Meraki

GIdenJoe

Have you measured between those 2 access points you give as an example? For an example an Iphone will start looking to roam at -70 but the neighboring AP needs to be at least 10 dB higher at that point before it does so. Perhaps you hare not having enough overlap. Also if you are using MA-ANT-20 make sure the AP's are not mounted over 8 meters above ground. Especially in the 5 GHz there is a large null zone at 45 degrees both above and below the antenna.

GIdenJoe

SD-WAN is the easiest to implement since you are not doing any NAT sessions over 2 providers but are just tunneling traffic between your branches. So after the security check your MX only needs to route the packets. SD-Internet is more complex since that deals with traffic being sent to the internet directly from your MX. This means if you suddenly change from WAN1 to WAN2 due to conditions all existing sessions are now NAT'ed with a different WAN IP and usually cannot go on in the case of TCP and have to be reestablished.

GIdenJoe

If you don't expect high levels of traffic in the school you don't have to calculate bandwidth. But if you do then it is very important to design for smaller cells having a cut off at higher levels than -65. Aside from that try to have each classroom to have enough secondary coverage from an adjacent room so each client can roam if it deems necessary and have just enough that the experience in the hallways is fluent enough so roaming does not become an issue when walking there. Try to shoot for having a solid -55 inside the classroom from the primary access point and the bleed through to the hallway down to -65 right next to the classroom. Then have about -65 to lowest -70 signal from the adjacent classroom. And also have that signal overlap a bit in the hallway once again for the roaming. The AP power should never exceed 14 dBm and if the wall attenuation allows it you can even lower it a bit to keep to the values mentioned above.

GIdenJoe · ‎Apr 7 2025

For the switch client you need to set the group policy via 802.1X and then you can have your L3/4 rules. For the wireless client if you block access to the same VLAN range, the AP will block it and since this rule is stateless the switch client will be able to send to the AP client but the AP client will not be able to respond back so in effect you can block traffic between a wired and a wireless client on the same VLAN.

GIdenJoe · ‎Apr 7 2025

It depends. You can have rogue SSID's that are SSID's from other devices that are on the same physical network. And usually you don't want extra SSID's for performance and confusion avoidance reasons. You can also have spoofs which are the same SSID's but from non Meraki devices or devices in a different Meraki network. If an attacker makes a spoof you need to be notified immediately because that is an attack in progress, however if it is a device under your control you can classify it as friendly.

GIdenJoe · ‎Apr 7 2025

Hey, Are you referring to the routed interface versus vlan interface difference? As for the moment purely routed interfaces are not yet supported on Meraki managed C9300's so you need to stick to vlan interfaces for now. It is important that you choose the correct upstream SVI. At this time the management of your Catalyst is done through the upstream SVI instead of a separate management IP like you have on regular MS switches. In dashboard when you try to set the management IP to static it will now also take you to the switch routing and DHCP page. This means, choose in what VLAN you want your switch to be managed and create your SVI in that VLAN and make a 0.0.0.0/0 route towards the gateway. Remember that in Meraki a switch cannot point to itself for management default route so in case of routed core switches you need to have their management interface in the upstream VLAN towards your internet gateway. Then the other steps should be straightforward if you follow the documentation.

GIdenJoe · ‎Apr 5 2025

Normally ACL's on MS switches are VLAN ACL's so you should be able to just block traffic coming from that VLAN to any private RFC1918 address in 3 rules and that should effectively also isolate guest clients from each other.

GIdenJoe · ‎Apr 3 2025

I considered that but in this case it was the first and only link that was being suspended. And the log message seems to indicate that it is a bug having to do with the creation of the new Po interface.

