Meraki

GIdenJoe · ‎Oct 17 2020

If you mean the ports and services the clients on the network are using then you can use the Traffic analytics page. To get the information however your network needs to be configured to use traffic analytics and to report specific hostnames.

GIdenJoe · ‎Oct 15 2020

If seamless roaming is important you should not use AP load balancing. Your client may be trying to join the next AP but being kicked off due to "high" load on the AP. I know 802.11v helps here but your client needs to support it. To be 100% sure it is the roaming itself that is being slow you should measure from the first authentication frame up to the last frame in the 4way handshake or less if you're using 802.11r.

cmr · ‎Oct 13 2020

@GFrazier those are the minimum requirements, as you haven't been able to buy 4-pair cat5 cable for years and I've never seen 2-pair cat5 cable in 25 years of networking! I can also confirm that cat6 FTP works fine for a 10Mb half duplex connection on a 2960 😇

TheSimplifier · ‎Oct 13 2020

Thanks for the tunnel bouncing procedure @Nash. I don't like it either, but it's just something we put into our P&Ps for now unless/until they add a feature to bounce individual tunnels.

Bruce · ‎Oct 12 2020

@GIdenJoe I believe you are referring to the Group Policy ACL feature. From my understanding its still in closed beta, although it was announced 6+ months ago. As you state it uses the filter-ID RADIUS attribute to specify a Group Policy for an 802.1x session, and applies the firewall rules in that policy as a stateless ACL. I'm not sure that it applies anything else from the policy, although haven't tried it and so can't be sure. With regard to switches, its slated to only be available on the current MS210+ models, so not the MS120 or MS125.

SobyKuruvilla · ‎Oct 12 2020

Thanks.. But I am looking if it is possible to upload the .esx files from Ekahau software to Meraki dashboard.

roesljas · ‎Oct 12 2020

Hi @GIdenJoe Thanks for your reply, this is exactly the type of info I was after. It makes sense to me and I think the 16 VLAN limitation won't be an issue. - I create the MS management VLAN that goes L2 through the core stack so the gateway is the MX. This way you can have the core switches and the access switches is one management VLAN. Understood - Then I create the /30 transit VLAN between MX and core stack. This is done both on the MX addressing and vlans page and the switch routing and dhcp page. Understood - Then I create the static routes on the MX pointing to the core stack IP each individually because you need those individual subnets to create a DHCP scope for in the MX. This is the piece of info I was missing, I see that for every static route you add (just like any VLAN you add) on the MX, you then have an appropriate DHCP scope added and configurable in the DHCP page. - Then I create the dhcp scopes on the MX DHCP page. Understood - Then I create the individual VLAN interfaces with DHCP relay pointing to the MX /30 subnet IP address. Understood Thanks very much. Jason

ConnorL · ‎Oct 7 2020

Awesome article @PaulF! It looks like this will be coming to the public release of macOS Big Sur. At least from what I could tell during the WWDC 20 videos. My iMac running build 20A5364e doesn't have this option yet, however.

PatrickBB · ‎Oct 7 2020

The thing to remember about a FEX is that it works just like a module in a chassis switch. When connecting a FEX, the configuration is done on the parent switch. In your case, you have a FEX connected to 2x 9ks so both 9ks are acting as the parent. Both 9ks have to have the same identical configuration for the FEX. The below link discusses configuration sync and Active/Active FEX topologies. It is specifically for the N5k, but the theory and design should be similar for N9k. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/operations/n5k_config_sync_ops.html Config-sync is how you can synchronize the FEX configuration between the 2 9ks as long as they are running as a vPC pair.

cmr · ‎Oct 5 2020

@M4TT we have our DC MXs set up as @GIdenJoe said. They have been completely trouble free for a year or so with 8 remote sites over dual connected SD-WAN and an increasing number of homeworkers with either small MXs or Z3s using the supernet method described. We use Sophos XGs as the main internet facing firewalls and their NAT plays nicely, I believe Palo Alto does not, not sure about other vendors.

GIdenJoe · ‎Oct 5 2020

Once again, the Brocade switches are not sitting between anything. They are only connected to allow the old VLANs to bleed over. However the other customer who ONLY has Meraki has the exact same problem.

PhilipDAth · ‎Sep 27 2020

I do a lot of deployments and I do have good ties to Cisco Meraki. However, most of my knowledge has come from doing deployments.

