Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About The_Roo
The_Roo
Getting noticed
Member since Aug 29, 2021
Dec 21 2023
Community Record
29
Posts
2
Kudos
1
Solution
Badges
Nov 20 2023
12:22 PM
I have worked with Cisco catalyst since they first appeared, but I've only been working with Meraki for a while. One of the "Get out of gaol free" tricks Catalysts have is that if you are going to make a configuration change remotely, one that might cause you to lose your connection to a remote box, you can use the CLI command "reload in xx" where xx is the number of minutes/seconds till the box will reboot and revert to the initial (before you started messing with it) configuration. Meraki is very different...no CLI and no "write mem" to make temporary changes permanant, but still the same ability to cut yourself off from a box when working remotely. I'm thinking about things like changing the "allowed" VLANs on an uplink trunk and omitting the management VLAN...if the management VLAN is not permitted on the uplink the box can't phone home, and you will lose connection to the device because the device loses connection to the Meraki cloud? So here's the question: is there a command or capability within the Meraki hardware/dashboard which would allow me to have the box I'm working on go back to the configuration it was when I started messing with it? Then, if I don't cut myself off from the box, I could cancel the reload, and carry on with the new config, but if I lost the connection, all I have to do is wait till the box reloads and I'm back were I was before I started fiddling
... View more
Nov 13 2023
3:31 PM
You are right Ryan, I explained it badly: in actual fact the APs are "out of the box", and have all come up with aggregation enabled, which I understand is their correct default state. Some of the switch ports are aggregated (so the two ports on a switch or a switch stack that support an individual AP are aggregated) but I only got so far through the process of aggregating the ports (there's a lot of APs, so a lot of ports) before I noted that the state of the AP (blue diamond or not) didn't seem to have any relationship with the port aggregation status
... View more
Nov 13 2023
9:18 AM
The APs are all running with aggregation, and I've tried aggregating the two ports the AP connects to, but it doesn't seem to have had any effect. Its peculiar, in that it only affects some of the APs (a lot less than half), and they were all connected straight out of the box default, so you would expect them all to behave the same
... View more
Nov 13 2023
8:04 AM
I just put together a network with MS225 switches, to a MS425 core stack. I'm deploying MR57 APs and seeing a number of good APs in the Topology, but also a number of blue diamonds The diamonds, when hovered over, show they are actually repeats of the APs already there. This must be something to do with the dual ethernet links to the APs, but they are all in default configuration with only some of them doing this. Has anyone come across this before, and if so what is the fix? Thanks Roo
... View more
Labels:
- Labels:
-
Installation
-
Other
Oct 27 2023
12:09 AM
Thanks to you both, I was pretty sure I'd covered all bases...sometimes, you just can't win. Thanks for your responses. I have to mark one of them as the answer, even though you both give me the answer, so I'll give you both a Kudo and set the first answer as the solution. Thanks Guys!
... View more
Oct 26 2023
12:45 AM
I am trying to find a way to satisfy the need to authenticate clients on to a Meraki Wi-Fi network using certificates, where the customer has specified that the Authentication must not require additional (CA/RADIUS/etc) servers. I proposed System Manager, but the customer already has all clients enrolled in InTune, and it is not possible to run Intune and System Manager (both MDMs) together. InTune will not provide Authentication on a Meraki network. So I proposed Trusted Access which should run in parallel with InTune. The customer objected to the Administration overhead (he was looking at https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Trusted_Access_for_Secure_Wireless_Connectivity_-_User_Guide and commented "the enrolment process looks a bit user “unfriendly”, having to enrol yourself every X days on a portal" But from what I can see from https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Trusted_Access_for_Secure_Wireless_Connectivity I could just add all users to "owners" and avoid the unfriendliness. Has anyone any practical experience of using Trusted Access in this way? Thanks Roo
... View more
Labels:
- Labels:
-
Installation
-
Other
Oct 13 2023
8:36 AM
Hi GreenMan, That was my original intention, but they only told me today they already have InTune, and I don't know enough about it to say if it will co-exist with InTune, so rather than try to run two MDMs in parallel, I'm looking at alternative ways to work
... View more
Oct 13 2023
7:02 AM
Hi GreenMan, Following on from what you and alemabrahao said, I have been looking at this information: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Trusted_Access_for_Secure_Wireless_Connectivity It looks like doing the authentication and authorisation this way still gives certificate-level security, still uses SM licences, but should co-exist with InTune. Am I right, or are there other considerations I have ignored? Thanks Roo
... View more
Oct 13 2023
6:58 AM
Some interesting stuff in there. I will have a read of it....thanks!
