Do the switches and AP's actually use the MX as gateway towards the Meraki Cloud? Is there a firewall in front of the MX that is blocking certain ports?   You could also locally login to the MX and see what error it has. ... View more

Yep, if your MX is serving a VLAN it can play relay server, so you just configure DHCP as relay towards another IP. You only have to be sure your MX has a route to the subnet where the DHCP server is at and that the DHCP server subnet has a route to the VLAN the MX is gateway of. ... View more

Do you have the rights to run powershell commands remotely or add VPN through GPO? You could do it manually: Add-VpnConnection cmdlet and be sure to add -SplitTunneling to it. Another thread on this board has a guide on it to add conditional routes (check my response at 01-19-2021 04:41 PM ) https://community.meraki.com/t5/Security-SD-WAN/Win10-Split-Tunneling-and-Add-VPNConnectionRoute-Command/m-p/106857#M26968 ... View more

I feel you guys. I had someone who blocked streaming media in his firewall but wanted YouTube to go through and had to whitelist a bunch of googlemedia domains and allowing UDP ports.   @RomanMDthe captures were done on my pc and I exclusively use Firefox, so yes QUIC is also used on other browsers.  If you read the article that was linked  you'll see it has to do with the chosen quality.   @PhilipDAthcorrect I could have posted this on the Cisco community but I can't be sure which version of NBAR is used on the latest MX beta software.  Also I'm hoping some engineer will see this and just forward it to Cisco. I haven't had a chance to test this on a non-NBAR network so I'm not sure if the classic Meraki TA will catch this or not. ... View more

I haven't tested VRRP with such high latencies.  I would believe for stability you really need a solid connection between the DC's.  It would be completely illogical to have latencies higher than 150 ms between DC's since you could have alot of delay in your applications if you would have a server crossing to the failover MX.   If you have more than one hop, or excessive delays in your DC interconnect, you should consider using VPN concentrator mode instead. But if you insist on routed mode consider following: All VLAN's must be allowed between DC's, so it's a layer 2 connection between the two. If you want to use virtual WAN IP you need to stretch the WAN subnet between DC's (this is usually possible if you have failover routers in front of the MX'es.  If your WAN IP's will be different then you can't use vIP.  Failover will take longer. ... View more

By default when using the windows L2TP/IPsec VPN you are building a full tunnel. Which means your traffic to the internet will be sent over the VPN to the MX and break out from there.   There are many reasons, like a lack of upload speed on the internet circuit on the MX that can cause delays. Also when using full tunnel, the firewall rules and content filter rules also apply to your client!   So path 1: troubleshoot on the MX what rules need to be opened and check WAN link usage and limits. Path 2: configure your client VPN in windows to use split tunnel and add the routes only to the internal subnets that need to be reachable. ... View more

Things to check: Are you using LACP passive or active mode on the Catalyst switches? Are you NOT using fast timers (Meraki uses slow LACP timers just like the default on Catalyst switches)? Is your Port channel configuration correct on Catalyst? ... View more

That is a great question that I don't find an answer for in the documentation. For me it is also not clear if the switch just honours the reauth timeout given by the radius server or has a set time where reauth is needed. ... View more

A broadcast storm does not respect any boundaries like VLAN's.  It will just nuke your link or make your switch CPU peg to 100% causing packets to stop forwarding.   STP will not block against a loop on a "dumb" switch or a switch even in a phone where there is a loop. Only loopback protection can help against directly connected looped ports or ports via dumb switch. Meraki switches should transmit these packets according to the docs. https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS If you are running MS2x or above switches you can also use storm control to limit BUM traffic to a percentage of bw on a link to better survive these loops or even devices that are spamming the network. ... View more

That it "works" was not my criticism. Bad designs always work great until they break 😉 I just wanted to highlight that these large layer 2 designs have inherent issues and will set you up for failure at some point in time. The thing with Meraki is that they will only support features that conform to their best practices.  And yes if you have a background is regular Cisco gear that usually has every feature or possible use-case on board than you could be in for some surprises 😉   It's true that Meraki deployments are quick and easy, but they do require planning if they will support the design. The biggest issue you will always have even when using other vendors in combination with regular Cisco switches is the fact they by default run PVST or RPVST which does not always play well with other vendors.  I have had Cisco switches shutting down ports due to etherchannel guard misconfig because when re-converging the core switches that were another vendor passed through a few RPVST BPDU's causing a massive outage! Normally if you use MSTP in the CORE with forcing the CORE to be the root for all instances (try running single instance IST if possible since stacking and MEC's remove the need for multiple STP topologies). Circling back to the design, the whole reason wireless has the possibility to tunnel clients between controllers or between AP's in Meraki world is because if you have a L3 CORE as you should you can still provide mobility for wireless clients that roam from an AP that has X subnet vs another that has Y subnet because it is connected to an access switch that connects to a different distribution switch. ... View more

I really hate that kind of design with a vengeance. I had a few colleagues that also get clients to have 3 "datacenters" with a triangle like topology just like that one in layer 2.  That makes no sense at all and should be avoided at all costs.  Usually you see these design choices when the customer used to have HP comware switches runnning IRF stacking.   Better designs: Or you have two datarooms with a stackmember in each doing a virtual stack and connect all your access switches to both.  Also WAN/Internet should be spread over these rooms then. Or you only connect access switches to dataroom 1 or 2 with two links and you have layer 3 between them.  And your WAN or Internet outbreak should only be connected to one of those rooms. ... View more

