Meraki

KarstenI

@alemabrahao Ups, they are not the same? When Captain Kirk enters his Millennium Falcon to rescue princess Vespa from the planet of the Apes?

KarstenI

Here we go:

KarstenI

In addition to the already mentioned resources, for you as a partner, there is also the Blackbelt learning track on Salesconnect.

KarstenI

Hi all, How do I enable this additional Insight information for the Organization Summary? This is how it looks for me: Have a great day, Karsten

KarstenI

The static route will become the source subnet in the source-based routing dialog.

KarstenI

You can also configure it for a static route that is available on the MX. This could be a specific subnet in your environment. But be aware that this is only a source-based default route, not something like PBR on other platforms.

KarstenI

If you can/want to use a very new Firmware (v19) and your peer supports it, you can configure your extranet VPN with BGP, and this setup supports routing into your AutoVPN: https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN (as already mentioned by @rwiesmann).

KarstenI

If you use something other than 192.168.0.0/16, you are pretty good here.

KarstenI

The implicit trust you refer to is only valid for browsers, but not for 802.1X. Here, the trust comes from either explicit configuration through an MDM, GPOs, or config-files (i.e., mobileconfig on Apple devices) or TOFU (Trust on First Use). You can use a public cert for this, but it won't give your clients any trust. Just think that any holder of a public cert would be trusted. Anyone could impose a RADIUS server role. The public cert won't give you any benefit for this use case. The cert is used between the Client and the EAP Authentication Server, which is typically the company's RADIUS server. However, with local auth, the AP takes this role.

KarstenI

Given that your clients are all managed by yourself, you can generate a CA on your own and build a certificate with that. You don't need a public certificate. My recommendation would be https://smallstep.com/product/wifi/ They also have a free version.

KarstenI

Same here on MX68 and MX75 with 18.211.5.2. My MX64 (18.107.12) was unaffected.

KarstenI · ‎Apr 3 2025

This is what TrustSec with SGTs is designed to do. But there are some more requirements for that.

KarstenI · ‎Apr 2 2025

I have no real solution, but as a workaround, you could capture the DHCP communication.

KarstenI · ‎Apr 2 2025

I did this in the old Catalyst 6500 days, and after that, I promised myself to protect my customers in the future of this mess. My advice is to get a proper Load Balancer, such as a Kemp Loadmaster. They have a free virtual version, so you can get to know this product before buying it.

KarstenI · ‎Mar 28 2025

Yes, 6GHz outdoor is a sad story in the rest of the world. I was a little bit disappointed that the CW9163 doesn't have a flexible radio that could change the 6GHz to additional 5GHz spatial streams, given that most of the world can't use 6GHz outdoors.

KarstenI · ‎Mar 28 2025

I am wondering why the phones don't do RTS on their own. Are these phones at least .11g? The decision to use RTS/CTS is based on many factors and perhaps the phone only uses framesize as an option which leads it to not using RTS/CTS. And now (no, I am not drunk, I am just thinking about how things work): If you bring a 802.11b device into the network, the AP should set the protection bit in the ERP IE which should force the phone to use RTS/CTS for every transmission. And if the network is already tuned down to get it working, you likely don't cause any additional harm. Well, the last statement should be evaluated ...

KarstenI · ‎Mar 27 2025

Oh, I should not read the message and reply a couple of hours later … 😉 I forgot the freezer and also didn’t realize that two aisles in one block could open simultaniously. But with a D1, I think it’s worth a try if the reflection give you enough coverage for three rows. Is there any “system” how the rows are opening? Perhaps you find something that you can provide connectivity to adjacent rows with two different APs just by clever placement of the antennas. That would at least reduce the hidden node problem. And when you say it’s a 1*1 2.4GHz phone. Given the investment for this project, will this device be replaced with something newer that has perhaps more configuration options?

KarstenI · ‎Mar 27 2025

This, and only this, is the way to go if you want a hassle-free VPN setup.

KarstenI · ‎Mar 25 2025

The 9172 and 9162 have the same list price, but the CW9162 seems to offer some good discounts. I fear that the 9162 will go End-of-Sale very soon, limiting the lifespan of this excellent AP. I have just ordered some 9172 and hope to have them running soon.

KarstenI · ‎Mar 25 2025

IMO, Windows 11 is not yet compatible with WPA3-Enterprise *and* Wi-Fi 7. I expect this to be resolved for the Meraki firmware because it would be a showstopper for any company with legacy clients. OWE would be typically used for Wi-Fi 7 and Wi-Fi 6E where 7 is not yet available.

KarstenI · ‎Mar 25 2025

This is a firmware limitation (an annoying one) of the specific release that hopefully will be resolved. If you have legacy systems that can not connect with Wi-Fi 7 compliant settings, I would disable 11be in the Radio profile until Meraki fixes this problem. You can still implement all the settings to run Wi-Fi 6/6E on your shiny new APs.

KarstenI · ‎Mar 25 2025

Not only Wi-Fi 7, it is also required with Wi-Fi 6E. I would not configure Transition mode, I always configure two SSIDs, "Guests" which is open and "Guests-Secure" with OWE. Guests-Secure is used in 6 GHz, while both are announced in 5 GHz. Clients that are not OWE-compatible might try the OWE one and fail. But they typically directly try the legacy SSID which will work.

KarstenI · ‎Mar 25 2025

After seeing this floorplan, I don't expect a hidden node problem anymore. If only three isles are open at a time (one on the left, one in the middle and one on the right), My first idea would be 6*9176D1 equally distributed on the lower wall. With only one AP for an APoS you should be able to test if you can cover multiple isles in this setup.

KarstenI · ‎Mar 23 2025

Luckily, I never had to deal with that. But although you design the "hidden node" problem into this solution, I still would expect it to work. RTS/CTS to the rescue. Well, at least while the airtime consumption is low. Don't forget to write/blog/youtube about your findings. 😉

KarstenI · ‎Mar 22 2025

You say yourself it's controversial... I think it was already a bad design when we only designed for coverage ... Does it have to be Meraki? To save on APs, I would run C9120E in dual 5GHz mode with one warehouse antenna connected with RP-TNC and a second one connected with the DART connector. Sadly, nothing from Meraki to build something like this. Neither an AP nor the Antenna (like Acceltex ATS-01088 that has Beamwidth 15 horizontal/120vertical).

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges