Meraki

Purroy

Are these clients using 2.4GHz or 5GHz? How busy is the channel? This could be caused by factors on the RF side. Also, wireless latency will never be the same as wired.

Purroy

This is covered in this article: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies#From_one_day_to_the_next

Purroy

You can create a Group Policy with a Schedule that denies traffic during the times that you want to block it. That Group Policy then gets attached to those clients.

Purroy

Having 5 different networks (with 10SSIDs and 10APs in each network) will result in a really bad solution. AutoRF works by coordinating transmission power and channel assignment with the APs in a single network. This design will severely break AutoRF and it is a bad design overall. For this scenario we have WPN which will solve the challenges that the customers on this type of spaces have and is a robust and secure solution. Friends don’t let friends do bad designs. Please educate the customer on why this path is a horrible idea and the benefits and simplicity of WPN.

Purroy · ‎Oct 18 2024

@cmr yes, you are right. I had a brain bubbu.... I will edit my answer to make it clear.

Purroy · ‎Oct 18 2024

Hello, No, you don´t need an external antenna if you want dual 5GHz radios. The 6GHz is an XOR radio that operates in either 6GHz or 5GHz, and it has its own internal antennas regardless in which mode it operates.

Purroy · ‎Oct 16 2024

No, that will actually have several negative effects. First, be careful when using rogue AP containment as this is not allowed in some countries. Second, it will have the opposite effect as the containment uses the flooding of deauth wireless beacons to the clients so it will severely increase the channel usage. Third, you might upset some of your neighbours. Honestly 2.4GHz is almost impossible to be used now a days and expect any type of quality, the most common recommendation is to actually disable it in your APs after verifying that all of your clients can run on 5GHz. I most environments this is possible. If not then disable 2.4GHz in about 2/3s of your APs.

Purroy · ‎Sep 24 2024

99% it will be an HP Direct printer that is connected to your LAN and its WiFi has not been configured or disabled.

Purroy · ‎Sep 14 2024

Yes, you can broadcast several SSIDs in a Mesh network. Those can go to the same or to a different VLAN (Mesh supports VLANs since MR28.x).

Purroy · ‎Sep 10 2024

I must agree, I particularly do not like transition mode. The answer to your question: - All of the MRs that you mention support WPA3 and WPA3 transition mode in SSIDs with Preshared Key, Passphrase or WPA3-SAE (however you want to call just having a fix password for the SSID). This is supported since version MR27. - For transition mode with 802.1x (radius) based authentication SSID you need to have MRs that are capable of running version MR31.1.1 or above. These are 802.11ax MRs so out of your original list only MR56 is capable of running this version.

Purroy · ‎Jul 21 2024

This is really a function of the Radius server that you are using. If the radius server is able to take into account both factors (MAC + AD account) when deciding to provide or deny access then yes. Windows built-in radius server (NPS) is not able to do that. This can be performed with more advanced radius servers, such as Cisco ISE or others. If what you are trying to achieve is that employees login onto wireless (AD auth) only with their corporate issued PCs then I would suggest to use Machine Authentication rather than username/password. With Machine Authentication the Radius server verifies with AD if that machine belongs to the domain. Then the user will be validated when they login into the machine. Assuming that this is a Windows environment.

Purroy · ‎Jun 21 2024

Check your native VLANs between all of your devices. They should ideally all match.

Purroy · ‎Jun 7 2024

Yes, Both 31.1.1 and 30.7 do have the fix. Pablo

Purroy · ‎Jun 7 2024

Hello, Firmware version MR30.7 has been released with a fix for this issue.

Purroy · ‎Jun 3 2024

You can open a support case so they can enable that use case in your network. But then you are responsible to set properly which MR76s are indoor and which ones are outdoor. By default dashboard assumes that all of the outdoor access points are installed in outdoors.

Purroy · ‎May 27 2024

Sure, that is exactly why this is done by support. As you mentioned this had good results on your first AP, I suspect the APs that were added to this version later on have not yet downloaded the correct image. Support can confirm this. Like you said if this is fixed in the firmware upgrade then you should move the whole network to the MR30.6 or current stable version at the time.

Purroy · ‎May 27 2024

Check with support to make sure that the MR36s all have downloaded correctly the MR30.6 version, sometimes this does not happen correctly. Also, why don´t you upgrade the whole network, not just certain devices to MR30.6. MR30.6 is the current stable image and it works great with MR33s and MR36s, you should strive to have your network in the latest stable image or close to it. Upgrading only certain units in a network is allowed for troubleshooting purposes but this is not intended or recommended to be done for normal operation.

Purroy · ‎May 22 2024

Also, please make sure you are running a Stable or Release Candidate image: Stable right now: Version 30.6

Purroy · ‎May 22 2024

I would suggest you open a Meraki support case to see why the devices are booting. This should not be happening?

Purroy · ‎May 14 2024

I have not tried this so I am not telling you this will work. But I think what you ought to do is send a Access-Accept with a URL redirect when a device MAC is not registered in your Clearness so they can register it. If it is registered then they just need to do a Access-Accept without the URL redirect. However, if this is for dorms or similar I would also recommend you check out the WPN solution based in iPSK. They can create those iPSK via API and a user portal.

Purroy · ‎May 13 2024

Hello, For the purpose you are trying to achieve I would not do the VLAN assignment based in Group Policies. I would override the SSID VLAN via Radius. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/VLAN_Profiles You need to send the following attributes from Clearpass in the Access-Accept Message: [64] Tunnel-type = VLAN [65] Tunnel-Medium-Type = 802 [81] Tunnel-Private-Group-ID = <vlan name> VLAN name is the name you configure in the VLAN Profiles that has the associated VLANs to it. Make sure you set the override option on the access control page for the desired SSID: With this you should be golden!

Purroy · ‎May 13 2024

En una renovación se puede renovar el numero de licencias de los dispositivos que se quieran mantener. No es necesario que sea el mismo numero de licencias que había anteriormente si algunos equipos ya no se usan.

Purroy · ‎May 9 2024

As per your pictures... You need to set the native VLAN on the port that connects to your AP (port 11) to VLAN 40. Keep it as trunk and put the native VLAN on that port to VLAN40

Purroy · ‎May 9 2024

Hola, Para automatizar la descarga de esa información lo mas adecuado es hacer uso de la Dashboard API. La documentación de dicha API esta en: https://developer.cisco.com/meraki/api-v1/ En concreto la llamada para descargar la lista de clientes por red es esta: https://developer.cisco.com/meraki/api-v1/get-network-clients/ Saludos

Purroy · ‎Apr 22 2024

Sure, if you disable Layer 2 LAN isolation then it should work as you expect it. You currently have it enabled.

About Purroy

Purroy

Community Record

Badges