Well, that is still a workaround, albeit quite a good one! You still need to realise that this is the issue, change back and forth, etc.. I have have not given up the hope that at one day this will be fixed for good. ... View more

Ok, but the question was not this. The question is, can the VLAN override be done with using splash page + Radius? Several people seem to say that it is possible, plus the captive portal documentation also mention that: https://meraki.cisco.com/lib/pdf/meraki_whitepaper_captive_portal.pdf For me it does not seem to work, but I might be missing some detail. With WPA2-Enterprise, I can confirm that it works. With MAC based auth I have not tried. But what I would need to do is none of this, it should be splash page, as we would need to offer several different auth methods and consequently assign the users to the right VLAN. ... View more

Hi, I would be very happy if you could share some more details. I tried sending VLAN attribute with EAP, that worked. However with the splash page + Radius, no matter whether I try simply the VLAN number in Tunnel-Private-Group-Id or the group policy name in Filter-ID, none of them works. Any idea what could I be missing?   A.   ... View more

Hello,   I am trying to make this working (overriding VLAN by Radius using splash page), but it seems I can not make it working. I tried it both ways, sending the Tunnel-Private-Group-Id and also Filter-ID (and configuring the group policy). Maybe you are aware of any tricks or pitfalls?   A.   ... View more

We did some more tests, and it looks like when a "real" failover happens, the 1:1 NAT is handled correctly. When we do a switch of primary-spare initiated from the Meraki dashboard, the 1:1 NAT stays with the device which becomes inactive and it will not work properly. ... View more

After more than four years, this still seems to be an issue. I don't buy the argument that I should clear the upstream device cache. If there is a failover, that should just happen without anyone intervening in any way. ... View more

  Sure. Let me find my notes. Here they are:   a.) Log in to your Cisco Wireless Controller b.) Go to Controller/Internal DHCP Server/DHCP Scope, click your scope and take a note of your DNS servers. In my case these were 8.8.8.8 and 8.8.4.4. Usually you have only two DNS servers, but it is also possible to set three. c.) Go to Controller > Interfaces and take a note of your virtual address. d.) Go to Security, Access Control Lists, Access Control Lists. e.) Create a new Access Control List by clicking New. Name it Pre-Auth-ACL. f.) Click the name of the newly created ACL. g.) Add the following five rules, while keeping their order. 1. Permit, Source 0.0.0.0/0.0.0.0, Destination: 0.0.0.0/0.0.0.0, Protocol: Any, Source port: Any, Dest port: Any, Direction: outbound. 2. Permit, Source 0.0.0.0/0.0.0.0, Destination: (your virtual address)/0.0.0.0, Protocol: Any, Source port: Any, Dest port: DNS, Direction: inbound. 3. Permit, Source 0.0.0.0/0.0.0.0, Destination: (your primary DNS)/0.0.0.0, Protocol: Any, Source port: Any, Dest port: DNS, Direction: inbound. 4. Permit, Source 0.0.0.0/0.0.0.0, Destination: (your secondary DNS)/0.0.0.0, Protocol: Any, Source port: Any, Dest port: DNS, Direction: inbound. (If you have a third DNS, add it here) 5. Deny, Source 0.0.0.0/0.0.0.0, Destination: 0.0.0.0/0.0.0.0, Protocol: Any, Source port: Any, Dest port: Any, Direction: inbound.   h. Go to WLANS, Select your guest network, Select Security, Layer 3, and set the newly created ACL as Preauthentication ACL for IPv4.   ... View more

Well, I am quite sure we don't want spend some more money this way just to plug this hole. It is possible to set custom DNS per SSID (Content filtering: custom DNS), we tried that, it did not work. ... View more

SLR, can you please elaborate? Where do you set Umbrella and how will that stop tunneling over DNS?   We tried to set Custom DNS in the SSID settings, even that is not working in the pre-auth phase.   ... View more

The issue here is that DNS to any public IP is allowed in the pre-auth phase. It should be allowed only to those servers which are handed out to client by DHCP. Those allowed should be captured and all answers should point to the captive server instead of the original answer. Cisco WLC is also vulnerable but that can be fixed by creating a pre-auth ACL. ... View more