I used this is a splash page that I've have setup,   <input required name="username" id="username" style="width: 300px" type="email"></input></p> ... View more

Hello,   I have also same issues., we are using meraki switch and connected to sonos music systems, but sosnis is not working, i have made as bridge mode.after that also same issue ... View more

Would just like to "bump" this. Because its really annoying for some customers, who do not have API knowledge, that they cannot just download "all" , or for a given time, only the 30 lines. I mean, all the data is there, its just an UI change that should be fairly easy for Meraki to do. So its kind of crappy atm. I wish .... I guess....  ... View more

Thanks for the great news @Sakul ! My systems are built with V2 and will try V3 on next system. ... View more

WPA3 is there since a few times but no support for WPA3 and 802.1x with Meraki Cloud Authentication ! Is there any plan to support it ? Thanks in advance. Nicolas ... View more

I have not integrated Webhooks with Solarwinds but it's possible.  Like I said, you will need an intermediary to ingest the webhook and take the appropriate action in SolarWinds.  That intermediary can get the webhook then decide what to do with it in Solarwinds.  Then it can make an API call to Solarwinds to update it.  There is no direct integration via Solarwinds. ... View more

@colinster We might just do that. I recently posted this:   https://community.meraki.com/t5/Wireless-LAN/WLAN-speeds-suddenly-became-erratic/m-p/91249#M13427     I think reflecting on this thread might have given me the answer to what was going on.   At one point in the last month or so I created a new RF profile which removes UNII-1 ranges. I applied this profile to two of the affected three stations. The plan had been to integrate a point to point Ubiquity shot which uses UNII -1 and I didnt want our Meraki stuff stepping on its toes. That ended up not happening (we found another solution) but in the meantime developed the problem in the above thread. What I didnt realize and now gather was that DFS prevents the use of some of those middle channels, so effectively there was some co-channel interference at 80mhz with UNII1 off limits. We changed to 40mhz channels and reenabled UNII1 on all APs and the speed issue seems to have disappeared. I think we could probably reenable 80mhz channels but I dont think it will make a huge difference for us in terms of speed as I cap WAN bandwidth at 150mbit and we aren't sending a lot of big files that would necessitate 80mhz wide channels. Does that all make sense to you? ... View more

@Stuggi wrote: I've been quite behaved recently, but in my younger days I had a bit of a hobby of reading the newspaper and seeing if I could find anything that could be used as material for WiFi naming. Say evil mega-corporation was in the papers, I'd add an SSID "EvilMegaCorp Guest" or something. It usually took around 3 days before my neighbours in the apartment complex started talking about how EvilMegaCorp had plans for opening an office in the neighbourhood.  Haha that's awesome!   I actually recently created a new SSID:     It basically translates to "#StayAtHome😷"   ... View more

This is helpful! Thanks! ... View more

RADIUS Logs are often important to debugging an authentication issue, so I would recommend collecting those as well. With RADIUS Accounting you can get IP address as well. You might also want to look into Webhooks for the Alerts notifications. These are important, and not always in the syslog, and most customers use email to send alerts, but using Webhooks let's you log them! Why are webhooks and syslog different?! It seems odd at first I know. Webhooks are alerts from the Meraki Cloud "controller" while syslog is the hardware device sending it's logs, so they are two different sources. Syslog is not "secure" and therefore only offered over your internal network, not to a public IP address. Can you get them all from one source? Yes, technically you can get syslog from the Cloud as well, but it's not a stream it's an API REST call you would have to poll every X minutes. The Meraki Syslog is easy and reliable. Check out the documentation: https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP_and_API https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Alerts_and_Notifications https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Webhooks ... View more

Hello,   thanks for the very informative reply!   Yes my question was answered thank you. My questions were more theory based, I work for a service provider who has a variety of clients (hospitals, retail, agriculture etc) so there is a fine balancing act between security and functionality.    In my case (lab setup) the answer was to switch to bridge mode and use layer 3 and DHCP on the MX which is working well.   regards       ... View more

I would recommend building and hosting your own custom captive portal. You can do this for free and host it on GitHub Pages. Rather than read the documentation.meraki.com material, I would recommend developers.meraki.com for more information. Here are some example guides, step-by-step to build your own fully HTML capable splash page:   Open Source projects by Meraki: https://developer.cisco.com/meraki/explore/#usecase=Guest%20Wi-Fi More code examples by Meraki on Code Exchange: https://developer.cisco.com/codeexchange/platforms/meraki#search=splash&view=grid   If you and your friend are new to this, I'd strongly recommend the Captive Portal Learning Lab: https://developer.cisco.com/learning/modules/getting-started-with-meraki/meraki-04-captive-portal-python/step/1 ... View more

Hey @smccloud1 I don't believe this is a Meraki bug, and I would look into issues with your RADIUS server.   1. I would take a look at your RADIUS server and see what authentication type you are using. Most likely it's a mismatch on the EAP method being used. There are two EAP methods, inner and outer, and the iOS devices don't always use the same methods as other devices.   2. There are several Meraki settings that could impact you. 802.11r, 11w, and several RADIUS settings that are hidden. Give Meraki tech support a call and have a packet capture of your 802.1X authentication ready for them. ... View more

Yes it is possible! The VLANs API endpoint is for the MX only. For MR, you must use the SSIDs API endpoint. Think of the Dashboard API as a mirror of the actual Dashboard. If you configure the VLAN for MR on the SSIDs' Access control page, it's going to be in the SSIDs API as well.   Here is the API call that you will need: https://dashboard.meraki.com/api_docs/v0#list-the-ssids-in-a-network   curl -L -H 'Authorization: Bearer <key>' -H 'Content-Type: application/json' -X GET 'https://api.meraki.com/api/v1/networks/{networkId}/wireless/ssids'   As @MerakiDave mentions, you can configure the SSID to use a VLAN or use AP Tags with VLANs. ... View more

