Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Alexs20
Alexs20
Getting noticed
Member since Aug 11, 2023
Nov 7 2023
Community Record
44
Posts
4
Kudos
0
Solutions
Badges
Oct 24 2023
12:37 PM
yeah, I am a getting all that a bit emotionally because this is not the first "anomaly" that i see, and because of the time limits that i have to finish the integration i cannot play with support cases and wait for fixes and make another try, i need the solution asap, and every time i change the direction and trying to go around the problem i am hitting another wall. --EDIT-- I am also sure for 99.999% that any my request to support will end up with response that this is how it is designed to be, already tried with several cases, so just a wasting of time, if it doesn't work as expected, then ok, it doesn't work... 😕
... View more
Oct 24 2023
12:00 PM
Yeah, I know how CoA and Disconnects work. And from my experience there is a way to implement what I am trying to do. The proper way to do that is to send CoA with either Calling-Station-Id or Acct-Session-Id set mac address that does not exist, like 00:00:00:00:00:00 or FF:FF:FF:FF:FF:FF, and in that case, if the remote device implemented the CoA protocol correctly, the device will respond with NAK and message saying that Session context not found... But looks like Meraki is again trying to invent their own rules and instead of just sending the NAK ignoring the request
... View more
Oct 24 2023
11:07 AM
I am trying to find a way to test that my messages are reaching the AP without using any session for that. Imagine I have a site with 100 APs installed. And I want to send "TEST" COA to all of them and see if I get response from all of them - just to make sure that there is no issues with passing UDP traffic from my service to all APs.
... View more
Oct 24 2023
11:03 AM
Yes. When I am targeting a real session then I am getting the AK message back.
... View more
Oct 24 2023
10:54 AM
Hi everybody I have a question about CoA messages. I am following this document: https://www.cisco.com/en/US/docs/ios-xml/ios/san/configuration/15-e/san-coa-supp.html And my question is about how can I troubleshoot the reason for not answering to CoA messages? For example, when I am targeting session that does not exist already, instead of return NAK the access point just keep silence, and on my side i have zero knowledge about what went wrong, it because of time drift? or maybe network problem? or i am sending bad message. The Log/Events section in Meraki Cloud is also keep full silence about what is going on and why AP is not answering. How can I troubleshoot such cases and force the AP to respond? Is it possible to just send a test Coa to AP just to make sure that at least no problems in the network? Any PONG-PONG coa message? Anything? Thanks.
... View more
Labels:
- Labels:
-
Other
Oct 11 2023
3:11 PM
Hi all, I need an advice about applying Group Policy by Radius Response message In MS switch I have one port configured to authenticate devices using Radius server. Then I made a custom Group Policy with bandwidth sharping and when device connects to the network and the switch asks Radius server for approval I return the Access-Accept with the Filter-Id attribute set to the name of that custom group policy. The device gets access to the network but in its statistics I see that it has Device Policy still set to Normal. If I change it manually from the UI, then it apply it and the device gets the bandwidth as defined in the group policy. But whatever I do I cannot force it to do the same using the Radius response. I feel like I am missing something, but cannot catch it. Thanks.
... View more
Oct 11 2023
1:57 PM
Ok, then another question. I see that MS switch also sending a "Meraki-Device-Name" attribute that contains the switch's name that I can change. Theoretically I can use this field to pass my custom data to the radius... but, I do not see any documentation that directly says that MS switch will always send the "Meraki-Device-Name" attribute. That means that I cannot use undocumented field... Is anyone aware about where can I find the documentation about this attribute? Thanks
... View more
Oct 11 2023
10:37 AM
Hi all, My question is about how can I provide a custom NAS ID value in a Radius requests originated by SM switch? I am comparing the Access Policy configuration forms between the Wireless and Switch and i see that I can do that for the Wireless mode (in advanced section) but I do not see anything similar for the Switch. Please advice. Thanks.
