About BrandonS

BrandonS

> It took 4 years to get them on to wi fi now install cameras instead. Well there's that client gone. MV just reasonable not the answer only in certain use cases. I get it, but try to find the upside. No one expects you can control decisions like this made by the likes of Apple and Google, etc. Technology is always changing and always will. It is an opportunity to get more accurate data and for you to make more sales and learn new technology. And all that while helping protect the privacy of individuals. If your customer would rather have nothing after a move like this from Google and Apple then all you can do is show them the available options. Best.

BrandonS

Thanks for sharing. Don't shoot the messenger, but- doesn't the MV32 have integrated wireless? You should not need anything more than a POE injector to power it up and then use it's built in wireless. It needs to be configured once while wired, but then you can move it. https://documentation.meraki.com/MV/Physical_Installation/MV32_Installation_Guide

BrandonS

Nothing is really technically different with the switch. The difference is the business models between Cisco Meraki and TP-Link. Meraki is "all or nothing". You either pay for the operation, software patches/updates, security, 24x7 support and hardware replacement warranty or you get nothing. If you didn't know or understand this when you purchased Meraki I can understand your frustration, but that is how it is. It is becoming a trend and others are moving this way too. The justification/explanation is usually along the lines of keeping enough recurring revenue for the business to operate successfully and continue to provide security patches, support and hardware replacement while giving the end customer a quality product, piece of mind and ongoing support. The converse would be TP-Link (or similar) that may have outdated software with known exploits that may never be patched and support that may not be available or responsive and no hardware replacement if it breaks. And maybe TP-Link can't sustain a business model with low margins and no recurring revenue so they go out of business or get sold to another company. I think there will always be a place for both business models, but more movement towards recurring revenue is definitely a current trend in industry.

BrandonS

@gingerbrown yes it will stop passing traffic. Think of it like a phone or a light bulb that will not work if you don’t pay for the service.

BrandonS

I don't think so. Last I checked it assigns the addresses from the client VPN subnet dynamically and you can only set DNS and WINS.

BrandonS

No, that wouldn't make sense to overlap or be the same. It needs to be unique. What do you mean waste a subnet? There are over 16 million RFC1918 addresses you can slice up and subnet however you like.

BrandonS

That's about right. I would just swap your 3b and 3c steps since you will need the IP information configured before it can connect to the cloud and continue.

BrandonS

I don't think any else said it explicitly, but the documentation should explain that you don't need to reconfigure everything. When you remove and then add in the MX100 it will boot up, update firmware and pull configuration from the cloud. Go over the documentation though because there are a couple caveats about how ports match up between different models and also if you need a static address or PPOE on your WAN interface that needs to be set manually and may require a reboot of any upstream gear like a modem or another router the ISP provides. Remember to be patient too. It can take 20 minutes or longer to come online the first time while updating firmware and rebooting sometimes more than once. Good luck.

BrandonS

Look what I found. I am going to try this on some of my printers: https://github.com/nmap/nmap/issues/2237 Describe the bug Aggressive option '-A' on printers produce unwanted print : binary blob with 'random1random2...'. The printed payload 'random1random2...' is located here : "/usr/share/nmap/nselib/shortport.lua" line 261 To Reproduce Run the following command on a printer device : nmap -A X.X.X.34 -vvvvvvvvv -p 9100 --script-trace

BrandonS

Interesting. I would not expect an NMAP scan to cause a printer to print anything, but I suppose it is possible. Do you have any port forwarding on your firewall to the printer or anywhere else that could even allow outside access into your network? If not, I suppose it is possible someone inside the network was playing around and caused this unintentionally (or intentionally). Also- this is not really the right forum for Meraki Go. This is "regular" Meraki here. Meraki Go has it's own community: https://community.meraki.com/t5/Meraki-Go-Community/ct-p/go Best

BrandonS

I'd give that a very low, almost zero probability of any kind of attack. I would dig into the printer settings and web GUI to see what you can find about that print job and look through logs, etc. How certain are you that it isn't just a corrupt print job from one of your users?

BrandonS

Well, this is weird. I just checked the one MS120-24P that had noticed a couple ports like this for a week or so now and as far as I know no one touched it and now the ports are green and the red warnings are gone, but I still see CRC errors in the last day.. in the packet counters. I suspect Meraki is aware and trying some tactics behind the scenes to fix this since it seems quite widespread.

