Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About fjulianom
Community Record
43
Posts
1
Kudos
0
Solutions
Badges
Jul 4 2018
9:10 AM
Hi MRCUR, I don't want to achive anything here, as I said at the beginning of the post I only wanted to know if Meraki has the EAP offload feature. Regards, Julián
... View more
Jun 27 2018
12:40 PM
Hi, Honestly I haven't used this feature with Aruba controllers, but I do have with Aruba Instant APs, where there is no physical controller. And I have used this feature without importing any certificate into the AP, and the APs have terminated the EAPOL process very fine. Obviosly the client gets a warning and must accept since doesn't have the certificate, but the client also gets a warning in case EAP offload is not used and it doesn't have the RADIUS certificate. Regards, Julián
... View more
Jun 27 2018
12:18 PM
Hi, EAP offloading terminates the EAPOL process onto the Aruba controller. If we supported EAP offloading you would have to upload a certificate to every AP, which isn't scaleable. Maybe in Meraki, but that's not needed in Aruba since each AP uses its built-in certificate. Regards, Julián
... View more
Jun 27 2018
11:40 AM
Hi Adam, Can the person(s) that manages the RADIUS make changes needed for you? But I don't need any change, as I said, the RADIUS server has a certificate, so can I assume the clients are receiving that certificate? I believe the function you are using is when clients have and use a certificate to authenticate? No, in that network I don't need the users authenticate with certificate, just with username and password (PEAP). I think the best way to prove that is setting up a lab with a RADIUS server without certificate and try if the users can authenticate or not. If they can't, it means the APs can't act as the authentication server and the RADIUS server MUST have a certificate. But right now I remember when I implemented that network the users could authenticate with the primary RADIUS server but not with the secondary one (there are two servers for redundancy purposes), and the problem was the secondary server didn't have a certificate. The problem was solved once I installed the certificate in the server. I open a thread in this community, look at this: https://community.meraki.com/t5/Wireless-LAN/Wi-Fi-RADIUS-Authentication-failed/td-p/11676 So I guess the Meraki APs don't have that EAP offload feature. Regards, Julián
... View more
Jun 27 2018
10:27 AM
Hi Adam, Sorry, before I meant EAP-PEAP and not EAP-TLS (edited), but basically is the same since in both cases the server must authenticate againts the user. Don't get me wrong, some time ago I have implemented a network using Meraki APs and the users are using their credentials to connect to the Wi-Fi network, they use EAP-PEAP, and it works fine. The RADIUS server has a certificate, but because I don't have access to that network, I don't know when the users connect to the Wi-Fi network, they receive the RADIUS certificate or the Meraki APs certificate (I don't know if this is possible). Or in other words, if the RADIUS server doesn't have a certificate, can the Meraki APs act as the authentication server and provide the certificate? Or just that scenario won't work? This is possible with the EAP offload feature in Aruba, I don't know in Meraki... Regards, Julián
... View more
Jun 27 2018
9:42 AM
Hi Adam, I assume your ultimate goal is to have the users/computers authenticate against your RADIUS server correct? Yes, you are correct. Some documentation on your wifi offload stuff here https://documentation.meraki.com/MR/Encryption_and_Authentication/EAP-SIM_with_MR_Access_Points But it talks about EAP-SIM, I use EAP-PEAP. Regards, Julián
... View more
Jun 27 2018
9:33 AM
Hi guys, I wonder how Meraki APs handle the EAP-PEAP authentication with RADIUS. In EAP-PEAP authentication, first the RADIUS server authenticates against the user sending a certificate to him, and then the user authenticates with his username and password against the RADIUS server. I am new in Meraki, but other vendors such as Aruba, have a feature called AP termination or EAP offload. With EAP offload disabled, the RADIUS server sends a certificate to the user in order to authenticate itself and then the user authenticates with his credentials. But when the RADIUS server doesn't have a certificate for authenticating or you don't want to use that certificate for any reason, you can enable EAP offload. When enabled, the AP itself acts as the authentication server, the AP terminates the outer layers of the EAP protocol, only relaying the innermost layer (credentials) to the external RADIUS server. This feature can be enabled or disabled just with a click. But I don't see this feature in the Meraki Dashboard, so I don't know if Meraki APs can act as the authentication server, if they cannot, or if there is some default. Can you help me? Regards, Julián
... View more
Jun 6 2018
2:22 PM
Hi guys, Today is fine, if I make a config change it takes around 1-2 minutes to update. Maybe the yesterday's cause was a Dashboard temporary outage. Regards, Julián
... View more
Jun 5 2018
1:41 PM
Hi, Right now the config changed to "up to date". Is there any place when I can see logs or something to try to see what is happening? Regards, Julián
... View more
Jun 5 2018
1:37 PM
Hi Adam, So it is weird. I also have changed only one port from VLAN 1 to VLAN 20. Right now is "out of date" for 44 minutes :S Regards, Julián
... View more
Jun 5 2018
1:27 PM
