And what is the switch and SFP on the other side of the fiber link? ... View more

I'm sorry but the options are 1G, 10G, 40G, 100G. I have never heard of 2.5 G SFP fiber. You can have 2.5G and 5G copper links but not fiber. ... View more

Hmm if you want usecases like that I think you will require a switch to do that. ... View more

Your traditional way remains the same way you do it today.  However you don't need to define the VLAN's on the switches.  They are automatically in use if you use them on an access or trunk port. So yes best practice is to have wireless user vlans tagged on the trunk port and the ap mgmt vlan untagged on the port.   In Meraki it is easier to use VLAN 1 native because you can more easily onboard Meraki switches that way however it goes against the best practice to not use an active used VLAN as trunk between switches to avoid VLAN hopping.  You also have the possibility to tag all VLANs on trunks between switches by just not setting a native VLAN. ... View more

The SNR value is the value of the most recent upstream frames from the client.  So the AP just shows how it actually receives the client frames. So yes it is from the perspective of the AP. Usually a value above 25 dB is considerd within spec. ... View more

So the DHCP server is allocating an IP to the AP.  Did you run a capture on the switchport to verify the DHCP ack is actually reaching the device?   If DHCP is ok then you still have the test that the AP can actually reach dashboard via the port. maybe test another device on the cable where the AP is cabled on and see if it also gets an IP in the same range (assuming you use the native VLAN for AP management) and test your internet connectivity. ... View more

If your AP is in repeater mode it received PoE power from the switch but there is a layer 1 or layer 2 issue preventing the access point from reaching the Meraki Cloud. Usually VLAN configuration issues prevent the AP from reaching it's intended default gateway or DHCP is not working.  But it could also be a cable issue between the switch and the AP itself. ... View more

Don't forget that Meraki ACL's are basically a collection of VACL's (VLAN ACL's).  So basically it's a giant port ACL that is applied to every port, depending on the input VLAN if defined. This means you can block intra VLAN traffic which is different from a RACL (routed ACL) you applied on your 3750 SVI. ... View more

In smaller network you can do L3 on the firewall instead of the coreswitch.  However in campus networks with multiple buildings or routed access designs you cannot have that and then you have to rely on switching to do the intervlan security OR you can use VRF's which is a feature that is missing on Meraki switches.  That is why the combination Catalyst in core/distribution and Meraki in the access layer is also a good design.  This is the whole reason we have Catalyst monitoring now. On small secret about Catalyst switches and "routed interfaces".  When you create a routed port on a Catalyst switch in the background the switch creates an internal VLAN which you cannot configure starting at 4094 (if internal vlan policy is descending) and only assigns it to the "routed interface" and disables some layer 2 protocols like STP on that port.  So in essence you can do the same on your Meraki switch.  You create an otherwise unused VLAN ID and assign it only on one port and then create an SVI with the correct IP.   About the DHCP thing.  You should do DHCP on the device that is routing or on a separate server(which is better).  If you want to do DHCP on your coreswtich you can only do that if your gateway lives on the coreswitch. ... View more

I would retract that statement 😉 802.11r is only out of favor in WPA2-Personal SSID's. For 802.1X WPA2-Enterprise it is standard to use 802.11r. I find this behavior @RaphaelL describes disturbing.  In regular Cisco AP's you have flexconnect and there these kinds of details are shared between all AP's in the same flex group(AireOS)/same site tag(IOS-XE) to have 802.11r work perfectly with CoA.  I would only ask if Meraki would do the same for AP's inside the same dashboard network...   So basically as it stands now: the moment you put that CoA button to enabled your SSID will not use 802.11r... ... View more

The issue was confined to downlinking to meraki switches.  The issue didn't occur if you connected directly to a provider router.  We had a test store with that issue so we avoided the release until it was fixed before upgrading. If you right now have two MX devices that don't work then it's tough to argue there is a hardware fault but it could be possible.  However do the usual checks like reseating the TX modules (there were some issues with those modules not fully clicking inside the SFP/SFP+ slot.) then the usual factory defaults, trying some other modules like SFP modules and link up to a switch with fiber just to get the upgrade going.  It's of course handy if you're a bigger Meraki shop and have some spare parts here and there.  Of course if you have multiple switches they should be double uplinked so you should have the ability to disable an uplink and use those SFP's in a switch and the MX. ... View more

I have customers running the MA-SFP-1GB-TX modules on the WAN ports without issue. There was a recent version however (16.16) that had issues with connecting to the switches. ... View more

