And if the answer of @PhilipDAth was too technical, the easy answer is "No, nothing has changed. Still nothing that compares to VTIs on a Cisco router".
... View more
You need to build a new organisation, and add a new network in the new org. Then the devices and the licenses have to be moved to the new org/network: https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Moving_Devices_between_Organizations https://documentation.meraki.com/General_Administration/Licensing/How_to_Request_a_License_Transfer
... View more
In the tech game, we bring the heat, Meraki Fullstack, can't be beat. Smooth as silk, no need to fret, Networks locked down, no room for threat. Meraki got your back, from street to suite. (If I win, please draw another time. I already have this nice little speaker.)
... View more
You need a downtime anyhow. I would remove both devices out of the network and just add the new ones. After that you have to reconfigure the VLAN-to-port-mapping and reenable the AutoVPN. The rest of the config is fetched from the dashboard.
... View more
Have you double checked to include the correct intermediate? When you open both the device cert and the intermediate, does the Issuer key-ID of the device certificate match the key-ID of the intermediate certificate?
... View more
Puede hacer esto en la pagina de estado local. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#MX_Series_with_Single_Dedicated_WAN_Link
... View more
based on RFC 5246 the only valid option is: device intermediate-that signed-the device-cert (intermediate-that signed-the-cert-above) (intermediate-that signed-the-cert-above) (root)
... View more
As fas as I know there is no way to influence the lifetime. For the chain, what did you upload? In most cases it only has to be the identity and the intermediate cert.
... View more
Keep posting with your progress and also how you would automate it with the API! For your home PKI I can suggest https://smallstep.com/ if you have up to 20 devices.
... View more
I would bet on a bug in the calculation of the keys on the AP. Disabling .11r changes the calculation on both AP and client, but the difference in firmware versions should only change the AP behavior.
... View more
Another strange thing is the TLS exchange before the 4 way handshake. This means it is not happening when doing a fast roam but instead on the initial connection?
... View more
The missing frames 3 and 4 are the logical consequence of the MIC failure. If the MIC can’t be verified after frame 2 the AP has to abandon the session. But this doesn’t explain why this is happening …
... View more
On Meraki you can use the iPSK with RADIUS for this: https://cyber-fi.net/index.php/2021/01/13/meraki-wlan-mac-based-access-control-with-psk/
... View more
My best practice is to avoid it where possible. But you won’t have any backward compatibility issues. But it can be the other way round because clients just do dumb things. Some devices will connect to the more “feature-rich” ax AP although having a better signal from the ac AP. Just make sure that you don’t mix in any MR32 as these devices limit the network from running recent firmware versions.
... View more
This should be completely independent of 6E or 7. And it seems that at least in US it's quite near. For EU/Germany we probably have to wait much longer.
... View more
Regarding networking basics ... /31 is allowed for over 20 years on P2P links. But I am not sure the MX supports it. At least the ASA can handle it.
... View more
It is very likely that *every* major vendor has WiFi-7 stuff in the pipe and will be proud to show them in the second half of 2023. Which feature are you looking at that is not found in the actual WiFi-6E line? For me it would be multi-band connections but this would not stop me from buying 6E devices if I need them in the coming months.
... View more
As Brash mentioned, the Umbrella SIG is likely the best option if you want to scan only internet-traffic. If you also want to inspect traffic flowing from VLAN to VLAN or between different auto-VPN sites, Umbrella would not help. But the mentioned inline device between the MX and the internal switch would do the Job. For Cisco, this could be a Firepower appliance with the appropriate licensing.
... View more
