This should be entirely configurable by the user.   Somewhat more worryingly, that this wasn't thought through from the start shows a worrying misunderstanding of the way people react. Bring a Happy Shiny Person to work . . .and test their reaction. ... View more

@american_niseiwrote:  . . The environment is a high-density, high-utilization co-working location.  There can be over 300 people in the space.  Running everything on auto except the channel width which I had set to 40.   I've had both connectivity issues (people getting booted off the AP) and speed issues.  I don't have DFS turned on and am not using any DFS frequencies.   Hi,   It looks like you have some challenges there.   Firstly, be aware that the specifics of operating in the 5 GHz band are dependent upon the regulatory area you are in. I know there have been some changes in the US and that in East Asia the legislation has changed, I don't keep up with this stuff globally (I have to eat), unless I need to.   Depending on where you are, if you are not using DFS channels (using DFS is not optional, it is mandatory if using a DFS channel). In Europe, the only 20 MHz wide channels that are nor subject to DFS services are: 36, 40, 44 and 48 - all at 20 MHz the equivalent 40 MHz channels are 38, 46 80 MHz channels 42  That is it for most of the world, including the US, if you avoid the DFS channels. So you only have 2 non overlapping channels available. High density, you are going to have problems.   The advice you have been given is dead right.   In order to so something about improving your overall service, these are the steps I would take.   Preamble - almost everything in the 5 GHz band is counter-intuitive.   With only 2@40 Mhz / 4@20 MHz channels to work with, you have some severe limitations. You need to better understand your environment. Start out by carrying out a site survey. Use Ekahau. If the budget is tight use their free tool, HeatMapper. Do read the very clear documentation, there is plenty of it, all helpful.   Generally, bear in mind: better to have more low powered APs  operating at low volumes, than fewer powerful APs operating at max TX volume. avoid having signals leaking into adjacent spaces serviced by other APs you have little control over Wi-Fi signals from neighbours leaking into your space, unless you can find a way to address the issue in a non-confrontational manner. Auto channel and auto TX volume is not as efficient as carrying out a survey and adjusting channels, TX volumes and AP locations explicitly.   These are just guidelines. If the problem is serious, and it sounds as if it is, hire a qualified professional to sort it out. If you have shouty Wi-Fi neighbours, don't get into a fight with them. Some of the cheaper brands of AP are not as particular about how high TX volumes are set when their domain is set to certain countries.     ... View more

@american_niseiwrote: and it has been recommended to change the default 5GHz channel width from 40 to 20.  Everything I can find seems to indicate that 40MHz or greater is the way to go for 5GHz.  I see almost nothing touting the benefits of a 20MHz channel width   Well, as you observe, the default 5 GHz channel width is 20 MHz. You won't see much written about the benefits of using  20 MHz channels because most of what is written is marketing material; but it does exist.   a 40 MHz wide channel is twice as likely to suffer from interference as a 20 MHz wide channel. The larger channel occupies twice as much of the available spectrum, so twice as likely to suffer from interference. a 40 MHz wide channel reduces the amount of space available for other APs, potentially causing conflicts and congestion. whilst virtually all client devices can use a 40 MHz channel, the same does not apply to 80 MHz and 160 MHz channels. if operating in Band B UNII-2 Extended  (5490 - 5710 MHz), then you are doubling the likelihood that weather radar will cause DFS, TPC and CAC to become active. Once that happens, depending on which channels are being used, an AP can go off-air for up to 60 minutes ensuring that it does not start broadcasting on an occupied radar channel. Basically the Wi-Fi shuts down, and you can't do anything about it, apart from avoiding the weather radar channels,   DFS is required in the frequency range 5725-5850 MHz to ensure an appropriate protection to the radiolocation service (including frequency hopping radars), DAA is required in the frequency range 5855-5875 MHz for the protection of ITS, in the frequency range 5725-5875 MHz for the protection of BFWA, and in the frequency range 5795-5815 MHz for the protection of TTT applications. If you are suffering interference related performance/throughput issues, it is a good idea to see if you can wind back the TX power of the AP radios without the client devices losing connectivity and reducing the likelihood of interference by reducing the channel width. If still suffering from interference , change the channel number to the channel just vacated and see if that makes a difference.   It is perfectly normal advice, as far as throughput/connectivity/interference issues are concerned to reduce channel width as the first step of nailing down the problem.   Without knowing a great deal more about your situation and environment, I could not comment on further steps to take to solve the issue. I can tell you this, however, turning up the TX volume,and widening the channel width always has unintended consequences.   Having said that, at my test site, I run 80 MHz channels because I am testing the efficacy of DFS/TPC/CAC and I am exposed to weather radar, marine, aviation and military use of the 5 GHz portion of the spectrum. ... View more

