Meraki

RaphaelL

networkIds[]=xxxxxxxxx should be the parameter

RaphaelL

What is the port config of the switchport where the APs are connected ?

RaphaelL

Those are some example for status. I have seen "Planned reboot" also if it was initiated from the dashboard.

RaphaelL

This is one of the most frustrating thing right now. It loads with the old UI, then reloads with the new on all the pages that support old/new ui which makes the dashboard experience disgusting and super slow

RaphaelL

Yep that update looked promising until I saw that MX-34504 wasn't fixed. Won't upgrade

RaphaelL

I think it's a private beta that is rolling out soon

RaphaelL

As mentionned by alemabrahao , try disabling 802.11r. What is the security on this SSID ? WPA2-PSK or WPA2-Enterprise ?

RaphaelL

So you must be running IPS and not IDS right ? Cause IDS won't block

RaphaelL

I was also saying this until I met EOS from Arista

RaphaelL

I'm mentioning this because ntp issues = time issues = tls issues. That might not be your case tho.

RaphaelL

Hi Kory ! I had the pleasure to work with you on multiple cases 😉 Welcome aboard !

RaphaelL

Hi , I have read the Microsoft documentation about the network requirement about MS MTR : https://learn.microsoft.com/en-us/microsoftteams/rooms/security?tabs=Windows#network-security Has anyone deployed MTR with Meraki ? What did your firewall rules looked like ? I'm hearing that I have to allow almost all of Azure which I really doubt.

RaphaelL

Hi , In your pcap , do you see TLS issues ? Invalid certs / expired ?

RaphaelL

That document is for MR , if those behaviors are the same for MXs that would be nice to add the changes to the MX doc. Thanks ,

RaphaelL

Hi , https://documentation.meraki.com/MX/Access_Control_and_Splash_Page/MX_Access_Policies_(802.1X) I think this page is lacking a lot of crucial information. 1- What happens if you put multiple RADIUS servers ? Is it round-robin ? 2- How is the MX made aware of RADIUS failures / timeout ? Will it go to the next RADIUS server ? 3- Is there a fallback mecanism ? If RADIUS #1 is unreachable and it going to RADIUS #2 , Will it comeback to RADIUS #1 or only switchback if RADIUS #2 comes unreachable ? I do know most of these answers , but I'm pretty sure that would help a lot of people.

RaphaelL

I was going to comment this , even if it sounds stupid a MX cannot snoop a TCP DNS request. It must be UDP unencrypted.

RaphaelL

Hi , Haven't tested all of them , but if you look at the API index there are a few that might help : https://developer.cisco.com/meraki/api-v1/api-index/ getNetworkWirelessDevicesConnectionStats getNetworkWirelessFailedConnections getNetworkWirelessClientConnectionStats

RaphaelL

Hi , Deny LAN won't deny access to the Internet. If you have a MX and MR , I would put the rules on the MX. 1- Deny LAN on the MR 2- Deny RFC1918 on the MX 3- Allow "internet" on the MX That is how we have our Guest SSID configured.

RaphaelL

Hi , https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/SD-WAN_and_Traffic_Shaping Note: ICMP traffic is not subject to traffic shaping rules. As a result, Flow Preference will have no impact on ICMP traffic Traceroute and ping are ICMP based so your flow preference rules will be ignored.

RaphaelL

Just to add to the answer provided by cmr : MX devices running MX 19+ firmware, MS devices running MS 17+ firmware and MS390/Catalyst devices running CS 17+ firmware will use the username admin and the password will be the serial number (Cloud ID) of the device (upper case letters and dashes). All devices running other firmware versions will use the serial number (Cloud ID) of the device (upper case letters and dashes) as the username with no password. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

RaphaelL

I'm not sure to quite understand your concern about IP overlap / conflict.

RaphaelL

An update has been posted A mitigation is being deployed to our systems and we are continuing to monitor the results. Your MX device may experience a further onetime reboot now during this remediation. It fits with what we saw

RaphaelL

I think a "fix" was just pushed. We see that they pushed a older SNORT rule. snort_rules_version: 20250409-1715

RaphaelL

Thank you all for the confirmation

RaphaelL

Also experiencing this issue. Can someone confirm they have the issue with any version from 18.211 to 19.2

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges