About Uberseehandel

Uberseehandel

@federicogalarza wrote: I would like to know what are the best practices which you usually implement in the Meraki world. Thanks! Federico The general rules I adhere to are: Tag all VLANs Set up a Management VLAN Set up an Isolated Guest VLAN (and SSID) Do not use the native LAN Create a faux VLAN for those cases where the configuration GUI requires a VLAN ID (make sure it goes nowhere) Explicitly declare the VLANs a given switch port should pass, avoid the all option on uplinks Make the firewall proscriptive rather than permissive. There are some exceptions for certain network architectures, even so, they are usually very limited in scope. For example, at the moment we have a Meraki network within a third party network. The MX running the Meraki network has its WAN port on a native LAN that is connected to the LAN port of the external facing security appliance which uses PPPoE on its WAN uplink. This enables the dynamic external IP address supplied by the ISP to be passed to the MX and even to the Z3C connected to the MX. It is simpler to set up than it is to write about it.

Uberseehandel

@BlakeRichardson wrote: . So far the list the Trump administration wishes to ban is. Huawei Hikvision ZTE Dahua And what about Apple?

Uberseehandel

@MerakiConnor Before I disconnect the WAN cable, the LTE modem is showing STATUS Ready, enabled IP 10.204.13.136 TYPE 4G STRENGTH Excellent(-51 dBm) PROVIDER Ee MODEL PLS8-E So that looks OK to me. I even checked that I still have a credit on the PAYG account. I do recall that at some stage yesterday, something odd happened - I wanted to measure the speed/throughput differences between LTE and wired connections. I connected my phone to the Z3C WiFi and ran the Ookla Speedtest app (Android). I was briefly surprised as the App stated it was dual testing (WAN and LTE?) and for < 4 secs it showed a download of over 100 Mb - then it stopped. Then just now, I wanted to connect the phone to see if I the Z3C would work with a WiFi client when the WAN cable was unplugged, and the phone would not connect, I checked the dashboard, all the SSIDs had been disabled. I don't know what is going on . . . :-[[ I can ping the IP address of the LTE from the dashboard - if that means anything.

Uberseehandel

@MerakiConnor wrote: Oi, I take full credit for this image ;-) Glad you got it working Robin! Great picture! I am curious to know how one switches from being connected via the WAN/Internet port to being connected via the internal LTE modem. At the moment, when disconnecting the WAN port the light on the front goes to solid red, and nothing happens. I did check that I still have a credit on the PAYG account and various combinations of powering off and unplugging WAN cable. Whatever is happening, it isn't connecting. I have been reminded of what one of my farming friends said about non-functioning beast - "about as much use as a pink button on a male cow", which is a bit of a conundrum.

Uberseehandel

@danielpugh wrote: if only i had the luxury of being able to pay EE in the UK said its simply not an option any more. raising the spectre of what to do with a publicised feature (4g wan backup) not working the 4g providers all work with ipv6 only... Curiously, yesterday I activated an EE LTE/4G data SIM, which was assigned an IPv4 address on activation. Whether it will always be the same IP address, I do not know, but as it is for a travelling Z3C, the cellular sub-system will be enabled/disabled frequently, so I shall soon find out. I did not have to specify IPv4. It occurs to me that the person who declined your request for an IPv4 address, did not understand the implications as far as you are concerned, and that such a request should be fulfilled if at all possible. Perhaps you could move up the food chain at EE and find somebody who can make things happen.

Uberseehandel

@SoCalRacer You make a good point - That list of supported/tested carriers is "historic" Orange, Telia, Telecom Italia, Telefonica, Post, BT, STC, Telenor, SingTel However, EE is the company formed to take over Orange and BT mobile operations in the UK (at least some of the Meraki staffers have EE), likewise O2 is the mobile arm of Telefonica and not mentioned yet I "know" their data SIMs will work. The list needs updating, I suspect that both 3 and Vodafone will function correctly as well (but not betting).

Uberseehandel

@PhilipDAth wrote: I hate to say it say it but you are going to need to try the SIM in another device like a phone. Perhaps it has a SIM lock on it or something dumb like that. @PhilipDAth As the actress said to the bishop "take care how you put it in" - job's right now.