... View more
Oct 13 2023
2:05 AM
A customer has asked if, rather than using Meraki System Manager to handle wireless client authentication, he can use MS Intune. I have no experience with Intune: from what I'm seeing on the Internet, it might be possible, but I can't be sure. I was hoping to use SM, but their wireless clients are already enrolled in InTune, so the other part of this question is (and I think I can guess the answer!) can the clients be enrolled in SM and InTune simultaneously? Any information would be much appreciated! Roo
... View more
Aug 22 2023
3:04 AM
I am trying to improve my understanding of System Manager and System Manager Sentry when used for Wireless Authentication. As I understand it, a corporate WLAN can be protected by dot1x and EAP/TLS by setting the WLAN's SSID to "802.1X with Meraki RADIUS" and any device that subsequently attempts to associate with the SSID will be authenticated by System Manager Sentry using mutual exchange of certificates. If there are no appropriate certificates on the device, the association will be blocked. If the device has the correct certificates, the authentication is transparent to the device user and association occurs. That seems straightforward, if I’ve understood it right. I also understand that, to deliver certificates to client devices, and prepare them to access the corporate WLAN I can create an "onboarding" WLAN (open security and only Internet access) by setting the Sign-On Method on the SSID to "System Manager Sentry". Then, when a client device is associated with that SSID, the Meraki system will interrogate the device to find whether it has been onboarded. If it has not, System Manager will prompt the user to provide on-boarding credentials, at which time certificates will be loaded and the device will be prepared to access the corporate WLAN. Again, that seems straightforward, if I’ve understood it right. But….there are a couple of things I can’t get clear in my head. I’m looking at a document “Configuring EAP-TLS Wireless Authentication with Systems Manager Sentry Wifi” The document mentions tag and profile creation, but I don’t understand how that works. I just can’t get my head round point 3, do I need to create tags and profiles, or does it happen automatically? Is there more to configuration than I mention in the first two paragraphs? Have I missed something critical. Thanks for any help Roo
... View more
Labels:
- Labels:
-
SSID
Jul 29 2023
2:25 AM
OK, I'm beginning to get this: I have a corporate SSID that will only allow enrolled devices on. because enrolled devices will have a certificate from Meraki loaded. Is it that simple? Then there is the enrollment process. I have been doing some looking around and I see that if I make an unenrolled device go to https://enroll.meraki.com/xxx-xxx-xxxx where the xxx number is one I get when I'm setting up my EMM network. I can take the device through through the enrollment process (possibly through an enrollment SSID) to positively identify it as authorised, at which point it will get the certificate loaded onto it. This enrollment process will use up an SM Licence. But...can you tell me if that is the process, or where I've gone wrong, and a bit more about tokens, I'm not sure about them at all 😞 Thanks Roo
... View more
Jul 26 2023
11:55 PM
Hi Karsteni Thanks for the comments. You wrote "The Tags are assigned in the Systems manager.", but I'm still unclear : by whom? I assume "by me" during configuration, and if so, how? I'm just not clear on the process of onboarding a device. It appears I have a secure corporate WLAN/SSID that will only allow devices with the right certificate onboard (and which must recognise the certificate offered by the network) to associate with it, but I'm unsure how the certificate gets on the device, and where Systems Manager fits in to this. I think I've got to configure a new network, of type EMM (Organization > Configure > Create network ). I've read that though I have multiple sites/networks that I only need one EMM, and that will manage authentication for devices whatever site they are at, but its the nuts-and-bolts of the process creating the EMM and onboarding the devices I've not understood. The answer is probably there in Meraki documentation, if I could just find it: I keep getting little parts from many different places but never the whole picture. Thanks Roo Thanks for any help you can give
... View more
Jul 26 2023
10:56 AM