Hi Adam, Changes are on my switches, I am changing the untagged VLAN of access ports from 1 to 20. Regards, Julián
... View more
Jun 5 2018
1:11 PM
Hi community, Today I was doing some changes on my MS switches. After doing the changes and trying to understand why they didn't work, I realized the configuration was "out of date". After some time, the config changed to "up to date", so I thought it was a temporary issue. But right now I am doing more changes, and the config keeps "out of date" for many minutes (right now more than 18). According to the documentacion and also to the following thread, there are 3 reasons an AP on your network will report this alert message (and I think is the same for the switches): The AP is behind a firewall that is blocking outbound access to Dashboard. The DNS servers your AP is configured to use are unreachable, not responding, or sending invalid DNS responses. Dashboard is experiencing a temporary outage. https://community.meraki.com/t5/Wireless-LAN/Configuration-out-of-date/td-p/2488 I am pretty sure point 1 and 2 are not the root cause, since my firewall is not blocking ports, the DNSs are reachable, and also I made many configuration changes other days and they worked well. What can be the reason? How can I check is not a Meraki dashboard or Meraki public servers issue? Regards, Julián
... View more
Hi MRCUR and Philip, I only read the L3 roaming description which appears at the Meraki dashboard, which only explains it is used to roam between APs, but it doesn't indicates "APs in differents VLANs". I have checked the Meraki documentation and there does explain L3 Roaming is used to roam between APs in different VLANs Since I can make the wireless VLAN available at all the APs as you said, then I will choose Bridge mode and tagging with the appropiate VLAN. Thanks very much for your help. Regards, Julián
... View more
May 28 2018
2:10 PM
Hi experts, Currently I have one corporate SSID in Bridge mode, without VLAN tagging, so the wireless clients are part of the LAN. I want to avoid this and have the LAN clients and wireless clients on different VLANs. I have seen I can achieve that still with Bridge mode and tag the wireless clients with a differtent VLAN that the LAN clients use. Or I can use Layer 3 roaming and also tag the wireless clients with a differtent VLAN that the LAN clients use. The only difference I see is in Layer 3 roaming the client keeps the IP address if it roams between APs, so I understand in Bridge mode the client doesn't keep the IP address if it roams between APs: Is that the only difference? Then I will always select Layer 3 roaming since I want the clients keep their IP addresses when they roam, and therefore they will not drop their connections. Regards, Julián
... View more
Feb 21 2018
6:33 AM
Hi MRCUR, Yeah, that's right and thanks for your help. Regards, Julián
... View more
Feb 15 2018
6:27 PM
Hi Markus, I have just exported the NPS configuration of the primary RADIUS server and imported to the secondary RADIUS server. I have deleted the primary RADIUS server in the dashboard and the authentication is still unsuccessful. The NPS log is the same I sent you. Do you guess something? Regards, Julián
... View more
Feb 15 2018
2:07 PM
Hi Philip, You are right, but that the client can attach to an AP which receives weaker signal from is also true. This is my case right now and therefore my laptop browsing speed is lower. In my case it makes no sense since in my office we have 4 APs and we are around 35 people. What was stated by MRCUR is also true. Regards, Julián
... View more
Feb 15 2018
1:39 PM
Hi, I find an option in Meraki which I think it has to do with roaming directly, which is the "Client balancing" feature. When I enable this feature I can see some logs like this: The AP rejects the association according to load balance, even if the client is receiving stronger signal from this AP. So I don't know how good is to enable this feature, especially for environments with few clients. Regards, Julián
... View more
Feb 15 2018
8:58 AM
Hi Markus and Adam, One more question about that. I have delete the primary RADIUS server under Wireless > Access control > RADIUS servers and left the secondary server and try to authenticate, it was unsuccessful. Is this correct? If I authenticate with only one RADIUS server (the secondary) and get EAP failure is it due to previous RADIUS synchronization problem? Regards, Julián
... View more
Feb 9 2018
8:29 AM
Hi Markus, OK, I understand, I will try it. Thank you very much! Regards, Julián
... View more
Feb 9 2018
7:55 AM
Hi guys, Just in case, do you know how difficult is the synchronization of RADIUS servers? Because I have googled out and seen that a PowerShell script is needed. If it is very difficult I will tell customer to implement it. Regards, Julián
... View more
Feb 9 2018
6:46 AM
Hi Adam, Thanks for that recommendation, I will test it. Regards, Julián
... View more
Feb 9 2018
6:45 AM
Hi Markus, I don't know very much about servers, I have to check the detail configuration with customer. So far I know there are two Windows Servers with AD, in each Windows Server I have aggregated the RADIUS role, Microsoft NPS. I know each Windows Server has its own AD, but I don't know if they are in the same cluster or not (I guess so because customer told me the configurations in both ADs are replicated automatically, but I don't know if that has to do with AD clusters or not). Regards, Julián
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 11056 |
© 2024 Cisco Systems, Inc.