BrandonS

Were you able to add the MR42 to your inventory and network? I had a couple rare occurrences a couple years ago where some batches of device serial numbers were not properly populated by Meraki's back end that prevented me from bringing some new gear online. It sounds similar to what you are describing, but maybe not the same.

BrandonS

@SNSGS I don't think I can estimate and I suppose it will depend on each environment and which messages you choose to send, but I do have dozens of devices sending what seems to be a lot of messages for only $10/mo. You can also filter out messages on the receiving end that will not count toward your quota. Best.

BrandonS

MS120-24P running 12.28 for me. Mine is a new install and has Meraki MX, MV and MR that all connected up fine and nothing but green. Our team ran the cable and tested it clean. Then some A/V and satellite TV teams showed up and that is when I started seeing this. I figured it was their gear or their poor terminations somehow. Now I am less sure about that.

BrandonS

I'm looking at a similar situation right now. Have yours cleared yet? I wouldn't worry about it much as long as they pass cable tests and are green for a while after repairing them, but I think someone has sorted the cable issues on mine and I still see an amber icon (not shown in my screenshot) and some red warnings:

BrandonS

Meraki Go has it's own community and support group separate from "regular" Meraki here. https://community.meraki.com/t5/Meraki-Go-Community/ct-p/go That said, there is a post claiming it should "just work" and not even require plugging in wired first: https://community.meraki.com/t5/Questions-and-Answers/Wireless-Mesh/m-p/27204/highlight/true#M40 Maybe try closing the app and launching it again?

BrandonS

I appreciate the updates. This sounds like a painful troubleshooting gauntlet, but your methodology seems sound and you are breaking the problem down into pieces so should at least end up with a general idea where the trouble was/is.

BrandonS

I think one antenna is fine for point to point. You should find a terminating cap or put cheap omni antenna for the unused ports though. It can damage the radio and probably cause other issues if they are not terminated. also, beware you can only bridge a single VLAN and not do a true bridge with Meraki at this time.

BrandonS

I have done that for small test/lab environments from time to time such as when staging some devices before shipping out to a customer. I would either create a VLAN on my production network for the purpose or in some cases just plug the devices in wherever they can get DHCP and internet to come online and get firmware updates, etc. I can't think of any particular downside to using a VLAN from your production network for this purpose except some extra configuration if you need to support or test incoming services that would require port forwards, etc. from your production network over to your test network VLAN.

BrandonS

Your description makes me think of a duplex mismatch. It could explain the 100mbps limit. If you can't control that on the ISP side maybe try a dumb gig switch as a test between your WAN port and the ISP handoff. If you can control it or have someone at the ISP check on their side you may be able to verify that port's negotiated status too.

BrandonS

Interesting challenge. Not sure why you are posting in the Meraki Community, but my suggestion is to carefully think through and document your troubleshooting methodology to rule out or (rule in) various components (including subjective end user). It seems you have covered most things, but: - Have you observed the problem yourself? - Is it reproducible? i.e. how often does it happen giving you a chance to "catch" the problem. - Have you enabled call recording or pulled packet captures that may let you listen to the audio stream for further analysis or confirmation of the trouble? - Have you considered the trouble may be with the other party this user is communicating with? Good luck.

BrandonS

Have you set any firewall rules, IDS/IPS, content filtering or port forwarding? Have you done a packet capture to see what is happening? Have you tried a phone bypassing Meraki or on another network to be sure Meraki is the culprit?

BrandonS

@Inderdeep That is for MX100. The Cisco partner portal has an area for global export compliance here: https://www.cisco.com/c/en/us/about/legal/global-export-trade.html The link for China compliance certification on that page is just an email: mailto:complianceinfo@cisco.com You may try emailing them to request a copy of the CCC certificate.

BrandonS

I don't think there is any detailed documentation about it. It may be considered proprietary/secret to some degree. I have noticed odd descriptions there too, but one explanation can be things like VMWare or a Mac user running Parallels or VMWare Fusion so the same machine can actually connect to the network as two different hosts either at different times or even at the same time. There is little flag you can use to submit suggested corrections next to the names.

BrandonS

Community Record

Badges