It's important to understand that the precious metals configurations on Cisco WLC's only define the maximum allowed QoS treatment WMM queue and DSCP value.   In Meraki you can set QoS rules per SSID but you don't have a preset limiter.   The best way to accomplish this is to make one traffic shaping rule on the wireless -> firewall & traffic shaping page that matches any subnet with a custom expression and then choose the correct DSCP value.  You can't set the 802.11UP value anymore but I believe they are correctly derived from the DSCP value. ... View more

The AP domain is enforced by the network wide -> General page setting: Country/Region. ... View more

It's up to the device to tag it's own traffic with the voice VLAN. The only thing the Meraki switch will do is periodically send CDP and LLDP messages detailing the voice VLAN in use.   You can perfectly capture this using following capture filter: ether host 01:80:c2:00:00:0e or ether host 01:00:0c:cc:cc:cc.   Documented here: https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Verifying_Voice_and_Data_VLAN_tags_with_LLDP_phones   So perhaps you'll have to check the device what it supports, static, cdp, lldp or both and setup accordingly. ... View more

It does support DHCP snooping but the implementation is different. It does not use a switchport to define where the offer/ack messages can come from but rather the MAC address of the originating server.   And it also has DAI which also relies on the snooping database. ... View more

@PhilipDAththat is only the case if you use 802.11r with WPA2 Personal since the keying material is made from the same pre-shared key. If you are using WPA2 Enterprise you'd better use 802.11r or you'll have roaming issues as a full authentication using 802.1X takes a long time.   @DarrenOCgreat question.  I'm hoping a Meraki employee will answer this.  If not we'll have to do a capture to determine the behavior. ... View more

Hey, if  you are using the L2TP/IPsec client VPN ( NOT the anyconnect variant ) then all routing is done on the client. So if you have made the VPN split tunnel then you will need to add the routes to the client. If you are using full tunnel, then it should already work provided you have no firewall rules blocking this traffic.   In case of windows 10 client VPN you can add conditional routes using powershell that only work when the VPN is up. New-VpnConnectionRoute -Connectionname "yourVPNname" -DestinationPrefix "192.168.100.0/23" ... View more

For your first query the answer is no. If your MS250 switch is acting as the default gateway of that LAN then you should configure DHCP server on the VLAN Interface on the switch.  In this case the MX is not even connected directly to that VLAN because it will be connected to a point to point link and routing to that subnet.  Alternatively you can have the switch be a DHCP relay agent, which would mean you need to point it to a DHCP server in an MX or server.   For your second query: it depends what you want to do. If your MS250 is acting as default gateway for all local VLAN's with a transit network to the MX you can have two scenario's. 1) You have a separate VLAN directly on the MX that severs as management VLAN for the switches.  You can either pass that VLAN over the same port to the MS using a trunk link or use a secondary link that only allows the management VLAN.   2) You grow the transit subnet between MX and MS to a /29 and have the MS250 management IP be in the same subnet as the transit IP.  then you can have a management VLAN that terminates on the MS250 for downstream switches.  This one is a bit weird but is valid. ... View more

The AP itself only passes on the EAP messages from your client to the radius server via radius auth packets.   When reading your explanation you can only set the credentials with an admin account, so the regular user is not logged in.  So there is something on the OS side that is preventing the user for entering and saving their credentials to the Wi-Fi profile. ... View more

Since I have not yet heard of a 3x3 AX client we need to assume the client will be a 2x2 AX. Looking at the MCS table for an 80 MHz wide channel, if that is how you are actually testing it you should have 3 possible PHY values: Please check if your clients effectively says one of these data rates.   1200Mbps = 2x2 MCS 11, 80 MHz, 0.8µsec GI 1134Mbps = 2x2 MCS 11, 80 MHz, 1.6µsec GI 1020Mbps = 2x2 MCS 11, 80 MHz, 3.2µsec GI   Then should also have an Ekahau sidekick standing by to capture and live monitor the waves when you start your transfer and see if all channels are nicely used at 80% or a bit more.   If both of your scenario's are exactly right, then you should have a fair test between both access points.   Since your effectief throughput will be around 2/3rds to 3/4ths of the physical rate, this should possible give a 800 Mbps of throughput.   ... View more

You shouldn't worry about it. The major problem with this metric is that it always uses the clients max supported bitrate which is highly dependent on the channel width.  However if your Wi-Fi is designed around 20 or 40 MHz and your client supports 160 MHz then you'll have 12.5 to 25% of your max bitrate all the time if you have a good signal.   I think Meraki should consider removing this metric or perhaps try to use the channel width of the largest portion of AP's in the network and put that at 100% but I'm not sure if there are too many variables to make a metric like that work.   To explain: If an AP is running a BSSID at 40 MHz and the client has support for Wi-Fi 5 MCS 9 with 2 spatial streams then the maximum bitrate achievable would be 400 Mbps then that number would have to be set at 100%.  Only then would the metric be fair because if you have good coverage those clients should vary between 400 and 270 Mbps IMHO.  If you have bad coverage or an issue then you could see the client drop to below 100Mbps and THAT would be a problem to show on that metric. ... View more

that's why STP is one of the hardest topics for any networking pro 🙂 ... View more

@Tore If you have an MST1 instance on the Catalyst then you will have a differente instance to VLAN mapping and have a different configuration digest.   This means your Meraki switch will no longer be in the same region and you'll have to reason how the MST region will interact with the Meraki MST region. ... View more