I’m trying to use Meraki's inbuilt ability to use EAP/TLS authentication. I’m also using MR57 APs, which have Wi_fi 6 capability and will use WPA3 encryption. I’ve been looking at the document https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Configuring_EAP-TLS_Wireless_Authentication_with_Systems_Manager_Sentry_Wifi (and lots of others, thanks Dr Google!) and understand I must create a secure SSID (sl-corp) and an on-boarding SSID (sl-corp-on-boarding). I also understand that I must set the access control for sl-corp to Meraki Cloud Authentication and select Systems Manager Sentry WiFi: All good so far: From the above, I believe that devices attempting to authenticate to the SSID will only be successful after a mutual exchange of certificates with the Meraki system. But its the backend part of this I'm missing: how lo get certificates on the client devices and get them to recognise the certificates from ther network. The document goes on to say: 3.Select the device tags to be associated with EAP-TLS. This automatically creates a Systems Manager profile for the SL-corp SSID to use EAP-TLS and installs a client certificate from the Dashboard for each client (this profile will appear under Systems Manager > Manage > Settings). Note that wireless authentication settings should be provisioned from either the SSID side, as described in this article, or the MDM profile side in Systems Manager > Manage > Settings and not both. My questions are “where do the device tags come from?” What is described above seems reasonable: Systems Manager will look for a pre-selected tag on a device and when it finds the authenticating device has the right tag, it will authenticate that device with EAP/TLS. Is there a single good document that shows how to set up Systems Manager and make it work in some detail? There is an "sl-corp-on-boarding" SSID mentioned but I can'see how it should be built or how it should be used? I want to use Wi-Fi 6, so the WPA Encryption mode will be forced to WPA3. Are there any considerations or will that just work? Probably some newbie questions here guys, I’ve done .1x /EAP/TLS with ISE, and I know what I want to do with the Meraki, its just I don’t know how to do it! Thaks for any help Roo
... View more
Jul 17 2023
1:26 PM
This thread has some really good info and discussion, thanks guys, I'm still feeling my way with Wi-Fi 6 (obviously!) but you have all been a great help! Roo
... View more
Jul 17 2023
8:19 AM
Hi Alemabrahao, Yes, you are quite right, and he does actually have cards in the workstations that are specified for Wi-Fi 6, I should have said in my write-up. I'm at the point where I know moving to Win11 will fix the problem, but I'm interested in other's experience when they hit this kind of situation and there was going to be a delay before Win11 would be an option. Thanks Roo
... View more
Jul 17 2023
7:27 AM
I have just rebuilt a network, replacing old EOL Wi-Fi 5 Aruba APs with Meraki Wi-Fi6-capable CW9166 APs. The 2.4 and 5 GHz works fine and is in use. The 6GHz looks fine on the Ekahau survey and the logs are running clean. However, the customer is saying that nothiong will connect to the 6GHz, which is not unreasonable, I only put 6GHz on his corporate wireless, and all he has to connect are a bunch of Win10 PCs. I know there is an issue where, to get Win 10 to connect to 6GHz, you have to down-grade the Wi-Fi driver, but I'm wary of doing that, for two reasons: 1 - its an outdated driver, so may have weaknesses and 2 - He's going to go to Win 11 in the next couple of months anyway, so any effort will be wasted. All that notwithstanding, are there any quick and simple fixes I can do, that don't involve messing with driver regression, that have worked for anyone else in this situation? or am I making any inappropriate assumptions? Thanks for any thoughts! Roo
... View more
Thanks for the quick and succinct response! Roo
... View more
Jul 11 2023
1:09 AM
I know that it is only possible to aggregate ports across switches when those switches are physically stacked together using their stacking port. However...the MS425 has QSFP ports for stacking which are "general purpose" (sorta). If I have a pair of MS425 switches stacked with a 40 GbE QSFP+ CSR4 (Copper direct-attach 40GBASE-CR4 cables) will I still be able to aggregate ports acrosss those switches.....and a secondary question, "is that the right cable to stack MS425 with?" Apologies if the question looks basic, I'm a Catalyst engineer from 'way back 😄 Roo
... View more
Jul 4 2023
6:40 AM
Dude, I am SO with you on that one....been playing ISE since v1.3 (yes I am OLD) and it's a far superior system!
