That's the goal ... View more

According to the doc Meraki APs do appear to use TLS for RADSec.   And yes it appears ISE only support RADIUS over DTLS today and not TLS RADSec. Various docs don't seem to be all that clear on the topic. ... View more

Hey guys, I just saw a notification for an update on this thread, and thought I ought to come back and at least share my own findings since I started it!   The network I was working in whilst encountering this issue had a very unusual IP address schema implemented by it's creator many years ago, this being 6.x.x.x   Turns out, this is the IP address schema that Meraki are using on their back end for communication protocol between AP's and switches, and therefore, can't handle it as the LAN schema.   No resolution in this case, but we are almost done migrating this network to fresh infrastructure with a corporare aligned address schema.   Not that I imagine this helps anyone else, sorry! ... View more

I haven't seen this myself however I suggest you open a support ticket as it could be a bug related to templates like you said.  ... View more

on the network concerned, you need to create a new RF profile. You'll then have the 2 profiles generated by the template + the one you've just created. You associate your MR with this new profile (which you can configure as you wish, independent of the other networks and the template). and all you have to do is enable/disable the radio on the profile ID of the profile you've created (no impact on other sites) ... View more

Thanks for the responses and advice on how to make requests. I've submitted my 'feedback' requesting this functionality/feature. I appreciate this wasn't the correct location to make the request, but I was curious to see if anyone else would want it or not, even though I didn't ask if anyone else thought it would be useful. 🙂 ... View more

Thank you all for your replies. The interfaces/networks on the MX are more complicated than in the diagram, I just simplified it to try to remove any confusion. We have 5 different vlans/subnets, each with their own source-based route as the MX is also used to tunnel some wireless traffic, and the default gateway for each of these subnets is actually the router, which has those 5 interfaces/subnets on them. I think the issue is routing, but on the return of the traffic. If I disable all firewall rules traffic originating from 10.1.0.0/24 can get to 10.112.5.0/24, however traffic originating from 10.112.5.0/24 passes through the MX to 10.1.0.0/24 (As can be seen in packet captures) and I can see the responses, but I suspect it's then following default routes, rather than source based routing for the return traffic. I'll confirm this by running packet captures on the different interfaces on the MX and check for the reply traffic going down a wrong route... The firewall rules are working correctly as the ACL hit count is increasing as I send test data, so not as I originally thought being an issues with L3 firewall rules.   Once again, thanks for your responses, hopefully I can figure this out. ... View more

Hey, Are you still facing this issue or is it resolved now? ... View more

If you are interested in participating in the EFT for this feature, please take a look at this topic: EFT opportunity: IOS XE upgrades using Cloud Monitoring. ... View more

My apologies for not responding to your query, region is Europe (UK). ... View more

It could be possible that the browser's zoom is to high. Please try zooming out to make text smaller.  If you continue to have issues even after zooming out. I recommend to open a support case with Meraki Technical Support.  ... View more

Team,  I think There is a bandaid fix that I can apply to maybe boost performance on those access points. If we increase the minimum bitrate on those access points it should allow for those device to be able to accommodate more throughput ... View more

So I can't imagine there actually being any real 6GHz usage around you, so I would suspect cosmetic bug. The spectrum and channel utilization is nice but it has a history of being unreliable.   https://nolanwifi.com/2017/02/02/meraki-rf-falsehoods/   As for the MAC, I don't see 6GHz mentioned on this document, but I suspect its MESH https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Calculating_Cisco_Meraki_BSSID_MAC_Addresses ... View more

I remember this cropping up a few times over the years, always doesn't seem to last long... ... View more

We have a similar setup, two pairs of MX450s in different DCs. It is possible to setup 'secondary concentrators' for tunnelling SSIDs, screenshot below: We split the connections to different HA pairs of MX450s to spread the load, but have secondary concentrators setup in case of DC failure. ... View more

Do you have matching speed and duplex settings on the devices?  We have found that forcing either at one end and having it auto at the other can cause this, along with the cabling issues mentioned above.  Also if you are using mGig line cards make sure that all of the cabling including the patch leads is Cat6a.  Again we have seen issues with mGig AP to switch connections where Cat6 or Cat5e is used for part of the run.  This often only occurs under load. ... View more

Specifically, this setting is only for Meraki-hosted Administrator accounts.   Correct, SAML accounts will use their own separate system. ... View more

Thats interesting. I checked the settings of the new network I created yesterday and they had the following settings: I then clicked on 'Restore to Meraki Default' and ...the 6GHz was set too power range 0-8??:   Then went and checked that the country the network was assigned (automatically) was UK, didn't make a change, and then checked the power range values again, and they have changed in the background??..: I can only guess there is a slight delay with the 'defaults' being applied, and then them being adjusted depending on country network is assigned to. ... View more

Nice spot. I also found the next slide interesting. While this looks to be only for the Catalyst monitored switches, I think it would be a great feature to include for the whole Meraki switch line, to be able to compare configurations between two different time frames. I appreciate that it's possible through the use of API or a appstore service, but including it within the dashboard seems to be a good thing.   ... View more

No update sorry, I never raised a call tbh and haven't checked to see if it's sorted yet. I'll try to do that later this week and get back to you. ... View more

Congrats 🙂 ... View more

I hadn't performed the initial steps and still haven't yet, but what is odd is that the Radsec option for SSIDs is visible again for me on the SSIDs that are setup for radius authentication. I have no explanation for why it disappeared and re-appeared, but lets just put it down to either my browser cache or temporary gremlins. ... View more

I don't want to assume anything, so if it's ok, can I confirm a few things first. When you say that it is using a custom radius, is the option selected 'my Radius server' from the option under Security>Enterprise with in the Wireless>Access Control part of the dashboard?    If so, I assume that under the Radius settings you have it configured to point to the radius server, which is what I'm ultimately trying to lead you too. This could be an ISE appliance/Service or any other Radius server, but this is where I think you need to start your actual investigation as it is the configuration within the Radius server which will tell you how clients/devices are authenticating the network. Which protocol is the policy that your clients should be matching to within the radius server (Apologies I'm using ISE terminology (I think)) EAP-TLS, PEAP, MS-CHAP...etc. How are clients/devices to authenticate, with a username/password or with a certificate, potentially both. The protocol will kinda determine which authentication method is to be used. I know that you have said that entering credentials allows the users to login, but it may well be that users/devices are actually supposed to authenticate with certificates, but the radius also allows username/password. I've had issue previously where computer accounts weren't located within the correct OU in AD, so a GPO which assigned the configuration for the wireless connection haven't been pushed out. My advise is to start at the radius server, look to see how succesfull clients/devices authenticate, and look to then see why your failed clients don't automatically...I do hope that this does assist you in your investigation.   ... View more

> the group policy itself will not determine whether the client should breakout locally from the SSID or tunnel back to the MX, it only sets the local vlan override, L3/7 FW and traffic shaping.   That is the case. ... View more

> When you state Content filtering do you just mean URL filtering   Yes.   >including safe search enforcement and AMP?   I don't know about these two. ... View more