About DCooper

DCooper

Are you using the router for anything other than the 4 VLANs? Voice services?

DCooper · ‎07-06-2018

Guard Interval = GI - SGI/LGI is not configurable on Meraki. We do not publish our chipset's and capabilities. I will give you an example on an older common radio, Atheros AR92XX radios or older only support short GI on HT40 & not HT20, so max HT20 rates are 65 Mbps/130 Mbps/195 Mbps (1x1/2x2/3x3) instead of 72 Mbps/144 Mbps/217 Mbps. This information is public.

DCooper · ‎06-28-2018

There have been ongoing APNS issues (checkins, devices going offline and a bunch of other issues) that have affected multiple EMM vendors. We are actively working with apple on this. We just pushed out some new changes this week that should help us in troubleshooting these issues. I would advise you open up a case with our support so we can track it appropriately and notify you when fixes are applied.

DCooper · ‎06-27-2018

@fjulianomObviosly the client gets a warning and must accept since doesn't have the certificate, but the client also gets a warning in case EAP offload is not used and it doesn't have the RADIUS certificate. - This is only obvious when you don't have it setup correctly. When setup right there is no accepting a certificate from the client, I made the assumption this wasn't the case. Makes sense now that your having the client manually accept the cert. Most people do not set it up this way for two reasons, security and they want it to be seamless to the end user. To make it seamless you push the server cert out to the clients via GP so they do not get the message your referring to.I can elaborate more on security but just keep in mind quite a bit of malware uses the same techniques on accepting a unknown cert. This is why most browsers have built in mechanisms to protect against certificates expired, unknown, etc. If your clients are used to accepting the certificate and ok with it then the process doesn't change when you go to EAP offloading and don't push each APs cert out. If you did not want the clients to accept the certificate you could export all of the APs certificates and push them out. Microsoft - https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/wireless/a-deploy-8021x-wireless-access See- To successfully authenticate the NPS, the client computer must trust the CA that issued the NPS certificate. The client trusts this CA when the CA’s certificate is present in the Trusted Root Certification Authorities certificate store on the client computer. If you deploy your own private CA, the CA certificate is automatically installed in the Trusted Root Certification Authorities certificate store for the Current User and for the Local Computer when Group Policy is refreshed on the domain member client computer. If you decide to deploy server certificates from a public CA, ensure that the public CA certificate is already in the Trusted Root Certification Authorities certificate store.

DCooper · ‎06-27-2018

@fjulianom Aruba controller imports the cert from the CA onto the controller to terminate the EAPOL process not the AP like your eluding to. Meraki APs do not have a controller to import to, thus the comment I made.Your not going to be able to use the Aruba issued cert from aruba on a AP to terminate the EAPOL process your Radius/PKI infrastructure. I think your getting the AP/controller communication based certificates mixed up with EAP offloading.

DCooper · ‎06-27-2018

@lpopejoyJust curious what Database are you dumping the data into?

DCooper · ‎06-27-2018

EAP offloading terminates the EAPOL process onto the Aruba controller. If we supported EAP offloading you would have to upload a certificate to every AP, which isn't scaleable. We do support Meraki authentication where we can auth PEAP/TLS from the cloud, TLS is done with Systems Manager and tags. https://documentation.meraki.com/MR/Encryption_and_Authentication/Meraki_Cloud_Hosted_Authentication

DCooper · ‎06-21-2018

GI is model specific. Atheros and Broadcom both have different GI support for different channel widths and MCS rates in the past.This means the GI would actively shift when you negotiated a different data rate. If you could, forcing a GI would pin data rates. IMO- I would change the design and add antennas to provide additional diversity before going down this troubleshooting path. Honestly, we rarely troubleshoot multipath issues anymore. I am not even positive this can be changed since it’s usually different depending on the model of chipset/AP running.

DCooper · ‎06-21-2018

Disconnect from the WiFi.

DCooper · ‎06-21-2018

Disconnect from the WiFi.

DCooper · ‎06-21-2018

Great news. Finally got the team to get it pushed out yesterday. See - https://documentation.meraki.com/MX-Z/Installation_Guides/vMX100_Setup_Guide_for_Microsoft_Azure#vMX100_on_Azure_CSP_Portal

DCooper · ‎06-21-2018

Great news. Finally got the team to get it pushed out yesterday. See - https://documentation.meraki.com/MX-Z/Installation_Guides/vMX100_Setup_Guide_for_Microsoft_Azure#vMX100_on_Azure_CSP_Portal

DCooper · ‎06-20-2018

It hasn't been published yet. If you know your Meraki Systems Engineer reach out to them and they can provide the workaround. Support may also be able to provide the workaround using the ARM template.

DCooper · ‎06-08-2018

There is a workaroud for CSP's now. The documentation will turned public at the link below within a week or so: https://documentation.meraki.com/MX-Z/Installation_Guides/vMX100_Setup_Guide_for_Microsoft_Azure In the mean time please call our support to gain the step by step on getting this working. There is a file that needs to be uploaded that support will provide.

DCooper · ‎05-10-2018

Sorry for you bad experience with Meraki sales. Can you PM me your contact information as well as the the relevant information regarding your referral so I can escalate internally?

DCooper · ‎05-08-2018

Netflow, radius accounting(basic) or pulling from the API(which would be a bit of delay but you could format time slices how you'd like) those are the only options beyond what I mentioned.

DCooper · ‎05-08-2018

Once you turn on detailed traffic analysis under network wide>general Traffic analysis a new tab will be under network wide> traffic analytics to see what your asking for.

DCooper · ‎03-12-2018

@Sweeks I was being a little facetious in my answer. :) In all seriousness, that Allen wrench is to tighten the screws on the clips for the t-rail. It should be little black screws that are already on the clips.

DCooper · ‎03-07-2018

PM me the info and I can get it to the guys that developed it the feature.

DCooper · ‎03-07-2018

@Marc_S Yes! It is called Meraki Now. Depending on the country the costs vary. When pricing out the service the location address is needed to make sure the requested SLA can be met. https://meraki.cisco.com/lib/pdf/meraki_now_solution_guide.pdf

DCooper · ‎03-06-2018

If you haven't seen the new Air Marshal page please take a look in your dashboard! The documentation on the new page can be found here:https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal

DCooper · ‎03-06-2018

You may have something wrong with the VLAN configuration on the ports? Please PM a link to your organization/network. Can you tell me which port the server is on and which device/port that is on VLAN 20 your trying to get an address from?

DCooper · ‎03-06-2018

Are you tagging an LAN port on your server? DHCP relay is a broadcast to the MX then a unicast when it does the relay to the server. If your trunking the same VLAN you have IP-helper setup for that would be your issue. You can choose one or the other, either trunk it or relay it but can't do both.

DCooper · ‎03-06-2018

Turn it into a access port to see if that helps.

DCooper · ‎03-06-2018

It has something to do with the security settings that are most likely changed via GP when you add the device to the domain. You can fix that.. or.. You can either follow the document below, make sure PAP only is checked and re-enter the PSK ,those are the most common issues. https://documentation.meraki.com/MX-Z/Client_VPN/Client_VPN_OS_Configuration If the PSK and PAP only don't work use the link to re-create the profile.

DCooper

Community Record

Badges