Well I did a fun calculation and access point to access point traffic can reach very high distances with the MA-ANT-27 if you aim them well, have not much interference and can use both spatial streams (which is not easy outdoors).  Since AP to AP signals can be much higher than AP to client the distances really can be large. Free space path loss calculation MR76 bridge Goal throughput: +/- 200 Mbps Possible matching MCS values at 2x2:2 with channel width: 40 MHz MCS 6 = 270 PHY @ 3/4 = 202.5 Mbps throughput -> necessary RSSI -74 dBm @ 5 GHz 80 MHz MCS 4 = 390 PHY @ 3/4 = 292.5 Mbps throughput -> necessary RSSI -77 dBm @ 5 GHz MR76 + MA-ANT-27 gain 12 dBi @ 5 GHz ETSI EIRP 5 GHz (ch 100 = 30 dBm) Situation 1: 5 GHz channel 100@40 (HE40) (= free channels needed 100,104) Tx Power: 18 dBm Antenna gain: 12 dBi EIRP = 30 dBm Minimum needed power at antenna receiver: -86 dBm Free space path loss allowance (including antena gains): 116 dB Free space path loss allowance (excluding antena gains): 92 dB Distance = 2.7 km Situation 2: 5 GHz channel 100@80 (HE80) (= free channels needed 100,104,108,112) Tx Power: 18 dBm Antenna gain: 12 dBi EIRP = 30 dBm Minimum needed power at antenna receiver: -89 dBm Free space path loss allowance (including antena gains): 119 dBm Free space path loss allowance (excluding antena gains): 95 dB Distance = 3.8 km   I based the minimum needed RSSI values on the MR76 datasheet receive sensitivity values. If you need a calculation with 1x1 which is more common outdoor if you cannot have any reflections I can do that one too but I'm out of time now 😉 ... View more

I love it, those big honkin' panels 😉 ... View more

Simple: You factory default the AP by using a PIN in the small hole (hold for at least 12 seconds) and your AP will boot in normal mode connecting to the dashboard en retrieving it's configuration.  It won't be in survey mode anymore.   Your local credentials will revert to SERIALNUMBER as login en blank password or the configured admin/password if you set one in dashboard. ... View more

Well for one: ports in 1 Gbps are higher are always full duplex. And secondly the only SFP port types on Cisco switches where you can/have to set speeds is on Nexus switches that run multiple speeds.   There simply is no negotiation between SFP's on both sides.  It just sends the traffic over the TX fiberoptic and receives on the RX fiberoptic.   I would start suspecting there is simply a wrong type of SFP in use in one or both of the switches or the fibercable is not up to spec for the distance/speed.   Both SFP modules at both ends must be of the same standard.  A 10GBASE-SR will not successfully decode data coming from a 10GBASE-BX40 SFP+.  First you need to be sure your fiber is okay and the correct modules are used at both ends. ... View more

What is all this fuss about? If you have an SFP+ port and you insert an SFP+ fiber module it runs at 10 Gbps period.  If you insert an 1 Gbps SFP it will run at 1 Gbps.  Unless you are using some weird dual speed SFP+ modules you shouldn't have any issue.   I guess the only issue you could have is with copper SFP's but since Meraki itself only sells 1Gbps variants one would assume 10 Gbps over copper SFP is not officially supported. ... View more

I guess you can. The restrictions that you have with a 210/225 family switch are: - Maximum 16 SVI's - Only static routing - No DHCP server - No multicast routing   So if your hosts don't need NAT and you can keep below said SVI's then you should be fine. ... View more

SFP+ ports usually are backwards compatible with SFP modules. I haven't seen any instance where it was not supported yet. ... View more

Greetings from West-Vloanderen and welcome to the forums. 😉 ... View more

In what regulatory area are you? FCC, ETSI? If you want to do a sort of point to point connection you'll need to know how much you can transmit. Because AP to AP can be higher powered than AP client.  But it depends how much you can transmit in your area. ... View more

I'm not sure what you mean with your setup. What is important that you can only use NAT forwarding if the NAT IP's your ISP gives you are in the same subnet as the WAN interface of your MX.  Then you can use port forwarding or 1 to 1 or 1 to many NAT. However if your provider tries to route some separate set of IP's towards your MX that are not in that subnet, that won't work.  Then you need the router in front of your Meraki also doing NAT towards the same subnet.   If you didn't get my explanation let me give some examples.   If the subnet between your provider modem/router is 11.12.13.0/29 and that router IP is 11.12.13.1 and your MX is 11.12.13.2 you can still use 11.12.13.3-6 to NAT towards devices behind your MX.  However if that provider tries to route 11.20.30.0/28 towards your MX at 11.12.13.2 that won't work. ... View more