Meraki Community

Marc_Abaya

Actually clicking the VLAN entry then Next will give that option. My bad.

Marc_Abaya

I'm creating a template as discussed here: https://documentation.meraki.com/General_Administration/Templates_and_Config_Sync/Managing_Multiple_Networks_with_Configuration_Templates#MX_-_Template_VLAN_IP_Address_Range_Allocations But when I look at my MX options under Security & SDWAN -> Addressing and VLANs, I don't see a way to set "Enable" or "Disable" on the VLAN (below). I wish to set the VLAN IP range allocations for this template but I don't see that option. What am I missing?

Marc_Abaya

Do you mean the inside subnets? We do have several behind the VPN firewalls. Also if this will make sense, I tried using the MX's WAN1 and the VPN works. But if you fail-over to WAN2, it will not anymore. Is this the IKEv2 limitation mentioned on that article?

Marc_Abaya

Nope, no traffic from Firepower since Phase2 can't establish.

Marc_Abaya

Thanks, I think I've seen this earlier. It's using IKEv1 which we can't do. Anyone able to use IKEv2 with Firepower? I'm guessing that's our problem, we can't make IKEv2 work.

Marc_Abaya

Curiously no errors, it's saying peer connection is established. We just can't pass traffic.

Marc_Abaya

We have already verified that we are matching Phase1/2 settings, but we can't get the VPN to work. Here's the error message- from Wireshark, it looks like it's stuck in CREATE_CHILD_SA. We're using IKEv2 and I think that's the culprit, but we can't use V1 since we're not allowed.

Marc_Abaya · ‎Sep 8 2023

Thanks, I was also reading that Reddit post. I just want to hear what real Meraki users prefer.

Marc_Abaya · ‎Sep 8 2023

If you have a choice between the two, which one will you choose? We got our budget approved for Cisco ISE but at the same time, it looks like we can do the same with ClearPass for a lower cost (and we can use the extra money for other stuff). Is the ISE cost worth it?

Marc_Abaya · ‎May 31 2023

It's just for WIFI. We're looking for RADIUS options right now and curious what most people in the industry are using. We're good with our VPN since we're SAML using OKTA.

Marc_Abaya · ‎May 30 2023

We're going to retire our Windows NPS after 10+ years in service. It's very reliable, but we're missing some key features like MFA. We're a mix of Azure AD and Google Workspace. What are the common solutions out there that's popular and mostly used? We're currently looking at JumpCloud and SecureW2.

Marc_Abaya · ‎Sep 14 2021

@BlakeRichardson With NPS, our users are spoiled with Machine/PKI authentication that they don't need to enter username and pwd anymore to join the WIFI. Can JumpCloud support that?

Marc_Abaya · ‎Sep 14 2021

Thanks for the reply. I'm reading JumpCloud but it doesn't look like it supports PKI/Certificate-based auth, which is what we are looking for? The pricing on the website looks reasonable though.

Marc_Abaya · ‎Sep 14 2021

Dave- Any ideas on how the pricing looks like for JumpCloud?

Marc_Abaya · ‎Sep 13 2021

Just curious which Radius service can you recommend? We're on the process of retiring our Windows NPS and looking for a cloud-based replacement. There are so many choices out there but hopefully I can limit them based from the feedback of Meraki users.

Marc_Abaya · ‎Aug 3 2020

@cmr Yes, I did change the SSID availability over the weekend. Let's see if this improves the roaming.

Marc_Abaya · ‎Aug 3 2020

Thanks for the note. I saw that post and it's similar to our problem last year with Realtek and it goes away for some reason. I am not sure what really fixed it, but we did a bunch of stuff: upgrade Windows, drivers and BIOS. Our problem right now is only while roaming, but who knows maybe they are related. I'm just trying to find a way to prove this to HP so we can get back at them.

Marc_Abaya · ‎Jul 31 2020

I'm also thinking of powering down some of the APs so they won't roam that much. How close is too close for the distance between APs?

