@ww wrote: i think this has never worked. unless you proxy your  mDNS packets to the other vlan. maybe @Uberseehandel knows. ? I think it can be made to work, but it may take more time than justified.   However, what I did was split the network into two. So there are now dual stacks with separate APs on each network. The MX uplinks to a WAN port on another brand security gateway that also has its own switches and APs.   So all the IoT, speakers, smart house kit, playout centre, Chromecast players,  multicast devices, smart monitors, Audio and Visual processors and Guest network are on the naughty step and the trusted devices are behind the MX attached to an MS.   Secure devices are only connected to insecure devices using HDMI, not Ethernet. Secure phones/tablets that need to initiate Chromecast streaming for an ephemeral link to the Chromecast VLAN and as soon as the Chromecast capable device starts playing, the link is broken. This all works quite transparently. But my electricity bill has gone up noticeably.   I am very cautious about Bluetooth, but that is another story. ... View more

For the sake of completeness, and clarity I would point out -    GDPR is not just about binning data. It is also about keeping data that needs to be kept, for however many years is required.   The British government has just managed a horrendous fail 🔥, by destroying the disembarkation records of those Caribbean citizens who came over with their children after the war to help with rebuilding the damaged cities and facilities. This was 60 and 70 years ago. These records are the proof that those children are legal British residents.   The Home Secretary in 2010 authorised the destruction of those records. That hapless Home Secretary is now an even more hapless Prime Minister. This may be all it takes for May to be pushed out of office, and one of her putative successors, Amber Rudd, the present Home Secretary along with her, for trying to deport legal citizens, who no longer had access to the data required to prove their legality, because Mrs May had destroyed them, and the present Home Secretary didn't care.   The consequences of this go far beyond the appalling injustice done to the "Windrush generation", they could cause cause control of the British government to fall into the hands of the loony extremists shouting for Britain to leave the European Union. Most of this lot are venial liars, and that is the good thing about them. . . .   When something as dry as GDPR becomes front page news and the first item on the TV news bulletins, life has gone very badly wrong.   Lest anybody is tempted to feel smug about this, the US still keeps my withdrawn residency application from 1969 on record, and pulls me out of line and bullies me about it, which usually adds an hour to to the time it takes to transit immigration. Personally, I feel that is abusive record keeping.   ... View more

Guys   I have just received this email from The Cisco Meraki Team -    @The Cisco Meraki Team wrote: Dear Meraki Administrator, At Cisco Meraki we have always been committed to protecting the data our customers entrust to our cloud-hosted service. Privacy goes to the heart of everything we do as a business. The General Data Protection Regulation (GDPR) is therefore a welcome opportunity to further refine our approach and ensure our customers can have complete confidence that they remain in ultimate control when they select a Cisco Meraki product or solution to simplify their IT. With May 25th fast approaching, we’re reaching out to communicate our plans for helping our customers navigate the GDPR, and to share our continued commitment to protecting and respecting personal data, no matter where it is collected or processed. Our engineers have been hard at work preparing new features for the Meraki dashboard that will help enable our customers to meet their obligations under the GDPR. These new dashboard features will be fully rolled-out in the EU before May 25th. We’ve covered the GDPR basics and some of the changes we’re planning on our website. These changes include steps we’re taking to address obligations of both the data “Processor” (that’s us at Meraki) and the data “Controller” (that’s our customers) under the GDPR. In brief, some of the enhancements we’re making include: The 'right to be forgotten' • New dashboard APIs will allow Meraki customers to delete dashboard data, either for themselves, or in response to requests from users of their networks Data access and portability • New dashboard APIs will allow Meraki customers to access and export dashboard data, either for themselves, or in response to requests from users of their networks. Restriction of processing • New dashboard APIs will allow Meraki customers to request restriction of processing for dashboard data in response to requests from users of their networks. Tracking GDPR-related requests • The dashboard event log will include new functionality for tracking GDPR-related requests, like the actions described above. Consent tools • Enhanced splash page functionality will allow Meraki customers to provide notice to, and obtain any necessary consents from, users of their networks for the collection, processing, and storage of network user data. As these features are finalized we will be rolling out a dedicated webpage setting out additional details and a further email communication to ensure we reach everyone affected. Thank you for being a valued Cisco Meraki customer.   This is more than "cutting it a bit close".   According to Meraki the features are not yet finalised, and a dedicated web page along with an email are what we can expect at some unspecified point in the future, by way of support. We have 29 days to implement our GDPR response, and we still don't know what to do.   It is well past time that Meraki took a more Global view of the world. I wonder how many Meraki folk know that the EU is a larger economic group than the US? Most of my European colleagues have been actively working on this for months, we have courts making decisions on what is and what isn't personal information. And for the benefit of whoever it was who understimated the importance GDPR, the courts will construe personal information  very widely, including the situation whereby meta data would have to shared between legally separate organisations in order to match, say, dynamic IP addresses to individuals.   ... View more

