IGMP proxy (for multicast) I'm curious on your use case for this. Hardly ever see multicast used in most environments. ... View more

@tmontano wrote: I have an MX65 and i would like to setup 700 computers connected through DHCP. How would i do this?  That's a lot more clients than is recommended for that model. I would suggest upgrading. Also, as others have pointed out, you can't do that in a /24. I'd recommend either creating multiple VLANs on /24s, or one /22. ... View more

Pretty sure the UAP-AC-LITE only supports passive PoE native. It "supports" 802.3af through the use of a proprietary Ubnt injector. ... View more

Security should always be your focus - we ALWAYS change defaults. Edit: If you don't set a password, it is the serial number of the device. So not exactly blank, but weak. ... View more

@MRCUR: Completely agree. Our ISPs offer us IPv6 and it would be great to offer it as well. ... View more

@MOT wrote: @DCooper, The support engineer responded: "Unfortunately, the disable mesh feature simply stops the APs from meshing, but will not stop the broadcasted traffic. This is not a bug but would actually be a feature request. If you have any questions, please feel free to reach out to us again. " I'm actually okay with this response (in *my* case) as long as these wireless interfaces with WEP are not attack surfaces from which a malefactor can snoop, do something malicious or cause a denial-of-service to either the data plane or command-and-control. I don't want an attacker to pivot. I really love my Meraki products, hence, I'd love for them to be as secure as possible, too! I'll also PM you. Most sincere thanks! -Mike It is a problem though because 1mbps/6mbps SSIDs take up a HUGE amount of airtime. In a dense environment, that's a bummer. ... View more

@MerakiDave IPv6 WAN support is really what is needed on our side. All of our upstream providers offer it. While we don't really have any plans for IPv6 port forwarding or anything like that ATM, offloading traffic to native IPv6 is just part of being a good netizen. We also like to support the broadest range of connectivity options we can. ... View more

@pjc What firmware version are you on? I'm not seeing it on my networks right now. But like that article, it could be possible when turned off the beacons only go out sometimes. ... View more

@PhilipDAth Aha! That makes more sense.   @iamHueMan Well, in that case, lots of data was lost in the S3 loss a while back - any chance the MSI you have predates that? Some of the files we had "looked" like they were OK, but weren't when we tried to access them. ... View more

@iamHueMan wrote: MSI is uploaded in Meraki cloud storage.      What do you mean by this? We deploy the Meraki SM via group policy with the MSI without any issue. What tool are you using to deploy it? ... View more

The WEP SSIDs are the AP to AP communication for the meshing. It uses a 1mbps/6mbps per band (2.4/5) signal, which is kind of a bummer because that takes up a LOT of airtime. If you have meshing turned off, it is supposed to disable the SSID from being broadcast, but for a while it wasn't. It may have been fixed by a firmware upgrade, I haven't looked in a while. Even though the communication is just some basic info about the mesh, WPA2 should really be used and not WEP. It's possible there is an attack vector in there yet to be undiscovered, but with such a weak keyspace, it would be pretty easy to start looking. Edit: I'm pretty sure the data within the mesh communication is encrypted, but, still.   TLDR; It's the meshing communication between access points.   As a side note, there really isn't much different in range between access points (even between vendors). They are all locked to a maximum output RF strength. The difference is probably in the antennas - the MX65W whip antennas probably work a bit better in your environment than the integrated radio on the MR32. You can view the RF coverage charts from the documentation to show how each AP/antenna type distributes the signal. The mounting plate also has a 5% or so reduction in signal going that way, so YMMV. ... View more

@PhilipDAth wrote: To exploit Meltdown or Spectre you have to be able to run code on the platform.  Embedded systems, like Meraki, provide no way for you to run any code on the paltform except their own - so they are not affected.   These vulnerabilities are all about rogue code stealing data from another process running on the CPU.   I doubt anyone will be able to detect this until an active exploit exists, at which time a signature will be able to be created to match the exploit. True, but it is probably technically possible for someone to create a malformed packet that might bypass protection checks. Likely? Not at all. But probably possible. ... View more