GIdenJoe · ‎Apr 2 2025

HI all, I'm just installing a few switches at a customer. The deployment is a stack of 2 C9300-24P-M with C9300-NM-8X in the main rack for collapsed core and access at the offices with a few MS130-48P switches scattered around the facility. When I wanted to aggregate the two fiber uplinks between each MS130 and the C9300 stack I first aggregated them on the access switches before doing it on the C9300's. When I ultimately enabled them on the C9300 the links went down. Checking the logs on the dashboard terminal I found these nice entries: %SPANTREE-6-PORT_STATE: Port Te2/1/1 instance 0 moving from forwarding to disabled %ETC-5-CANNOT_BUNDLE2: Te2/1/1 is not compatible with Po1 and will be suspended (Broadcast suppression: Level of Te2/1/1 is not configured. Level of Po1 is 1.00%, 1.00%.) %SPANTREE-6-PORT_STATE: Port Te2/1/2 instance 0 moving from forwarding to disabled %ETC-5-CANNOT_BUNDLE2: Te2/1/2 is not compatible with Po2 and will be suspended (Broadcast suppression: Level of Te2/1/2 is not configured. Level of Po2 is 1.00%, 1.00%.) %SPANTREE-6-PORT_STATE: Port Te2/1/3 instance 0 moving from forwarding to disabled %ETC-5-CANNOT_BUNDLE2: Te2/1/3 is not compatible with Po3 and will be suspended (Broadcast suppression: Level of Te2/1/3 is not configured. Level of Po3 is 1.00%, 1.00%.) This is strange since the running config on the individual interfaces already had following config storm-control broadcast level 1.00 storm-control unknown-unicast level 1.00 One of the first things I usually do is limit the BUM traffic by configuring: So when unbundling those channels the ports came back up as one would expect. I then disabled storm control first, created the aggregates then and was able to re-enable storm control after the channels were made succesfully. So for people in similar situations: - Do the storm control feature in the final steps after the topology is up and running.

GIdenJoe · ‎Mar 29 2025

The oldest phones are 11n and the slightly newer ones are 11ac. The old ones were the ones tested.

GIdenJoe · ‎Mar 27 2025

Except for the fact that with an internal antenna you are once again limited to 2 aisles per AP which brings the total for that freezer to 9. And the fact that it's a freezer would require indoor AP's to have an heated enclosure which is also quite costly in buy installation and maintenance. In my initial validation survey I did explain the hidden node issue that could arise if two aisles too close to eachother would be open. And thanks to your remark you made me think about how the hidden node problem arises and how RTS/CTS can help mitigate it. So thanks a bunch for that! In further investigation I've noticed the phones don't do RTS on their own but they do respond to RTS from the AP's. This could be one of the reasons these phones have a default of 20% or more retry rate going up to 80% in end of aisles. But that could also be due to too many reflections of the signal. I'll have to investigate that too.

GIdenJoe · ‎Mar 25 2025

Either have the other side change their DH parameter to DH14 or have a separate router device do the VPN and just route to it from the MX.

GIdenJoe · ‎Mar 25 2025

The cloud radius that is part of Meraki Access Manager allows for EAP-TLS authentications which means you can have Entra ID users that have a cert on their laptop that can be authenticated agains their Entra-ID group membership directly. So in this case there are no splash pages involved. You can also use EAP-TTLS/PAP if a cert is not on the client machine but then the user will need to use the supplicant to provide his/her username and password. But again no splash pages involved.

GIdenJoe · ‎Mar 25 2025

I believe you will need to poll dashboard instead. The MS switches themselves only know mac addresses but they will fingerprint traffic and see the IP address that way. But that is solely used to feed into dashboard.

GIdenJoe · ‎Mar 25 2025

I like your creativity when it comes to moving racks however if you know what exactly moves you wouldn't be able to solve it that way. Below is a part of a measurement walk I already did in one of the freezers. The blue racks are all racks however I have traced the fixed racks with a black box. So each segment is split by fixed racks and in between you can have anywhere between 6 and 10 moving racks. There is always one open aisle per section. So here on the floorplan it is drawn at the left side. So when you want to open another aisle in the middle all racks to the left of it move along a rail towards the left. So attaching an AP to a rack itself will only make it track that aisle particularly. For your kind of system you would require an AP mounted to a plate on a rail that knows what aisle is open en where to place itself which is a whole other solution in itself. If you count the potential aisles in this freezer alone you would require 9 AP's in this one freezer alone if you keep the antennas both at the AP itself. They now have 3 AP's in this freezer. And there are many freezers like this. This is a atmosphere photo of that freezer taken from the right side looking left. If my hidden node introducing compromise design would technically work then I would achieve it with 5 to 6 AP's.

GIdenJoe · ‎Mar 24 2025

That's a promise 🙂 I did a few captures on the other site and yes all the clients use RTS/CTS nicely. You are correct about the airtime. Since the current solution is using 2.4 GHz exclusively and even with the amount of AP's they use now they have areas with 20 to 30% usage even when no employees are present at that exact moment. The current deployment is a bit poor and they actually set the min bitrate all the way down to 1 Mbps to still get it to work.

