Meraki

rhbirkelund

OpenRoaming integration with Cisco Spaces Change: Updated prerequisites: "Pending Public Release of Open Roaming New Architecture". Coindicing with my case that's been open since January being updated with it finally being fixed.

rhbirkelund

Does the dashboard still complain with a device managed switch? I think we do the same with semicolons on non-Meraki or switches not in Meraki Dashboard, but perhaps this would be a better fit for using tags?

rhbirkelund

I'd avoid the EOX API for everything Meraki. It's buggy, and data seems inconsistent, and the Support Mailling list just seems uninterested in fixing it. I've had some queries I tried following up on, and no one seemed interested to do anything about it.

rhbirkelund

Are you talking about the Cisco Champions? Because, that is not my impression at all.

rhbirkelund

I have never had a customer using Systems Manager, and I don't really think it's that relevant for customers in my country. I've only ever touched through the CMNA stack that I got at first, and has since then played around with it a little to get a feeling of how it works and how to use it. I have devices at home that I have enrolled. Systems Manager in its entirety as an MDM solution, I don't think it relevant however, there are som aspects of Systems Manager that I still think might be useful, and would be interested to see if or how it could be continued or even improved.

rhbirkelund

I see many customers going with Intune, since they find it better Simply out of curiosity, why makes you think SM is superior? Why is it better than Intune or other MDM systems?

rhbirkelund

Yes, but that shouldn't necessary, since it's Meraki itself that's the Root and Intermediate CA. I also don't see where I should upload this. The Certificate page, is related to Access Manager. This is not Access Manager.

rhbirkelund

The SCEP certificate issuing is not something I do as such, but Meraki SM, upon enrollment. I login with my Entra Credentials to the SM portal, which creates a profile, including SCEP certificate. Once enrollment is done, as far as I understand the documentation, Entra is out of the picture again. From there on, it's the trust relationship between the Trusted Access profile and Meraki Cloud Authentication.

rhbirkelund

Hey I've been trying to lab a couple of things today, one of them being Wireless Trusted Access. Since Meraki now supports Entra ID integration, it's possible to use Entra and IdP for the Wireless Trusted Access. After working through a combination of three deployment guides, I've finally gotten so far as to getting the enrollment to work. I am able to browse to portal.meraki.com with my Network ID, login with Entra ID credentials and enroll my device for Trusted Access. Downloading and Installing the Profile for my iPhone, works. I am almost at the finishline however, I've reached a block, that I have no idea what's causing it. When I attempt to connect to my Trusted Access SSID, my client fails and the Eventlog shows EAP Failure. No other details, no nothing. And for the life of me, I cannot understand what's not working. It seems there is some trust that is missing, but I'm not sure where it is, since this should all be provisioned automagically by Systems Manager. Organization -> Configure -> Certificates, has the SCEP CA as trusted anchor, but I'm not entirely sure, that this is related. Any ideas as to what I am missing?

rhbirkelund

I am not implying that it is supported. Simply stating numbers. From what I understand, 20 ms RTT is the requirement between AP and CCG. Is it a hard limit? I doubt it, so with longer RTT it would probably still work. From my understanding, it's possible to have the MCG assigned one network, and have APs on several other networks, all connecting back to the same MCG. That way, sites can be segregated, and all still have one exit point, much like the Local Mode APs we know today on 9800 platform. Of course, the APs need to have a way back to the MCG. Whether this is a routed link or a VPN connection, who knows. As long as there is a route back, that is not Internet. All I'm saying is, will it work? Likely, yes. Is it supported? No. As is the case with most corner-case Cisco deployments. And if it doesn't work? Too bad, it should have been tested in a POC before deployment.

rhbirkelund

I think you should be able to achieve this by using VLAN profiles, and define a Named VLAN group, where you can concatenate VLANs, much like a VLAN group on a Wireless Controller. You'll have to create a VLAN profile, and define a group with vlans. Assign the APs to that VLAN profile, and then refer to the Named VLAN in on the SSID settings.

rhbirkelund

I'm curious, what's the requirement for only sending 80/443 over VPN, based on?

rhbirkelund

You probably have to dig through old Sales Orders, and look them up in CCW-R. At this stage, I think your best option is to bite the cost and physically get up to the AP, or accept that you have two "spare APs" mounted somewhere unreachable.

rhbirkelund

Otherwise you could try the "Meraki Click of Faith". Type in the SKU, and just click Add, eventhough nothing shows up in the search. This has usually been the case with Meraki SKUs in CCW.

rhbirkelund

Any chance it's already claimed in the inventory, but just not assigned a network? In that case, the mac address would suffice.

rhbirkelund

Or a set of NoName, unmanaged 4port switches from a nearby electronics store, may also do it.

rhbirkelund

Seems to work?

rhbirkelund

No, an AP can only tunnel all its SSIDs to the same MCG cluster.

rhbirkelund · ‎Nov 19 2025

An AP can only tunnel SSIDs to one MCG cluster.

rhbirkelund · ‎Nov 18 2025

Correction; four MCG clusters per network.

rhbirkelund · ‎Nov 17 2025

20 ms RTT is the official number from Cisco. Would it work with higher RTT? Most likely.

rhbirkelund · ‎Nov 17 2025

MCG and APs have seperate Firmwares (at least in a Meraki context). When you upgrade the MCG you do not also upgrade the APs and vice-versa. The rule of thumb is to first upgrade the MCG, and afterwards upgrade the APs. You can only have one MCG per Network, but you can have multiple Networks each with an MCG, and thus have multiple MCG clusters per Organization.

rhbirkelund · ‎Nov 14 2025

In that case I believe the last resort would be to reach out to your local Meraki AM/SE.

rhbirkelund · ‎Nov 13 2025

Perhaps try and hit the Local Status Page? https://documentation.meraki.com/Platform_Management/Troubleshooting_and_Support/Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#MS_Series_(includes_CS_Catalyst_Meraki-Managed_mode_Pre-IOS_XE)

rhbirkelund · ‎Nov 13 2025

What is the access grant URL that the Unify Controller redirects the client to, once authenticated?

About rhbirkelund

rhbirkelund

Community Record

Badges