Uberseehandel

@SoCalRacer Thanks for responding. Definitely a Z3C-WW model Firmware MX 14.39 I think a Meraki person is going to get an EE SIM from the shop around the corner. ;-[]

Uberseehandel

The new Z3C is functioning as far as wired workstations and wireless devices are concerned. I put in a data SIM earlier today, but the Z3C is not recognising it. EE, the MNO, tells me that the SIM is activated and that there is credit on the account. They also state that it should not need an APN, although some Meraki documentation suggests otherwise. I don't think it is anything stupid I've done as far as the SIM is concerned, it is in in the correct orientation, despite the silly tray and flaky tray extraction tool. Any suggestions?

Uberseehandel

@GaryShainberg wrote: Dear Friends, I have a client with an extensive Meraki (full stack) network but they have a couple of locations that need a max of 3 devices (mostly 2) and for them to invest in 120 (8s) is an overkill both physically and financially. Please Can someone suggest some low cost switches that support vLAN's and work well with a Meraki infrastructure. There are a number of small managed switches that are cheaper, but not Meraki products. Over the last couple of days I have been experimenting with the Meraki Z3C Teleworker Gateway. They have 4 local gigabit ethernet ports, one of which is PoE 802.3af, and a LTE modem may be specified, as well as the Internet port and MU-MIMO WiFi. I had a quick google and I see that in the UK, it is available for £247.88 exc.vat. This is noticeably cheaper than the 8 port switch. It may suit your use case. https://meraki.cisco.com/lib/pdf/meraki_datasheet_z_series.pdf Once I had set it up in its own network, it just worked and is managed by the Meraki Cloud software.

Uberseehandel

@BrechtSchamp I have not used Meraki VPNs before. We have a number of VLANs, including Management, Audio-Visual, IOT, Design-Office etc. In my dreams, I would like to securely(encrypted) extend a sub-set of the main network VLANs (Vectis) to the Z3C network (Acheron) so that when I connect a workstation to Acheron, it behaves as if it were attached to Vectis locally, even if I am at a remote location. The best way of managing SSIDs, is also up for debate. It goes against the grain to set up yet more SSIDs. On another brand's equipment I am able to use the same SSID, validation and password on different networks, and roam between them. Whilst I won't be roaming between networks, it would be an elegant design feature. I must say, I am learning a lot!

Uberseehandel

@BrechtSchamp wrote: Imo it would indeed show up as a client if you have it behind a Meraki network. But as per usual with MX and Z it needs to be in it's own network. It would only be using that other network as it's "internet connectivity". You can only have one of them per network. I see that you claimed it and given it a name. Does that mean that you've added it to a new network? No like a complete dweeb I added it to my main network. Thanks for pointing it out. Before I do anything regrettable, is there anything I need to know about removing it from Vectis.CaithnessAnalytics.com before I create another network and adding the Z3C to that? Even quite a moderate sized organisation could end up with literally hundreds of networks if handing these out for staff home offices. I can see next week is going to be more crowded than I originally planned. ;-[]

Uberseehandel

@Richard_W wrote: I know for my Z3, depending on the connection, it did take a while to finally show up in dashboard, when deployed. . . . Are you just testing at work prior to deployment? For the last 30 minutes, or so, the Z3C shows that it is connected, solid white light on front, but the dashboard does not show it. I had a quick look at available Wi-Fi networks on my phone and was able to connect to a SSID called Meraki Setup which is open and lets me access my remote hosted files, so it is working. It only shows as a client on the dashboard, I cannot find any way of configuring it from the dashboard and the local connection is very limited. So it remains something of an Enigma. I would like to configure it properly before I take it up to London next week, otherwise I will not be taking it.;-[] Thanks for your assistance.

Uberseehandel

Hi Much to my delight a shiny new Z3C arrived today, so I have been deep in comparative MNO coverage (EE has the best coverage and a free PAYG data SIM package, for anybody in the UK). However, setup is proving problematic. I have claimed the device, given it a name, connected its WAN port to a trunk port on the switch. I have reset it, tried giving it a fixed IP address as well as getting one from the Management VLAN DHCP server. Mostly to no avail. The light on the front is permanently red/orange. I can ping it from the dashboard; somewhat oddly it has an IP of 1.1.1.1. I have not yet put a SIM in the device, do I need to for a wired Ethernet connection? Should I plug it in to the MX 64 (avoiding the switch)? Should I set up a new VLAN solely for this device (and presumably the VPN functionality when I'm away from base)? I have not tried attaching a local workstation yet, is it mandatory? Hopefully, the solution is simples (pay attention, Meerkats) Next to the rest of the Meraki stack, it looks slightly menacing . . .