@Lia wrote: Wondering if anyone has done this before and can offer some tips on how to implement a solution...Here's our situation..   We're mainly a Mac shop with maybe 10-15 Windows users We have our MX32 units set up to use RADIUS and user authentication Mac machines are not domain-bound  What we need to do: Prevent all non-company devices from connecting to our corporate/internal wifi What we've looked at: Attempted to block MAC addresses on the RADIUS policy side but Apple does not have a set range of MAC addresses for each of their products Attempted to use Meraki's "apply group policies by device type" setting but failed miserably -- when we tested by blocking all iPhones and Androids from our corporate network, Meraki started flagging all phones and some macbook pros as iPhones and blocked the company laptops from connecting Swap to machine authentication instead of user auth -- cannot do this because the Macs are not domain-bound and can't simply use certs from our CA Swap to machine auth by using Meraki's System Manager -- cannot do because cost and management doesn't want to do anything that cost money.... Only options I see but have not tried: re-bind all Mac clients to the domain and configure machine auth with our CA Set up a SCEP server to hand out certs to perform machine auth since Macs are not domain-bound If any one has done something similar, could use some pointers.  Meraki Systems Manager is what I would use. The "apply by device type" will not work as it is quite inaccurate as you saw. SME licenses when purchased from a good VAR should be around $30-$40 per 3 years per device, which shouldn't be that much.   Not an Apple guy, so unfortunately I don't know much about RADIUS options for Apple. ... View more

Not a Meraki employee - but my opinion is doubtful it could be exploited. Meraki has never publicly commented on the CPU inside the MX series (other than stating once that it was "x86 based") that I'm aware of. I thought some of the older models were ARM or custom ASIC, but they might indeed be x86. At the root of this issue it is basically a memory leak/exploit. The MXs (and the rest of the product lines) run a modified version of Linux, so a patch should be available. As for #2, no. Just maintain good patching hygiene as patches are available for Linux, Windows, and OSX. ... View more

@AdamS wrote: Very nice shot, but may I suggest the framing would be better with some MS425's under that ;-). Looks like an HP 5406zl. One of my favorite switch chassis! Now if there was a Meraki switch chassis....wow would that be legit! ... View more

@nikiwaibel wrote: i have to post my statement on this threas also: pls no PTZ. a hi-res 360 will do (PTZ can be implemented fully digital - i am sure that will save quite some $$$). How can PTZ be implemented fully digital? Zoom, sure, but not pan and tilt. ... View more

@Mr_IT_Guy: Are those dual MX400s? Hate you a little bit. ... View more

@tnight   Wow! Thanks so much for the recognition. Meraki has truly transformed our business from an IT perspective. The WiFi we had in place before I came on-board was your typical terrible hotel WiFi - slow, awful signal, bounced every few minutes. Not the type of service you want when offering $500 a night suites. With Meraki, gone are the days of "rebooting the modem" to get a few more people on. 2,000 concurrent connections? Not a problem, bring it on!   @CarolineS: Thanks for making such a great community and inviting us to be a part of it. Really a lot of fun here helping other users and seeing how other businesses have deployed Meraki solutions across the world! ... View more

@Lia wrote: ours is so screwy and it's gotten so bad...we tried to use the apply policy by device type feature in meraki. All hell broke loose because Meraki was flagging all our devices as iPhones....turned that crap off real quick. Flagging the device as inaccurate doesnt do anything. Reached out to Meraki they told us Meraki determines a deice type based on the HTTP GET request it sends to clients.   Asked what our options are to get this fixed since we're trying to block personal devices from our network. They just said to try and upgrade to the latest beta firmware because the feature "MAY" have been improved. Doesn't really inspire much confidence when the support isn't 100% sure what's what and asking you to run a beta firmware on production systems...but okay...i guess?? It's also LLDP. But yeah, it's not particularly accurate. ... View more

 @CarolineS - next time I'm in the city, for sure! ... View more

@BrothersTM wrote: Spring of 2016 I ripped it all out.  I mean all.  New switches and about 400% more ap's, new fiber between closets up from 1Gb to 10Gb, new racks, new cat6 cabling...color coded I might add.  Yellow is voice, white wireless, green data, and red security cameras.  I've included a Google Drive share below to view all the pics I have so far.  We had a new construction so you'll see some of those as well.  The end result is night and day and much easier to manage.   Before and After pics   Since the upgrade, I have added some 1U blanks for air flow management and it just looks nicer.  41 MV21/71s at the new construction.   Boooo MMF. But seriously, that's some excellent work. I've always wanted to do color coding for patch cables... ... View more

Is this little museum thing in the 500 Terry building? How have I never seen this when I've been to the office?! ... View more