@MRCUR wrote:   It's a bit pricier than I expected.  At that price it is time to check out the alternatives. It would be so nice if the MXX range sorted out the MX's feature shortcomings. And the Z3 needs to handle multicast and IPv6 properly, it is supposed to be for telecommuters.  ... View more

You may find this helpful.         ... View more

@PhilipDAth   As you say, pretty major.   Much to my surprise, the Google translate does a decent job with the Dutch original these days, so worth translating the article reference in my original post. (Or finding a cow-cockie in the Waikato) ... View more

Once you have the 857 running in pass through mode, I am sure you will have no difficulty configuring the MXto act as the router/security gateway.   I have run the MX using PPPoE/PPPoA with a modem in bridge mode and also connecting the WAN port on the MX to a LAN port on a different brand security device, that was routed straight out the WAN port. Both ways work fine.   Re Sky -    The UK ISP Sky utilises Mac Encapsulated Routing (or MER) for its "Sky Fibre Broadband" (FTTC) VDSL2 Internet service and some "Sky Broadband" ADSL services – this uses details that would normally be supplied by the Sky router; which are included in DHCP requests from the router, to authenticate with the network and receive an IP address. According to users, these details also work for Now TV (Broadband). These details are usually specific to the router supplied by Sky but it is possible to use another router with the Sky MER service if that router is able to provide DHCP option 60 and option 61 when making DHCP requests to the ISP. This configuration does not require cloning the MAC address of the ISP router, which allows the DrayTek router to get its own DHCP IP lease and renew that without issue. ... View more

Bridge mode - Cisco 857     ... View more

@jannemikola wrote:   Just earned my CMNA a couple of days ago and looking to get accepted to CMNO as well.   (Someone should try to clarify the difference of CMNA and CMNO somewhere better than it has been done. A very simple question for example: which one is more valued? Or a higher level certification? I did read that CMNO will move to an exam based model in couple of months, and it already has unique certification IDs so even though it's online, I'm leaning towards the idea that CMNO > CMNA. Typically people are stating other way around in these forums.) Welcome Janni   If you have CMNA, that is broadly equivalent to CMNO, except A comes before O and some CMNOs would rather have a CMNA!   Based on your Telia experience and academic qualifications, you probably want to aim yourself at Meraki Masters rather than an exam that you could pass without ever having had access to an MX. Presumably you also have MIEEE and MACM?   I cannot recall if Telia offers managed services, but the Meraki kit is a very good fit to the requirements in that sector.   Personally, I would like to see the VoIP offering expanded to Europe (Spanish, German, French and Italian versions released), but the product as presently set up is not a very good fit for European requirements (no surprise there).   What we do need is more people asking Meraki to get on with SHA-2, IPv6 and multicast the way many of the ISPs offer it (IGMP-proxy). ... View more

@Adam wrote: . . . . . one thing that drives me crazy is the MX limitation on internet bandwidth.  With larger pipes being available for much cheaper these days it is hard to swallow having to buy an MX84 or MX100 to get > 200M.  What's your guys thoughts on this?   Has anyone ever reviewed any products like this? https://www.ubnt.com/edgemax/edgerouter-x/   I'm just trying to think of solutions for smaller sites 10-15 users where fast bandwidth is available.   I have some experience with UBNT product, our small network, which gets complicated and Meraki cannot provide the services required is split into two   Meraki - secure network using MX, MS & MR serving workstations, laptops and authorised mobile devices. UBNT - UniFi - handles multicast, Chromecast, Guest network, IoT devices, smart TVs/monitors, video playout, audio processing etc.   The UniFi network has a CloudKey that is accessible remotely which provides a single pane style dashboard to run that side of the network. We still have to delve into the CLI and use a "fiddly" procedure to ensure the configuration is not lost on rebooting or upgrade.   The EdgeMax range is more traditional and CLI based (EdgeOS is a fork of Vyatta), but that is changing with a new dashboard style management tool being available in beta.   UBNT has released a EdgeMax router capable of 80 million Gbps / 18 million pps which is also in beta release as a UniFi product. If this is overkill, there are lesser routers/gateways available with varying levels of throughput, dependent upon activation of DPI and IDS, IPv6 is a work in progress.   By splitting the network I an less concerned by crap on the portion designed to serve all the dodgy kit, I only need to worry about what is behind the MX.   The MX uplinks to a LAN port that goes straight out the WAN port. It works, as does connecting devices on the naughty step to secure devices using HDMI cables to continue meeting our analytic workstation requirements seamlessly.   The issue of WAN speed is overdue for addressing by Meraki. 1Gb/1Gb FTTP is available locally for £50 per month (but not in our exact location). By way of comparison, if I take the Internet access cost out of the telco provided package, 80Mb/20Mb costs £45 per month. Everybody will take the FTTP package (probably at 200-300Mbps) as soon as available.    The reality is, what security appliances, routers will handle this sort of speed? Certainly not the small MXs.   If we add in the lack of proper native IPv6 support (no tunnelling, no performance deg), the lack of multicast capability, SHA-1 issues, one could say that the MX range is long overdue for a complete overhaul.   If the MX is being replaced, to address these and other shortcomings, I would ask them to also consider moving to a Zonal security model, much more intuitive, one of the things I like about the SRX-300 from the Gin Palace (alas no proper multicast).   One of the problems with splitting/duplicating the network is a noticable increase in electricity consumption. To say nothing of larger rack space requirements, and some additional thought requied when changing anything.   Life would be simpler with an MX designed for today's requirements. ... View more

