Meraki Community

chrissw · ‎May 26 2021

We have an answer from Meraki support. It is Cisco ISE causing the non-availability of 802.11r. Apparently because RADIUS CoA is enabled by design when using Cisco ISE for authentication, this disables 802.11r. According to Meraki, "due to CoA...we need to do a full authentication on every roam in order to apply the policy." Moreover there is no way to disable CoA. So if you're using Cisco ISE for authentication, you can say goodbye to 802.11r. Which isn't a good look, given that these are two Cisco products. This is going to cause us significant difficulties.

chrissw · ‎May 24 2021

Thanks but I've read that bit of documentation, and I know where the 802.11r option should appear (see below). Is a firmware update required from 27.6? Perhaps someone from Meraki can answer that. What is more strange is that an SSID with PSK authentication does have 802.11r available as an option. Also my own test network, which has 802.1X-enterprise authentication against an open source RADIUS server also has 802.11r available. I cannot work out what it is about our use, in production, of authentication against Cisco ISE, which backs off to Windows AD, is preventing 802.11r from even being available.

chrissw · ‎May 21 2021

Sorry I should have mentioned that we are using bridge mode. We never use NAT or L3.

chrissw · ‎May 20 2021

Late response, sorry: I got on the 28.x early adopters and installed it on the APs but it made no difference; still no IPv6 over mesh.

chrissw · ‎May 20 2021

Hi all, We have an SSID (broadcasted) using 802.1X enterprise authentication by user client cert against Cisco ISE/Windows AD. APs are MR52 on version 27.6. The option to enable 802.11r does not appear on the SSID settings page. It does appear on, for example, and SSID with PSK auth. Can anyone suggest why the 802.11r option is missing? Is there something I'm not understanding here? I thought 802.11r was supposed to be of benefit where such authentication is in use, in order to avoid a full de-auth and re-auth by clients when they roam. Currently we are experiencing delays with clients getting re-authenticated on this SSID. Sometimes users are saying that they have to disable and re-enable wireless on their machines in order to get them to reconnect, and sometimes even reboot.

chrissw · ‎Apr 21 2021

I have 3 MR52s on 27.6. One of them is connected to the wired network and it gets an IPv4 address from my DHCP server, and a valid IPv6 SLAAC address, so it's clearly seeing the router advertisements. The other 2 MR52a are meshed to the wired one. Any wireless client associated with the wired MR52 gets an IPv6 address from DHCPv6 (same server as DHCPv4) and IPv6 works just fine for such clients: they can access resources on the LAN over IPv6 and on the Internet. Any wireless client associated with a mesh MR cannot use IPv6 even if I assign them a static IPv6 address. Actually it's slightly more complicated than that: a client on a mesh MR can ping internal resources with IPv6 but that's all they can do; for example I can't SSH over IPv6 from a laptop to another machine. If I want to do SSH over the mesh I have to specify ssh -4. The ping reaches the destination device: tcpdump on the destination shows it. SSH does not reach the destination. This is the case for multiple pairs of devices, and is true in both directions. IPv6 bridging is definitely enabled network-wide. So it seems that if you want to do anything other than ping with IPv6, you and your destination device have to be either wired or associated with the mesh root. I didn't have this problem with Cisco Aironet. It just didn't arise. Is this normal behaviour for a Meraki mesh?

Meraki Community

About chrissw

chrissw

Community Record

Badges

Re: 802.11r not available for an SSID

Re: 802.11r not available for an SSID

Re: 802.11r not available for an SSID

Re: IPv6 over wireless mesh not working

802.11r not available for an SSID

IPv6 over wireless mesh not working

Re: 802.11r not available for an SSID