Meraki

simonsabato

Hi folks! (OP here) Thanks for the very helpful discussion. FYI, I went ahead and spun up the 9800-CL, joined my AP to it, and converted it to Meraki. Worked like a charm. This was quite the welcome from the Meraki community! My story -- our small company of ~20 moves into our new building in two days (Mon). One week before the move, I asked about Wifi, and was shown 3x Meraki MR42's the priors hadn't bothered pulling down, years ago. I doubted we should, or even could, use them. Choices were limited for getting new devices in time, so I ordered 9164s w/ 3-year Meraki license, to arrive on move-in day itself, but luck bestowed one a few days early. It arrived Thu -- incompatible, with ~3 days to fix it. Official support channels just weren't gonna cover this, not in the time I had. I was told to purchase 9800's, offered to migrate my DNA license to Meraki, offered to take back the Meraki license and sell me DNA instead, etc. 🙂 THANKS to this group, that AP was installed and working today (Sat), and I still get Sunday off. Respect! 🙂 --- IF you are reading this in search of help on this path, here's my steps (links are below). I ran the 9800-CL on Ubuntu on Dell laptop. KVM/virt-manager via the qcow2 image and the "installing with linux bridge networking" script taken from Cisco 9800-CL install guide (links vvv). Virtual bridge to connect the VM to the laptop GigE port to the AP via PoE switch. Only place I got stuck was when I hadn't properly setup the 3x virbr as per the Cisco script, where you fill in <network name>, as I fumbled getting that working, it would fail in an install script loop, without really explaining what the issue was, at least for me. To setup the WLC, I used the "Day 0 CLI Wizard" (link vv) because I like CLI, but at step ~6 where it says "you can do the rest in WebUI", I switched the webUI and didn't do anything except the bare minimum to add the AP, wait for it to connect, then switch to Meraki mode. Cisco provides a 5-pager PDF (link vvv) on how to do it, once you have AP connected to WLC. Give every step time, esp the switch to Meraki, it will reboot a few times. Seemed like forever -- half hour? -- from clicking convert to having it show up on the Meraki cloud. And ~1 day for a "country mismatch" warning to clear. The hardest part for me was setting up networking such that the VM could see the AP, consider your comfort level in that area and/or budget time to iterate on it!! 🙂 (I spent ~1 hour on that, and 2-3 on the whole process) https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/9800-cloud/installation/b-c9800-cl-install-guide/installing_the_controller_in_kvm_environment.html#id_89856 https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/9800-cloud/installation/b-c9800-cl-install-guide/booting_the_controller_and_accessing_the_console.html#Procedure_Using_Cisco_setup_Command_Facility https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/migrating-dna-to-meraki-mgmt-mode.pdf

AxL1971

The only devices that will be connecting on the 6Ghz spectrum will be corporate laptops. Lenovo Thinkpad's that are at most 3 years old. Some will have the older AX201 chipset and some the newer AX211 chipset that supports 6Ghz. We only allow non corporate devices/IoT on the 2.4 Ghz.

PhilipDAth

Others have already hinted at this. Personally, I would first start with your RADIUS server. Did it deny or allow access? If it denied - why does it say it denied access. Fix that. If it allowed access, check out @rhbirkelund 's comments. If it is allowed and still not working, update the WiFi drivers. Go to the actual WiFi NIC manufacturer's website (such as Intel, Broadcom, etc) and not the manufacturer of the machine (such as HP, Dell, etc). ps. If you are using Microsoft NPS, filter the security log on the NPS server for Event IDs 6272 and 6273.

rhbirkelund

About time. 😉

rhbirkelund

While it's a C9300 Cisco switch, and the supported SFP matrix from Cisco, says yes, I'd still rely on what the Meraki Datasheet says. This is to ensure support from Meraki, just in case. The C9300X-24Y-M datasheet says that it supports 10G twinax. https://documentation.meraki.com/MS/MS_Overview_and_Specifications/Catalyst_9300X-M_Datasheet If possible, I'd go with the Meraki SKU, so ensure compatibility and support.

KarstenI

Mist was also quite late with Wi-Fi 7. I think Ruckus was first, but Extreme also says they were first to market. Yes, Ubiquty and the HO devices like TP-Link also came early.

ww

Once you set the good mx as primary, and the bad/down mx as spare. There is a pencil icon behind the spare. You can change the serial of the spare if you click it

rhbirkelund

You should be able to do so already, without RBAC. Go to the Switchport that you want your employee to be able to manage and tag it e.g. Facility. Notice the tag Facility in the screen shot. Then go to Network-wide -> Configure -> General Under port management privileges you can configure the tag to be used for port privileges. Then on Organization -> Administrators, you can create your employee as an administrator and target the employee to a network and select the tag Faclility. From then on, your employee should only be able to access ports only assiged Facility tag. Maybe he can view other ports - I can't remember. But he will not be able to edit ports that are not assigned the Facility tag.

hmc250000

I like your creativity, but this can potentially become quite an ordeal to manage which I would want to avoid. Just to mention a few, monitoring and zscaler, could make it a mess.