@wey2go wrote:     Key driver for 802.11ax is efficient spectrum utilization. In reality .11ax is all about efficient spectrum utilisation of the spectrum by all the different classes of user of the 5 GHz spectrum, of which stationary WiFi is only one. There are whole new classes of spectrum user that have to be accommodated, traditional use classes that existed prior to WiFi's wholesale adoption of the 5 GHz band have asserted their rights to better, interference free, access.   You might be looking at .11ax purely from the point of view of Wi-Fi, the people responsible for managing the spectrum for the overall benefit of all users see it as a way for improving overall efficient use of the spectrum by all classes of user. The arrival of mobile WiFi and the burgeoning demands of some IoT communications protocols will have the same end result as the delivery of a cuckoo's egg in a bird's nest.   WiFi marketing is dysfunctional. For example, throughput values are quoted on the basis of aggregating half-duplex signals across different radios some of which are operating in different parts of the radio spectrum, under entirely unrealistic ideal laboratory conditions, as if WiFi were some kind stereophonic broadcast system. You may not have noticed that wired Ethernet is Full Duplex. Wi-Fi only functions if both client device and AP form a link, the system does not handle concurrent sending and receiving, unlike, say, mobile telephones.   There is no point in chasing after a standard that is not yet ratified, that is not the best available solution for WiFi users, but suits WIFi manufacturers to offer because it requires new kit that punters will queue up to buy. Most of the "manufacturers" buy in the components from the handful of businesses around the world that actually design and manufacture the subsystems and components required to make WiFi access points and client devices such as phone and laptops inter-operate to form viable wireless links.   There is a whole separate area of the spectrum that is virtually ignored that has been set aside for traditional WiFi use. The manufacturers are not presently adopting it for their own reasons. What reasons, well generally speaking - "two bites of the cherry is better than one . . ."   Nobody would be that foolish would they? ... View more

@PhilipDAth wrote: Maybe Caroline would make it like the "Make a Wish" feature on the new Meraki Insight product (that is satire).   ps. Here is a screenshot in case you have not seen this.  Perhaps Meraki should run a competition.  If a customer actually figures out how to make a wish for Meraki Insight they get a free pair of glasses. Go on, look really hard, and you'll eventually figure out how to make a wish.   @PhilipDAth wrote: Maybe Caroline would make it like the "Make a Wish" feature on the new Meraki Insight product (that is satire).   ps. Here is a screenshot in case you have not seen this.  Perhaps Meraki should run a competition.  If a customer actually figures out how to make a wish for Meraki Insight they get a free pair of glasses. Go on, look really hard, and you'll eventually figure out how to make a wish.   Just beneath Report a map error - (43" monitor). I need a new prescription ... View more

@PhilipDAth wrote: I understand storage space is quite tight at the SFO office.  What about if you had all the swag manufactured and stored in Auckland, New Zealand?  Just think of all the International freight charges you could save on. To say nothing of shipping sooner than it would anywhere else in the world . . .  ... View more

Based on my own experience, a now dead generation of the kind of folk that ran the Empire used the word quedo or quedos (that is how I assumed it was spelled based on the pronunciation) to describe unspoken/unrecorded acknowledgement  of merit that, in extremis, could divert an otherwise deserved "rocket". Earning quedos was part of building a successful career.   I don't know at what point it entered US slang, or how. But if US-usage doesn't pre-date February 1943. I have a fairly good idea of the how/why. The term has been in pretty regular use in the UK military for a long time.   Originally, like so many other phrases, it could have its roots in India. In a world where people live in each other's pockets, quedos, like bitcoin was transferable and spendable in ways that are not always readily apparent.   So there is an interesting tradition as far as the modern kudos is concerned. ... View more