GIdenJoe · ‎Sep 26 2020

Hey, your question is on the wrong forum. Wireless WAN only covers the MG gateway product. You should go to the correct Meraki Go forum for this. In enterprise Meraki there is not support for SIP ALG, so we could assume this will also be the case on Meraki Go.

PhilipDAth · ‎Sep 24 2020

I use 12Mb/s 99% of the time for maximum compatibility. The rest of the time I use 54Mb/s to make for the smallest coverage footprint in which a user can connect.

cmr · ‎Sep 15 2020

@GIdenJoe Main DC of an SD-WAN solution over MPLS/VPLS, it allows more than 2 WANs at the core. 👍

GIdenJoe · ‎Sep 14 2020

Well a capture is catching all packets and you'd normally see the Sonos communicating with some external server. If the info is encrypted you won't see that it is in fact communicating it's local IP. You could also capture on the default gateway of the sonos for messages going to 224.0.0.251 on udp 5353 to capture the mDNS entries. But that will only prove the Sonos is using mDNS outside of the logging in to the sonos account. If a capture is too much you can of course create a firewall rule to match all traffic coming from the sonos and log the traffic to a syslog server. Followed by another rule that matches traffic from your devices IP towards the sonos.

GIdenJoe · ‎Sep 10 2020

I have also noticed some possible discrepancies in the allowed EIRP on Meraki W6 AP's vs the actual regulatory allowed EIRP. In Europe you have following rules. All 2.4 GHz channels - max 20 dBm EIRP. So the MR 33 should be max 16 dBm Tx Power and the MR36 should be max 14 dBm. In case of 5 GHz it depends on the channel. 36 - 48 and 52 - 64 = max 23 dBm EIRP In this case you should have max 19 dBm Tx power on MR33 and max 17 dBm on MR36. 100 - 140 = max 30 dBm EIRP In this case you should have max 26 dBm on MR33 and max 24 dBm on MR36 However the MR33 also has a total max Tx power of 17 to 21 dBm depending on the channel used. And the MR36 is even a bit lower I've found the datasheet in the library section of the site (it's not linked on the product page itself 😕 ) the max power is 18 dBm in 2.4 GHz and 17 on 5 GHw

mcvosi · ‎Sep 7 2020

I'm in a similar predicament. I currently have a stacked pair of 250's, but was curious if a warm spare was better or not. Since it's a small office I would think from a management point of view a stack would be better.

FariziAP · ‎Sep 3 2020

Greetings All, Thank you for all of your advices, After calling the Cisco Meraki TAC, This problem is solved by upgrading the MR firmware to MR 27.4, after that the MR46 successfully got IP from DHCP and broadcasting my office SSID. Cheers! Hope its helps.

Ristridin · ‎Sep 3 2020

status quo: since giving the amazon fire tv stick a static dhcp lease, it works so far...I will report back soon.

PhilipDAth · ‎Sep 1 2020

Can you describe the solution more. Are all the switches going in the same rack, or are they in separate buildings, etc.

GIdenJoe · ‎Sep 1 2020

I did all of that. Yesterday afternoon it seemed to be working again 🙂

EdwardDybas · ‎Aug 31 2020

Our Meraki Cloud's VPN authentication is down again. Please fix this ASAP!

GIdenJoe · ‎Aug 29 2020

I'm pretty sure you can change the cipher options in windows. I'd have to google it though 🙂 Edit: There was a graphical tool to use for all your VPN's however you can add a single VPN with powershell to use a specific ciphersuite. Add-VpnConnection -Name "MyVPN" -ServerAddress <VPN_WAN_IP> -TunnelType "L2tp" Set-VpnConnectionIPsecConfiguration -ConnectionName "MyVPN" -AuthenticationTransformConstants SHA196 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup ECP256 -DHGroup Group14 This still needs the psk switch but you get the point.

GIdenJoe · ‎Aug 28 2020

AFAIK the MR74 does not have auto detection of the antennas. So if you already have configured MA-ANT-20 on BOTH BANDS!! then you should not even have received the warning. The default on outdoor AP's is MA-ANT-27 which has the highest gain causing the AP not to go past a certain TXpower.

About GIdenJoe

GIdenJoe

Joey Debra

Community Record

Badges