@KrisVerdonckwrote: It was handmade to put the rack on top of it but then we found a much better stand between the junk 🙂   Well the wine was hand made -      ... View more

The wooden box caught my eye . . .  ... View more

The MX beta firmware 15.3/15.4 allows NO-NAT configuration. I debated using it and opted to run with turning off NAT on the port on the device ahead of the MX, so there is not a double NATting issue. Optionally, I can turn the NATting back on to test what occurs . . . ... View more

The reality is that it is not difficult to set up:   a separate management VLAN all VLANs explicitly declared explicit declaration of VLANs permitted on trunks use of a blackhole VLAN where configuration insists upon an entry Personally, I suggest using 101 as the black hole   You asked me once, what was in Room 101. I told you that you knew the answer already. Everyone knows it. The thing that is in Room 101 is the worst thing in the world.                                                 — O'Brien, Part III, Chapter V - George Orwell, 1984  @PhilipDAth suggested using a non-existent VLAN, the selection of an appropriate number was an automatic choice ... View more

🗿 can't find gnomes or dancing girls. ... View more

he probably goosed the pokies whilst he was at it.   Getting access to your internal WiFi, probably social engineering. ... View more

I tried getting clever with CIDR super- and sub- netting. It wasn't allowed. I have changed my network architecture so I have options at all levels. Taking a leaf out of the banks' playbook after the last financial crash, I have bad bank and good bank, or rather bad network and good network. All the dodgy stuff is in bad network. Good network is secure and boring . . . bad network is out dancing all night.   ... View more

@KrisVerdonck   That looks excellent. Thank you for the URLs for the cables.   I have a feeling my photogenic rack is going to end up more expensive than a lot of the kit in it . . .  ;-[]) ... View more

If you want to configure a VPN, you need to be able to access the dashboard. To access the dashboard, you need to be able to access the Internet.   The MX device I am currently connected to is not connected to the Internet. It is connected to another network that is connected to the Internet. This allows the MX to connect to the Dashboard.   Local configuration options are described in the Installation Guide I referred to above. ... View more

Combined Dashboard Networks   This may suit your organisational/network  structure. ... View more

@Inv-Secwrote:   But to then carryout further configuration, i.e. Site to Site VPN, it seems you have to do this logging in via Meraki Dashboard which is accessed via the internet. Hence my questions is that, can I still carry out advanced configuration, if Meraki device not connected to internet, while still connecting locally.   Because I need to have full access to it while i configure and test it's VPN connection.   Do we have or can I configure a management connection allowing me full access locally?   If you need to access the dashboard, you will need to have an Internet connection.   I am unsure of how your MX is connected   Is it at a location that has a dedicated leased line to another site? How were you anticipating the VPN would be routed to the remote site?   ... View more

@KrisVerdonck   Hi   Is that the 3M turquoise Ethernet cable that you are using, it looks good as does the other colour with it, pale lavender?    I have to build a small rack from scratch that will be photographed and used in explanations, so it will really have to look the business.   The turquoise colour works well with metallic objects - see the Mecedes Petronas F1 car, and your other colour choice is equally suited to a metallic environment.   I'd use Aston Martin's AppleTree Green if I could find cables that colour (photographs are unreliable, however)   Cheers ... View more

@Inv-Secwrote: Hi,   . . . ., I was wondering if the Dashboard be accessed offline or do i need to have internet connection to access and then carryout any configuration?   There are local pages which you can access, see the MX65's Installation Guide, which explains how to access   http://setup.meraki.com locally, without internet access. However, particularly when new to the product, you will probably find it simpler and quicker to use the Dashboard for those things that you do not have to use the local access for, but the guide has clear instructions. ... View more