Here's the proper solution! Meraki has MAC address filtering "built-in" because Policy settings are so easy. Meraki Policy settings are based on the MAC address. A lot of customers have this question.    There are multiple ways to use a client MAC address to authorize access on a PSK encrypted network. I'll order them easy to hard to implement:   Solution 1. Enable PSK and Click-through Splash and setup a Custom Hosted Splash page that authorizes based on MAC address.  https://documentation.meraki.com/MR/MR_Splash_Page/Using_a_Sign-on_Splash_Page_to_Restrict_Wireless_Access_by_MAC_address   Solution 2. Enable PSK and Click-through Splash and setup a Custom Hosted Splash page that authorizes based on MAC address. You should consider SplashAccess.com instead of building it yourself.   Solution 3. Enable PSK and add a firewall rule for the SSID blocking all access. Then use Meraki's policy settings to apply a whitelist policy or apply a Group Policy but just for devices requiring access.   Solutions requiring a RADIUS Server:   Solution 4. Enable PSK and Sign-on with my RADIUS server and configure your RADIUS server to authorizes based on a MAC address. Most RADIUS servers can do this.    Solution 5. Enable the new feature Identity PSK with RADIUS and configure your RADIUS server to allow specific MAC addresses. https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_with_RADIUS_Authentication   While the previous post accepted as a solution is still sort of correct, you can't choose PSK and "MAC-based auth" at the same time. But MAC based auth / MAB is not the only type of MAC based authentication/authorization. If you DON'T need a PSK, and really want "MAC based auth" you cannot use PSK. This is primarily used with Cisco ISE deployments for guest WiFi. However, I much prefer the built-in Splash page. https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_MAC_based_access_control_on_an_SSID ... View more

Wow, I learn something new every day. ... View more

I gotta give you credit though. I forgot you can add commas to simplify rules. I fixed my mistake after seeing your genius simplification. Also I expanded the solution to include all of entire private subnets, you know, just in case. 10.0.0.0/19, 172.16.0.0/12, 192.168.0.0/16  ... View more

  All MX models support a splash page that authenticates against a RADIUS server. Enable the splash page and set it to authenticate against the ISE RADIUS server. https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Configuring_RADIUS_Authentication_with_a_Sign-on_Splash_Page     The MX64, MX65, MX64W, and MX65W support access policies including 802.1x. You can point the MX to authenticate the ports against the ISE RADIUS server: https://documentation.meraki.com/MX/Access_Control_and_Splash_Page/MX_Access_Policies_(802.1X)     You can see the matrix of compatibility for MX on the document here: https://community.cisco.com/t5/security-documents/how-to-integrate-meraki-networks-with-ise/ta-p/3618650 ... View more

You are limited in what you can edit with the Meraki Splash page editor. You cannot change the forms easily as Javascript is limited in the editor. In my dashboard, I see the word "Email" not "Username" in my default splash page, so perhaps it's a language translation?   You have a few options: 1. Add text in the editor to describe what to do for your users. "Please enter your email as your username." 2. Build your own splash page from the open source projects and host it somewhere. Then set the Meraki configuration to use your Custom splash URL. Learn more about this on developers.meraki.com 3. Buy a splash page from a company like Splash Access. www.splashaccess.com ... View more

Yes, all other Wi-Fi access points and 2.4/5 GHz devices will be considered by the Meraki access points when choosing a channel. Typically leaving the Meraki on automatic (the default setting) will be the ideal setting. Nearby access points on the same channel will typically "share" the air time, nearby access points on overlapping channels will typically create noise and "interfere" with each other, and nearby access points on different channels will not impact each other.  If you'd like to avoid interference, you can manually assign channels per AP, or you can configure the Meraki RF Profiles to avoid specific channels.   For example, if you have an access point from another network (Meraki or not Meraki) using channel 36 and very close to your access points, I would recommend using RF Profiles to avoid channel 36.    https://documentation.meraki.com/MR/Radio_Settings/RF_Profiles#Channel_Assignment_Method   If you have a lot of access points overlapping with a lot of access points, a manual channel plan might help. https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Radio_Settings/Manual_Channel_Selection_and_Transmit_Power_Adjustment ... View more

I've dealt with this using a workaround for locations without an upstream firewall. Workaround: Apply a traffic shaping rule to limit bandwidth on port 53 and other ports that might be used by a VPN. Users attempting to bypass splash pages to access the internet over VPN will not likely use your network if they only get 100 Kbps. Real Solution: Use an upstream MX or other firewall to block VPN attempts on port 53. Make sure not to block your DNS server such as 8.8.8.8. Root Cause: When client devices connect to the MR they are placed in a captive portal policy and the MR firewall rules (L3 and L7) do not get applied to the client devices until after they authenticate with the captive portal. However the traffic shaping rules are indeed applied to clients, and you can limit the throughput of VPN traffic. Documentation error: In my testing, MR Traffic shaping rules are indeed applied before splash page authentication. "When splash page authentication is configured, captive portal strength settings take precedence over configured traffic shaping and firewall rules. This means traffic shaping and firewall rules will only apply after Splash page authentication has occurred successfully." Documentation Link: https://documentation.meraki.com/MR/MR_Splash_Page/Configuring_Splash_Page_Authentication_with_an_LDAP_Server ... View more