Marc_Abaya · ‎Jul 31 2020

A summary of my network: - About 30 Windows 10 users, HP Probook with Realtek WIFI adapters running the latest driver - 802.1x using NPS Radius Windows 2016 Server, Fast Reconnect enabled - 7 MR33, running the latest 26.6.1 FW - 802.11r Enabled, only 5-GHz, Bridge-mode, Width is 20MHz only - Auto Power Reduction, Channel set to Manual (no channel overlaps) My first problem is this site is about 6-hour by plane so it's a bit hard to justify to fly there. I do most of my troubleshooting on the Meraki dashboard. I will get frequent complains about wireless users losing connection when roaming. Event Logs is not showing any errors that will give me a clue on what's wrong (unless I'm not looking at it correctly). I can also confirm that the WiFi signal between APs are overlapping, specially since these APs are more or less 20 feet apart. In high-density areas, the APs are even closer. Air Marshall also looks clean. I asked someone to walk-around the office and from my pings, I can see that for 30-60 secs, they will lose their connection. There are also cases that the Relatek will quit and disable itself (the WIFI icon will disappear on the taskbar). What's interesting is we tried using a WiFi USB dongle (and disable the built-in Realtek) and this was reduced significantly. Now my questions are: 1. Is this a Realtek problem? I would like to go HP Support and report this but I'm not sure how to prove it. 2. Do you see the benefit of enabling 802.11r? How will I know if 802.11r is actually causing those Windows devices from not connecting? 3. What's the best way to troubleshoot roaming problems? Thanks for the help.

Marc_Abaya · ‎Jul 24 2020

Aaron, great post. I'm having similar problems, but my Wireless Profile was pushed by Group Policy. When you enter netsh wlan show profile, it will show under "Group Policy profiles (read-only)" and not "All User profile". Now I'm curious how you can move them to "All User profile". Our workaround is the same as yours, we provide them USB WIFI adapter which fixes the problem.

Marc_Abaya · ‎May 6 2019

I set-up a hidden SSID using WPA2. My plan is to use it for select devices only and increase security by using MAC address whitelisting on the Meraki Radius. I use "Add Client" to add the MAC add on the dashboard. It works but my problem is if the device has been away for a while, it can no longer connect to the hidden SSID by itself. I would need to choose "Other Neworks" and type the SSID and the password in there. Is this a normal behavior for hidden SSID? Also I need to add the client once more using "Add Client" on the Dashboard since I can no longer see that device in there. How long will they stay there?

Meraki Community

About Marc_Abaya

Marc_Abaya

Community Record

Badges

Re: Missing VLAN menu in the Configuration Template?

Missing VLAN menu in the Configuration Template?

Re: Cannot establish VPN to non-Meraki peer (Firepower)

Re: Cannot establish VPN to non-Meraki peer (Firepower)

Re: Cannot establish VPN to non-Meraki peer (Firepower)

Re: Cannot establish VPN to non-Meraki peer (Firepower)

Cannot establish VPN to non-Meraki peer (Firepower)

Re: ClearPass vs. Cisco ISE: What will you choose?

ClearPass vs. Cisco ISE: What will you choose?

Re: Good replacement for NPS Radius for WIFI?

Good replacement for NPS Radius for WIFI?

Re: Cloud-based Radius recommendation?

Re: Cloud-based Radius recommendation?

Re: Cloud-based Radius recommendation?

Cloud-based Radius recommendation?

Re: Roaming issues with Realtek adapter?

Re: Roaming issues with Realtek adapter?

Re: Roaming issues with Realtek adapter?

Roaming issues with Realtek adapter?

Re: Wi-Fi constantly dropping in only one portion of a single physical netw...

iPhones/iPad can't locate Hidden SSID?

Re: Missing VLAN menu in the Configuration Template?

Re: Missing VLAN menu in the Configuration Template?