This explains how it is done. DDNS is used ... View more

@Adam   I don't know very much about the database at the backend. I do know it is a "roll-yer-own" and I have reason to believe that it may not be dissimilar to MongoDB as far as end users are concerned. Which basically means that if we were able to get access to replicated subsets of our own data the speed of development of API functionality would increase.   Health Warning - Radical ideas may be injurious to your health, mental or otherwise. "Rollies" and random clicking on Internet links may have unintended consequences.   ... View more

@PhilipDAth   I write autonomous vehicular control systems using Node Red. Apart from anything else, it is far easier to get useful feedback from the likes of marine architects and hydrodynamicists with a Node Red representation, than asking for help with developing the code to accurately reflect how the speed might decay under certain conditions with C++, for example. They are completely familiar with the maths, its how it relates that matters.   And node.js / node red is asynch, so ideal for real world applications. ... View more

As somebody with a name that too many sites can't handle -    Robin St.Clair   I have had to develop techniques (based upon the reality that upper and lower case do/don't work in the beerosphere.   So - RobinStClair@HitMeBabyWithYourRhythmStick.com   so Philip_dAth@kiwi.networks.co.nz or Jose_daSilva@Brasil66.com   it kinda works     ... View more

@trunolimitwrote:     I a bit confused about your set up. How do you avoid double NAT with the BrandX gateway in front of the MX. I adamantly don't know what a brandx gateway even is.   The BrandX gateway conveniently allows NAT to be configured on a per-port basis, so the MX uplinks to LAN2 which has NAT disabled.   A BrandX  gateway is a security gateway from a brand that is not Meraki (or Cisco). I had some of their kit sitting in the chuck shed so I dusted it off and discovered that it appears to solve a problem common to many Meraki users in Europe and East Asia, where, unlike the US, SSM is commonly used by network providers. SSM is used by some US ISPs but less commonly than elsewhere.   I only mention BrandX because it solves a specific problem, multicast and the avoidance of double NATting, which, at the moment, Meraki has no solution to.  The ability to keep the insecure devices even further removed from the secure parts of the network is a bonus. The component cost is slight, but not everything can be done with a GUI, which isn't for everybody.     ... View more

@trunolimit   At present there are certain things which the MX does not handle, but free (ISP supplied) routers do handle. There are also some eminently affordable and capable devices (routers and security gateways) that can be used with the MX to correctly distribute the services the ISP provides.   In my case, I put a BrandX security gateway ahead of the MX. This started off as a way of getting around the reality that there are certain flavours of SSM (source specific multicast) that the MX makes no attempt to handle, although the switch handles it fine. Very quickly I realised that splitting the local network into 2 distinct LANs gave me some real benefits.   All the doubtful kit (wireless speakers, HVAC control, smart TVs, smart home paraphernalia, Chromecast, Alexa, light bulbs) communicates via the dodgy doofa LAN, and the secure stuff sits behind the MX. The MX connects to the ISP through a port on the BrandX gateway. I have the choice of either having the MX handle NAT for its own dependent clients and specifying that the traffic from that port is not NATted when routed out the WAN port, or letting BrandX do all the NATting. At the moment I have the MX doing the NATing. I need to avoid double-NATting.   For services such as Chromecast and Bonjour, carefully configured VLANs allow access from a secure network hosted wireless client to a Chromecast capable device on the dodgy network, so music plays, or whatever, and once it has started, the device on the secure network can disconnect.   Much as we might like to, we cannot ignore the smart gadget phenomenon. I discovered, by accident, that "smart" light bulbs exist; I can't imagine there is a property manager out there who isn't attracted by that sort of capability. One of the problems is that the people who make speakers and bathroom scales and such are not interested in the security implications of networking. So better to put all that stuff in purdah and keep them away from what matters.   I have secure network devices that interact with the dodgy doofa kit by HDMI 2 alone, It works fine, we have large monitors that cope with this seamlessly. If I wanted to, and I don't, I could route the SSM link to a playout attached to the secure network.   Keeping the sheep from the goats is a good idea. ... View more

To get to the bottom of how the Verizon setup plays with 3rd party kit - look around the forums where this information is explained. They will explain how to configure everything.     ... View more