@gabrielcouto wrote: At this case, the client request me to create two SSID, but he would like to roaming between them without any re-authentication. Both SSID are the same layer 2 vlan, but I believe that it is not possible. On the positive side, if the client understood what they were asking, they wouldn't be needing you to implement their half-baked ideas.   Whenever there are "tricky" WiFI design schemes, it is like a warning sign that the design has been implemented before it has been fully resolved. It happens all over IT/IS. ... View more

You also need to make sure that the trunk port allows the Management VLAN as well as the SSID VLANs. ... View more

@PhilipDAth wrote: The last time I used an MS120-8 with fibre was in a factory.  I needed to connect about 3 x PLC controllers which were around 400m away from the rest of the network. When I started automating production plants "a very long time ago", we had to use fibre because of all the interference, safety, and environmental issues. Still we see folk resisting the use of fibre, mostly because the industry has done a really poor job of explaining how to deploy it, and what to use under different use cases. Also most of the time people who haven't used fibre before expect it to be much more expensive than it actually is.   For those that are green inclined, I rather suspect that fibre is more environmentally friendly than copper (subject to sheathing material).   ... View more

@PhilipDAth wrote: ps. The standard is expected to be ratified till late 2019 - so don't rush too quickly into it. Anything before then will be "non-standard". There is a very good case to be made that IEEE 802.11ax is a case of manufacturers ignoring the reality that demand for use of the 5 GHz spectrum is growing and conventional WiFi is not the most likely application to dominate this space. WiFi will see the emergence of virtual channels made up of discontinuous portions of the spectrum, APs and other 5 GHz spectrum devices that autonomously set channels in order to maximise overall spectrum use (think about that). In reality .11ax is a step on the way to very messy 5 GHz WiFi future. I would not chose to spend money on developing this tech, I'd jump straight to .11ad Where there is a great deal of uncontested spectrum and there will be a slightly different deployment model as, at least initially, ranges are likely to be short, mesh topologies will dominate, many small, hopefully unobtrusive, APs will be deployed, speed however will be great and there is sufficient spectrum to ensure that there need be no contention between uplinks and client links.   As far as .11ad range goes, there are exciting developments under way. ... View more

I have developed mobile applications for use by clinical staff and regularly work with high speed streaming telemetry. As a matter of course, I now assume that connectivity will be intermittent and that the portable device should synch with the remote servers when the link becomes active, that is asynchronously. So the changes will be replicated. Systems which are dependent on uninterrupted and continuous connectivity are rarely successful. Even in a controlled environment such as a hospital there is no guarantee that connectivity will be continuous.   ... View more

@kredmore wrote: We have Hulu for TV, Netflix, Amazon Prime, etc. and all streams fine.  We have trialed other services too, like Playstation Vue, DirectTV Now, etc.  Which ones can't the MX/Z handle?  Just curious... They are not multicast, they are unicast. Multicast is used by a few broadcasters in the US, but is widely used in East Asia and Europe. It makes great sense for telcos selling packages and optimises throughput over the network as a whole, including "the last mile". This way, idf there are three TVs watching the same channel, only one stream comes down to the router which distributes it to those switches that have devices wanting access to the stream attached to them. ... View more

My rules of thumb for home deployments are:   don't chase range wire anything that does not move place an AP in each space that needs WiFi access Far better to have more small APs operating at low power than a few large ones operating at max TX volumes. For WiFi to work the AP has to be able to hear the client device as well as the client device hearing the AP. In the long run shouty APs often create problems.   Sleepovers can be very demanding. They all want to watch the movie on their own tablet. Then when the gang comes round to watch sport, the same thing happens . . .   I would be cautious about running a full stack in a domestic environment because the MX does not handle the flavour of multicast favoured by many broadcasters. So I have a duplicated stack, completely different networks, sharing a common ISP connection. Multicast, IoT devices, Chromecast, Bonjour, Guest WiFi go on one network whilst there is a separate Meraki MX, switch and APs on the secure side.   Meraki is shooting itself in the foot by not supporting IGMP-proxies on the MX/Z range. Imagine making a box specifically for home deployment that cannot handle streaming IP TV from many providers. Many managed service providers would love to be able to expand their offerings to including Meraki managed client sites that require multicast to function correctly. All that is required is a desire to make it happen. ... View more

How many client devices are 802.11ax capable? ... View more