Uberseehandel

1996 - IPv6 specified (RFC 1883) 2006 - Meraki founded No excuse for any engineer at Meraki to be blind-sided by IPv6. Trying to explain away the reality that the engineers really screwed up just insults the audience being addressed. Can we have some straight talk please from somebody at the C-level. Vague flummery or testiculation will only exacerbate an already bad situation. Note for the philologists: testiculation - waving one's arms around whilst talking balls.

Uberseehandel

It was interesting to hear that everything in the house is being connected . . . But still not STBs that are based upon (Multicast) IGMP-Proxies. This is fast becoming an ubiquitous delivery mechanism but not on Meraki. The isn't a newly noticed shortcoming, it has been known about for some time. I would suggest that Meraki take a less US-centric approach to prioritising this requirement. Not much requires to be done, its in Debian, so, as a Meerkat might say, "simples".

Uberseehandel

Uberseehandel

Configuring Simple Guest and Internal Wireless Networks is a good place to start

Uberseehandel

From the MX67 Documentation Setting PPPoE PPPoE authentication may be required if you are connecting MX device to a DSL circuit. You need to know your authentication option and credentials (supplied by your ISP) in order to complete these steps. Choose Connection Type > PPPoE. Select your Authentication option. If you select Use authentication, enter appropriate values for Username and Password.

Uberseehandel

@lxLondon wrote: Will raise a ticket with the Meraki support to get the MX software improved. Good luck with that.

Uberseehandel

The ITU are planning to make it mandatory for all APs to have GPS capability, so the user, rightly in this particular instance, has no control over which regulatory domain the AP is configured for. Out in the wild, this is a real problem and cowboy installers have been known to configure APs to be in certain domains which have no limitations on the use of locally proscribed portions of the spectrum. 5 GHz Spectrum Contention - EU In some regulatory domains the frequencies reserved for licensed fixed networks are available for use by APs (if they have devices that can be encouraged to use those channels 141 - 161). I have a small working paper that anybody contemplating further investment in 5 GHz technologies will probably find helpful; it also describes the implementation issues to be addresses if using certain types of QAM. It could be made available if required.

Uberseehandel

Thanks for pointing out the link was borked. Any reasonable person might assume the Meraki would sponsor its own videos to advertise products. Or is the marketing function being subsumed into Cisco?

Uberseehandel

Interestingly, Cisco has persuaded Linus Tech Tips to review the new Meraki MR55 (connected to an MS355-24X2). https://www.youtube.com/watch?v=Mx5-T8ZwxbU Equally interesting was the complete non-mention of Meraki. Early in the video there was a shot of an engineer installing an AP; the colour of his t-shirt screamed Meraki, and so it proved to be. Is this a new policy from Cisco? What does it imply?

Uberseehandel

@maramera wrote: Tx power on MR42s - auto reduced significantly across several networks this morning. Which band are you using? If in the 5 GHz band, then channels 100 - 128 could be affected by DFS/APC/CAC cutting in as a result of the APs detecting radar.

Uberseehandel

@PhilipDAth wrote: Maybe give them a call and say the radar is causing interference to your WiFi in the 5Ghz band and can they tell you what channels they are using so you can stop using them. I live in a radar hell-hole, surrounded by military activity, next to the biggest shipping lane in the world, and incidentally underneath the preferred flight path of cargo operators moving specialised loads in AN-124s (old weather radar), with frequent bad weather and storms (a bit like Wellington, but without the cable car). Some (older) airfield weather/ILS systems can cause WiFi issues, these systems tend to be used infrequently. Fortunately, it isn't as bad as the situation close to Schiphol's rather distant fifth runway where the radar causes WiFi "failure" frequently in bad winters. Apache helicopters have sensors that detect WiFi sources and other "anomalies". There are a couple of helipads about 400 metres away. When they detect my WiFi they turn to face me and do the "bee dance", before leaving with a wave. On balance I am quite sanguine about radar interference as the systems used to detect and warn against windshear conditions save lives. Windshear can catch out even experienced pilots.

Uberseehandel

Community Record

Badges