... View more
Jul 4 2023
4:43 AM
Well, that was a bit of a let-down. I had a debug session with the guy running the NPS. He made some changes which involved removal of the group policy and reinstatement and the whole thing burst into life (with Wi-Fi 6 and WPA3 disabled). So I then re-enabled WPA3 and Wi-Fi 6 and he again removed/reinstated the group policy and that worked too. I was remote from him, so I'm still not sure what he did to the NPS, but the biggest clue was that when he looked in the event log of the NPS server, he said there were no alarms showing, so the EAP failures the Meraki was showing were probably down to the fact that the NPS was just ignoring the AP messages and the AP was timing out. Once the Group Policy was sorted it was all OK, so it looks like the Meraki side was OK all along. It also shows that you can run WPA3 with NPS even though NPS only references WPA2. Bit of a wild goose chase, guys, sorry to waste your time but for what its worth, I learnt a bit about WPA3 and Wi-Fi 6 Thanks for all your help Roo
... View more
Jul 3 2023
3:01 AM
Here's what I got from the NPS, I've redacted in a fairly obvious way after the raw log went through https://iso.csusb.edu/tools/nps-log-interpreter ---------------------------------------------- NAS IP: "1SR-DC-01" Client Username: "IAS" Timestamp: 06/29/2023 12:35:22 Service: 1 RADIUS Server: "host/8203X.redacted.local" "redacted.local/Hardware/Laptops/Technology/8203X": "Aruba MAC Address redacted" (Note: incumbent wireless is Aruba, being replaced by Meraki) "Intel MAC Address redacted": : "192.168.110.2" "192.168.110.2": 0 0: "192.168.110.2" "wlan controller": : 19 : 2: 5 "Secure Wireless Connections": 0 "311 1 192.168.30.210 06/03/2023 13:59:54 190290": : : : : : : : : : : : : : : : : "Secure Wireless Connections": 1 : : -------------------------------------------- NAS IP: "1SR-DC-01" Client Username: "IAS" Timestamp: 06/29/2023 12:35:22 Service: 11 RADIUS Server: "redacted.local/Hardware/Laptops/Technology/8203X": : : : 0: "192.168.110.2" "wlan controller": : : : 5 "Secure Wireless Connections": 0 "311 1 192.168.30.210 06/03/2023 13:59:54 190290": 30 : : : : : : : : : : : : : : : : "Secure Wireless Connections": 1 : : -------------------------------------------- Several iterations of the sequence above, followed by several sequences of the below: ------------------------------------------------ NAS IP: "1SR-DC-01" Client Username: "IAS" Timestamp: 06/29/2023 12:33:20 Service: 1 RADIUS Server: "host/8203X.redacted.local" "redacted.local/Hardware/Laptops/Technology/8203X": "Redacted Meraki AP MAC:redacted Meraki SSID" "Redacted Intel MAC Address": : "Redacted Meraki AP MAC:vap1" "Redacted Meraki IP Address": 1 0: "Redacted Meraki IP Address" "Meraki AP's": : 19 "CONNECT 54.00 Mbps / 802.11ax / RSSI: 47 / Channel: 44": 2: 11 "Secure Wireless Connections": 0 "311 1 redacted-radius-server-ip 06/03/2023 13:59:54 190230": : : : : "CA3866B9CE2BA82A" : : : "D5B99E420436E168" : : : : : : : : : "Secure Wireless Connections": 1 : : -------------------------------------------- NAS IP: "1SR-DC-01" Client Username: "IAS" Timestamp: 06/29/2023 12:33:20 Service: 3 RADIUS Server: "redacted.local/Hardware/Laptops/Technology/8203X": : : : 0: "redacted-radius-server-ip" "Meraki AP's": : : : 11 "Secure Wireless Connections": 16 "311 1 redacted-radius-server-ip 06/03/2023 13:59:54 190230": : : : : "CA3866B9CE2BA82A" : : : : : : : : : : : : "Secure Wireless Connections": 1 : : --------------------------------------------
... View more
Jul 1 2023
3:09 AM
2 Kudos
This discussion is helping me to crystalise my thoughts about this, and I believe Philip's point above is right.....the log from the AP shows an authentication attempt, so the supplicant is able to talk to the AP (authenticator) OK. That exchange is the only one protected by WPA3, the conversation between authenticator and the NPS is carried out using EAP, not WPA3. No, it looks now like the conversation between the AP and NPS is where the problem lays, so I'm going to do as I suggested above and get an NPS log, and hopefully sort out what is going on. Keep the thoughts and suggestions coming, guys, this has been a real useful session! Roo
... View more
Jun 30 2023
1:40 AM
I'm setting up a new Wi-Fi network with RADIUS authentication. It will have 20 Meraki CW9166I APs installed on an existing Cisco switch network, with known good DHCP and DNS services. There is already an NPS in place, and having entered the NPS address and credentials into the AP, the RADIUS test provide by the AP communicate with it correctly. When used by authenticators other than the Meraki AP, the NPS authenticates known PC clients and allows them onto the network, but when the Meraki uses the NPS, I get this in the log: Now this is a Wi-Fi 6-capable AP but there is a statement on the dashboard: "This SSID will not broadcast on the 6 GHz band. Use WPA3 to enable this band." During limited testing time, I set the AP to use WPA3, but I'm concerned that the issues I'm seeing are due to the Authentication conversation being trashed because the AP wants WPA3 and the PC is using WPA2. This would be made clearer if there was a document that covered the latest APs....the most recent document I have found is https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise which only talks about WPA2....is there a more recent document that covers the latest APs and encryption? Thanks Roo
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 1100 | Oct 13 2023 7:02 AM |
© 2024 Cisco Systems, Inc.