GIdenJoe · ‎Mar 23 2025

Yes it has to be Meraki. The other branches of the customer is becoming all Meraki. I have considered a controller with C9120 as an option but then in these freezer areas they would require heated enclosures which kinda nullifies the cost difference and increases the configuration and maintenance difficulty. And combining full Meraki with controller based in a single Meraki network is not possible. I reckon for now that since the MR86 is 4x4 you can use a ANT-25 or 27 since it has at least polarization diversity to have some merit when only receiving one physical antenna at full strength. Before suggesting this installation type I will however try do to a good enough test with the phones and the scanners to see if that kind of setup is okay or not. This weird setup has been working fine in the locations where 1 antenna does line up to the open row. Have you ever had any testing done with situations like this?

GIdenJoe · ‎Mar 22 2025

I know this topic is a bit controversial when it comes to antenna diversity specialists but I do want an outside opinion. So I have a customer with an existing wireless deployment in a freezer warehouse environment. There are some phone issues where calls can drop at the end of some aisles where I found the phone to try to roam from one AP to another while both only have about -85 dBm signal strength which is to be expected. The environment has one tricky issue and that is that the racks are mobile. So each rack is 2.5 meters wide and in each grouping of racks there is always one space of 4 meters. So yes I have checked and there always is a 1.5 meter overlap where I could place an AP to cover 2 potential rows. In the current setup that consists of Zyxel access points they have put 3x3 AP's where one directional antenna is about 3 meters to the left of the AP and another is to the right. They have not connected the 3rd antenna slot because Zyxel told them their AP's detect that and go into 2x2 mode. Since not all antennas are lined up to every possible open row configuration the above mentioned problem happens predominantly when an antenna is not lined up to the open row. So in a potential new deployment I would like to of course take into account all the rows. However since Cisco and Cisco Meraki is just a teensie weensie bit more expensive than a Zyxel solution I am a bit worried about mainly the cost but also the potentia of having to double the AP count. I was wondering since the MR86 can be paired with single element or dual element antennas without having issues. In essence would it be possible to have one antenna connected via a 3 meter low loss cable to the left side of the AP covering the first gap (2 row combinations) and having the other antenna do the same to the right covering the second gap. I know that antenna diversity will be less than stellar. It's not that there won't be any coverage from the second antenna that is blocked by the rows but that will be poor while the visible antenna will have great coverage towards the entire row. The second slight worry I have if that if this is entirely out of the question I will have to double the amount of AP's and thus double the amount of airtime utilization since I only have the option to place the AP's at the open wall in front of the rows and not above the rows themselves. I will apply for a demo to test this scenario out but I'm curious about my fellow wireless guys with more experience what you would say about this. Btw the clients are a mixture of 1x1 wifi phones, and 2x2 Zebra barcode scanning devices.

GIdenJoe · ‎Mar 17 2025

I wish Meraki would suppress the link down -> RSTP disabled and link up -> RSTP designated on portfast/edge ports cause these just flood the eventlog for no real benefit. It is already enough to have the link down link up on these ports.

GIdenJoe · ‎Mar 17 2025

Usually for normal endpoints the typical 300s/5minute timeout is perfect and should never be changed. However routers usually talk to other routers and those connections are supposed to be rock solid so that is why Cisco routers use a much longer timeout on ARP entries.

GIdenJoe · ‎Mar 11 2025

What do you mean exactly when your main site goes down. Do you mean you are full tunneling their internet traffic or do you mean they now go through the main site to reach Azure resources? You can only use vMX appliances as VPN concentrators for remote sites. It will not work to full tunnel traffic to the internet.

GIdenJoe · ‎Mar 11 2025

Hmm that would be strange since Catalysts even in Meraki managed mode still use the same configuration methods as they would in CLI. These are NOT MS switches. Perhaps if you could use dashboard CLI and do a show run on the switch itself. There could be an SNMP view that is limiting what you are supposed to be able to see.

GIdenJoe · ‎Mar 1 2025

It's probably a bug specifically on the MX95 if the MX stops responding to DPD packets. You'll need to engage support. There is probably no useful logging on the Meraki side for that issue.

GIdenJoe · ‎Feb 24 2025

This would defeat the purpose of your uplink monitoring. Your MX needs to be able to reach external DNS servers to test DNS query/responses so it can report the WAN uplink is up or down. Why would you actually want the MX to use an internal DNS anyway? The sites it tests for are quasi hardcoded anyway.

GIdenJoe · ‎Feb 24 2025

You should investigate if multiple mac addresses are using the same IP address. I have never found dashboard to be wrong about this. If they see that a different mac address is using an IP address that has just been used by another mac it will throw that alert. Maybe write the mac addresses involved down and perhaps do some pcaps to see if your device is not changing it's mac address. You can easy apply filters on your capture to just limit between those mac addresses.

About GIdenJoe

GIdenJoe

Joey Debra

Community Record

Badges