receive DHCP from that VLAN instead. ... View more

Simple: You factory default the AP by using a PIN in the small hole (hold for at least 12 seconds) and your AP will boot in normal mode connecting to the dashboard en retrieving it's configuration.  It won't be in survey mode anymore.   Your local credentials will revert to SERIALNUMBER as login en blank password or the configured admin/password if you set one in dashboard. ... View more

Well for one: ports in 1 Gbps are higher are always full duplex. And secondly the only SFP port types on Cisco switches where you can/have to set speeds is on Nexus switches that run multiple speeds.   There simply is no negotiation between SFP's on both sides.  It just sends the traffic over the TX fiberoptic and receives on the RX fiberoptic.   I would start suspecting there is simply a wrong type of SFP in use in one or both of the switches or the fibercable is not up to spec for the distance/speed.   Both SFP modules at both ends must be of the same standard.  A 10GBASE-SR will not successfully decode data coming from a 10GBASE-BX40 SFP+.  First you need to be sure your fiber is okay and the correct modules are used at both ends. ... View more

What is all this fuss about? If you have an SFP+ port and you insert an SFP+ fiber module it runs at 10 Gbps period.  If you insert an 1 Gbps SFP it will run at 1 Gbps.  Unless you are using some weird dual speed SFP+ modules you shouldn't have any issue.   I guess the only issue you could have is with copper SFP's but since Meraki itself only sells 1Gbps variants one would assume 10 Gbps over copper SFP is not officially supported. ... View more

I guess you can. The restrictions that you have with a 210/225 family switch are: - Maximum 16 SVI's - Only static routing - No DHCP server - No multicast routing   So if your hosts don't need NAT and you can keep below said SVI's then you should be fine. ... View more

If you are going to multiple VLAN's you'll need to troubleshoot the wired LAN first. - Are your clients getting an IP -> if not, check DHCP and link to DHCP server - Can you ping your gateway -> if not, check layer 2 issues - Can you get to the entire -> if not, check your firewall policies. ... View more

Meraki switches alone cannot do what you want. Your gateway will have to take care of the rate limiting. Even if you would use an MX you can limit individual flows but you can't set an aggregate limit.  Perhaps if you would try to match on local net traffic and set the bandwidth limit there but I believe it will apply it to an individual flow. So you'll need some router that can actually police/shape entire queues of traffic. ... View more

Yep, it's a challenge with quick filling up diskspace. I've got a colleague that's working with a script to select between flow logs vs flow_start and flow_end logs.  Apparently my colleague noticed that the flow_start and flow_end logs which also show NAT information always write to the log even if that specific rule is not set to disable logging. And then in that script you can merge different sources going to the same IP/port with hitcounters.  This is useful to start adding more specific firewall rules.  Oh well, busy busy 😉 ... View more

SFP+ ports usually are backwards compatible with SFP modules. I haven't seen any instance where it was not supported yet. ... View more

Greetings from West-Vloanderen and welcome to the forums. 😉 ... View more

I suggest you first put the ap in a network and just create a NAT mode WLAN. Then you can connect to that WLAN and go to 10.128.128.128 te configure the AP in survey mode.   The AP will reboot and then show the site_survey-macaddress SSID where you can once again join and login to the local page on 10.128.128.128. ... View more

In WiFi 6E when using low power (lpi) access points (which will be the default) it is not allowed to use external antennas.  so no there won't be a 6 GHz AP with external antennas coming soon. ... View more

That means you are only sending the system eventlog to your ubuntu machine.  Please go to network-wide and check your syslog configuration.  You need to add the tag Flow in there to enable flow logging. ... View more