Rhyskil

I originally had the issue that this fixed back in December, but was told by support it was a fault with my connections (despite being two different carriers on two different networks happening at the same time). Was semi-relieved to see I was only being gaslit, in that there was a firmware patch addressing this exact issue. Upgraded, ran fine for two weeks, but having the uplinks briefly spike in latency / high loss for the last week again, 3 times just this morning. Issue's not fixed.

JaideepKukunuru

Please note that - we are working on couple of flexible licensing options for General Availability (GA) to meet the diverse needs of our customers. Advanced license is one of the options. We will provide more details soon.

MK2

Does anyone know what makes the MTBF times between the MS130 und MS150 so different? When comparing the MS130-48P vs MS150-48FP-4G, the MS150-48FP-4G has about 3 times higher MTBF rate. Are these values okay to present it to customer?

PhillipJFry

Switchport is configured as a trunk allowing all vlans at the moment.

rhbirkelund

Good luck with the song and dance with Management. 🙂

Hannah-C

@RaphaelL Hello! Thanks for chiming in about the VPN Status Page. Looks like those changes to the "VPN Registry" information were rolled back on January 29th and replaced by more recent updates (made today). @rhbirkelund Thanks for pointing this out updates on the Meraki Campus LAN; Planning, Design Guidelines and Best Practices page! The most recent changes made on January 15th were to correct 3 broken links. No text or policy changes were made to the page. I hope this information helps!

RWelch

ManageEngine OpManager Plus Welcome Zoho Corporation to the Cisco Networking App Marketplace!

PhilipDAth

The 34 credits for DCAIE is huge. I have signed up!

shlomoi

working!!!! Thank you very much

sinelnyyk

Hi @James2050 , @cavementech1, Process of converting C9300 from Meraki to DNA/CLI managed mode is pretty quick and should take no longer than 15 minutes on call, but it can only be done with the help of Support. Once you created the case and called Meraki Support, the agent will verify your support passcode and initiate the migration, which will then take up to 300 seconds for selected switches to start migrating. Once initiated, the migration process cannot be stopped via Dashboard or SSH, and should not be interrupted. Also be cautious of the fact that migration will factory default the switch and all configuration.

GreenMan

Every Meraki device is managed by the Meraki Dashboard. What I think you're getting at though; the built-in wireless of an MX64W (the W bit) is separate from the wireless provided by any MR Access Points. Even if you place the MX and the APs in the same Network, the setups are configured via different menus and will not interact with each other. You could, for example, configure an SSID on the MX (via Security & SD-WAN menu) and an SSID with the same name on the APs (via Wireless menu) but the APs and the MX would not co-ordinate channel and power settings (AutoRF), nor would a client device roam seamlessly between the MX and the APs. It should be noted too that the WiFI capabilities of the MX6xW are significantly less sophisticated than any of the dedicated APs shipped in the last half-dozen years.

ggatten

Exclude Uplinks

rhbirkelund

Bridge mode, or configure your ISP router to open or forward 2223 to your MX.

mrjelly

What I mean is the way of looking at the firmware notices you put forward. That this is the base version across the dashboard, rather than upgrading a physical device.

Nigel_MC

Hi @rhbirkelund, @KarstenI, and @PhilipDAth, Thank you all for your valuable insights! I really appreciate the time you took to share your recommendations on how to best connect and secure the MS130-8. I wanted to share our planned approach based on your feedback. Planned Changes for Securing the MS130-8 1️⃣ The MS130-8 remains a managed WAN switch (no changes in hardware). 2️⃣ Local Status Page will be disabled by default for security. 3️⃣ Emergency access to the Local Status Page will be restricted to a single port on a dedicated Management VLAN 4️⃣ Firewall rules will be put in place to restrict management access, blocking unauthorized traffic from other VLANs. 5️⃣ Meraki Dashboard connectivity is currently routed via the internal network, but we will first check if we have spare public IP addresses available before deciding whether to assign one. Thanks again for your valuable input—I truly appreciate the expertise and best practices shared by the community!

BouncyRabbit81

Hi mate, Yep, been there, despite what that reddit article says, they do document (now at least) that they use DES here - SNMP Overview and Configuration - Cisco Meraki Documentation. No dice following this so far.

About rhbirkelund

rhbirkelund

Community Record

Badges