Meraki

KarstenI

The MT30 really needs much more flexibility.

KarstenI

Ah, alright. Yes, I am also waiting for that. But that is not "WPA3 Enterprise". It's still "Personal" although it uses RADIUS.

KarstenI

For IoT I also don’t always enable Band Steering. 2.4 is for IoT. And if I see a device in 5, I smile! My Dyson Vacuum robot is a device that is in 5GHz.

KarstenI

But the mentioned behavior is already quite old.

KarstenI

For me it is the same as for the last around ten years: Incoming filter for extranet VPNs on the MX. But I don’t understand the wish for WPA3 Enterprise. I am running that for a very long time with Meraki.

KarstenI

Infact BPDU frames are dropped and do not traverse MX appliance in "Routed Mode." There is an important "it depends". On the MX, you need to have the native VLAN enabled on the ports that connect to MS switches, as BPDUs are transferred only untagged. Then the BPDUs are passed which is needed to build the Meraki-suggested redundant setup. https://cyber-fi.net/index.php/2022/03/13/how-to-connect-the-meraki-mx-to-ms-switches/

KarstenI

At least on my Office SSIDs, I never enable Band Steering. I don't enable 2.4.

KarstenI

I can confess that I 100% fulfilled my 2024 resolution. My goal was to survive. This year I'll go with the same resolution!

KarstenI

You have no Firewall in this setup? This would be more a home office setup where security is handled by the ISP router. I would add a firewall like an MX and terminate the Guest VLAN directly on that firewall.

KarstenI

I just checked my 9300, and yes, no move is available. I hope this gets implemented before I have to move my first monitored Catalyst ... 😉

KarstenI

You are testing from a device with a very small CPU that is not built to generate and receive large amounts of traffic. IMO, this test is entirely meaningless on internal devices.

KarstenI

In addition to what was already mentioned: I would look for CWNA training. It's available not only as classroom training but also online or in UDEMY classes. For your real problem: The MR36 is 99,99% the wrong model for this task. For 1000 seats, better let this design someone who has experience with that.

KarstenI

I am not 100% sure this is the cause, and it likely needs some investigation ... The wireless standard has no feature for individual group keys per VLAN, but only per SSID. With that, each client will see the BC/MC traffic from any other client on the same SSID regardless of the VLAN. In the general network-wide settings, you can enable the multicast to unicast conversion. Although it should be enabled by default, look if it is disabled in your setup and try enabling it.

KarstenI

They are already listed as "compatible Switches" in the Subscription page of the dashboard.

KarstenI

There are countless times I think, "If they just came here to ask before they started to implement it" ...

KarstenI

It's a different system that operates differently. You need some tunnel, and this is how it is implemented in the Meraki world. Regardless of whether it is liked or not ... 😉 The MX concentrator is the component that takes the role of the CAPWAP tunnel endpoint for data.

KarstenI

You can tunnel the traffic to an MX VPN concentrator at the main office as described in this document: https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Tunneling_and_Layer_3_Roaming_-_VPN_Concentration_Configuration_Guide#SSID_Tunneling_to_an_MX_VPN_Concentrator

KarstenI

I wrote a blog post some time ago summarizing the different options. Perhaps it helps: https://cyber-fi.net/index.php/2024/02/19/connecting-your-meraki-mx-to-the-internet/

KarstenI

British Telecom tried this 15 years ago with their "Phorm"-Project. And the bad press (*) was quite heavy. I would think twice before doing this, and if so, I would also put some money aside for the lawyers that you likely will need. * The community software didn't allow me to use a word that combines the result of the digestive system and very heavy weather.

KarstenI

Great, this seems to be what I am looking for!

KarstenI

Nothing can beat WiFi Explorer Pro from Intuitibits (IMO).

KarstenI

Hi all, I want to get all active (primary) MX devices from all networks. What would be the best endpoint for this? Happy Christmas, Karsten

KarstenI

Wat about iterating through all appliances of the org with a short delay between each query?

KarstenI

I am missing a detailed diagram to really understand the topology.

KarstenI

This Log is always UTC, as it combines Logs from all possible time zones.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges