About KarstenI

KarstenI

==> PM

KarstenI

Today, I faced a problem with my SSID that uses Meraki Cloud Authentication. I am still investigating this, but the bug is with Meraki Health. Although the connection Log is full of "Client made an 802.1X authentication request to the RADIUS server, but it did not respond", the Wireless Health shows 100% success, and no client was affected on this SSID. This really should be investigated to correct the Wireless health output.

KarstenI

(shouting) Meredith, Meredith, Meredith ...

KarstenI

It was certainly not meant this way. But there was no "contract" with Cisco/Meraki, so it should be legal. It's just that a vendor will think about actions like these when the devices show up on eBay in larger quantities.

KarstenI

Darren, that was my vote. And of course this other guy, you know, was active before, took a break, came back …

KarstenI

Welcome to the wonderful world of Meraki Magic. For the CEs, I think that CMNA is not giving you any credits. But both passing the CMSS (Cisco Meraki Solutions Specialist) and taking the ECMS classes that help you prepare for the exam will give you credits.

KarstenI

@PhilipDAth you would be lonely for quite some time ...

KarstenI

I understand this problem ... 😉

KarstenI

If you use the uplink ports, it is only a switch-to-switch connection but not stacking. But the stack cables are also available in three meters: MA-CBL-40G-3M

KarstenI

All the best, and "see" you again in summer. Enjoy a peaceful time with silent nights, undisrupted sleep and shiny diapers ... 😎

KarstenI

Where does this /16 come from? If you have one VPN gateway you need one IP address.

KarstenI

it's well described in the documentation: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX

KarstenI

Then you probably have to configure a 1:1 NAT with a free IP and forward all traffic.

KarstenI

Yes, it's still the same situation. I assume everything regarding extranet VPNs has no priority at Meraki, which is sad as I don't know a single customer who doesn't need this functionality.

KarstenI

Is your VPN gateway behind a NAT or PAT gateway? Then you don't need IP/50. And with PAT it typically can't be forwarded as there are no ports to translate.

KarstenI

And this is a good decision. People using 160MHz should be CENSORED (sorry, that would be NSFW).

KarstenI

With "access-switch," do you mean that there are *no* VLAN interfaces configured on the switch? If you have, the report will count all of the connected clients as coming from this switch.

KarstenI

Isolated ports are isolated against each other, but not against the non-isolated ports. If it would, you couldn't reach your upstream gateway. You need to implement other security measures like different VLANs terminated and filtered on the firewall or switch ACLs.

KarstenI

Thanks for the clarification. I looked it up in the datasheet to see if it is already implemented and it says "will be enabled via firmware update at a later date". Great to hear it is already available. Time to adjust the documentation ...

KarstenI

Yes, important fact. With the CW9164, some bucks can be saved in environments where 2.4 doesn't play any role. Same as previously with the MR44 vs. MR46.

KarstenI

The only advantage of the MR57 over the CW9166 is IMO the possible port redundancy. But as there is no PoE redundancy yet, even that is limited. I also only go for the CW models for 6GHz now.

KarstenI

It likely is allowed as the 6 GHz radio is default disabled and will be enabled only based on regulatory availability. For ETSI, I would likely still choose the MR86, although the CW 9163E is fascinating. But in the EU, the device will likely go through the next refresh cycle before the EU approves it ...

KarstenI

To add to the answer from @CptnCrnch : - The traffic from the user to the MX is protected with TLS, including the authentication. - The MX forwards the user credentials with RADIUS to the RADIUS server, which is the cleartext password encrypted with a weak encryption algorithm.

KarstenI

There is no advantage of max power. But you need consistent power in a survey which means it has to be fixed and there should not be any RRM changing it while the survey is done.

KarstenI

I think there is more to this problem ... Or less ... Surveying without activating the survey mode always has the potential of automatic changes to the power settings. If not using the survey mode, the RF profile should at least lock down the power, but then you can also enable survey mode with the same amount of "work". For the antenna, I would assume that the AP still recognizes the Meraki Antennas. But for that, I didn't find any documentation. If the dashboard identifies the antenna, the survey will remain consistent as the power gets fixed on the local status page. The only problem could be that you go above the regulation when attaching an antenna with a high gain. But again, I could think that the AP could limit the TX power if the AP does not recognize the antenna. But again, I did not see any documentation stating this.

KarstenI

Karsten Iwen

Community Record

Badges