... View more
Aug 28 2023
10:16 AM
Hello, Is it possible to activate and configure Splash pages on Switch level (based on VLANS)? So any device that connects to the network via wire will see the captive portal Thanks
... View more
Aug 28 2023
9:40 AM
Hi, maybe someone know the answer to the following, CoA related, question. I've verified that the AP responds to CoA messages initiated from the local network. However, the actual requirement is to send these messages from the internet, externally. The option of configuring port forwarding for each AP individually is not very feasible due to security concerns and the complexity involved, especially with a potentially large number of APs. As a result, the only viable approach seems to involve routing these messages from a single open port to the respective AP, based on specific criteria such as the 'NAS-IP-Address' value. So, my question is: does Meraki offer any hardware solutions that can facilitate this message forwarding? Alternatively, is there an alternative solution that I might not have considered? Thanks
... View more
Labels:
- Labels:
-
Other
unfortunate it doesn't work with either "MAC-based access control" nor "Identity PSK with RADIUS" looks like this is only for Sign-on Splash just tested
... View more
yeah, looks like this is the only way
... View more
Aug 24 2023
11:42 AM
2 Kudos
oh, NM, I found the problem. I had to add my PC IP into the list of radius servers
... View more
Aug 24 2023
10:06 AM
Looks like I need a little more help. So, I am trying to talk to AP using radclient utility my command is echo ' Calling-Station-Id = "<MAC redacted>" NAS-IP-Address = 192.168.2.224 Filter-Id = "PASS" Event-Timestamp = "1692895863" cisco-avpair="subscriber:command=reauthenticate" cisco-avpair="subscriber:reauthenticate-type=rerun" ' | radclient -x 192.168.2.224:3799 coa <secret redacted> But there is nothing coming back. 192.168.2.224 - is IP of my AP and this is what i see in Access-Request message when connecting to SSID Any ideas? Thanks
... View more
Hi, I there any way to control Bandwidth rate dynamically using RADIUS response in "MAC-based access control" mode? I know how to do that via polices, but i need to control it dynamically, per authentication, something similar to that: WISPr-Bandwidth-Max-Up := 100000 WISPr-Bandwidth-Max-Down := 100000 Thanks.
... View more
Aug 23 2023
3:21 PM
That means that I cannot use external RADIUS server (means hosted in internet) as AP sits behind the firewall. Hmmm, ok, thanks.
... View more
Aug 23 2023
2:48 PM
Hi, Assuming that I have one AP connected to Meraki cloud, with "MAC-based access control (no encryption)" security mode enabled. I also have "RADIUS CoA support" option enabled. What is the destination IP for CoA messages? Is it the same as Meraki console FQDN? Thanks
... View more
Yeah, I saw that. This is hotspot 2 not the same as the regular hotspot, not all devices support hotspot 2 connections. For example for Android devices - only starting Android 11 with special HW, the same with Apple, only devices from last 5-6 years. And this is a problem, because we are trying to cover 99.9% of devices. Unfortunately the closes implementation of the regular hotspot is what Meraki calling - Sign-on with Radius, which has very limited functionality. But anyway, thanks for trying to help and direct me, but looks like not all problems possible to resolve in a easy way 🙂
... View more
Lol, wanna compare skills? Well, I also work in the same industry for almost the same amount of time... maybe little less but not significant, 8 years. And I am also a developer with 20+ years experience with different network protocols and I already did a few vendor's integration. And I can say for sure that even if for Meraki it is an "expected behavior", this is not the same for the rest of the world.
... View more
No this is not expected. Imagine you are a Guest in hotel. You are coming to your room and connect to SSID (Rooms), you see the login page and accept Terms and Conditions of using WIFI in the Hotel, then you go to the Restaurant, and connect to another SSID (Restaurant) and instead of just connect to the network you see the Terms And Conditions AGAIN. As a administrator I should be able to configure roaming between different SSIDs, and this is why you need to query device's registration status with Radius server Before Showing the splash page, not after. Just to repeat myself - Ruckus and Aruba controllers doing that in a right way and Talking to the Radius before making the decision Do or Do Not show the splash page.. but not Meraki, unfortunately.
... View more
Did you read my post about two different SSIDs with splash page configured on both? Where exactly in all quotes you posted from that L3 roaming doc I can see how to bypass second Splash Page when user that already logged in first SSID connects to second (for first time!) ? I think we are talking about two different things. In your scenario, to have L3 to work user should connect to SSID 1, then Login in Splash page, then connect to SSID 2, AGAIN LOGIN in Splash page, and only then L3 roaming start to work if he moves between them... but my problem is with the SECOND SPLASH, on SECOND SSID, when user connects to it for first time, while he already logged in first SSID. SSID names are different, not the same, but AP could be the same! But NM, the Meraki Employee in the thread I found and posted before has confirmed that this is impossible and Meraki not implemented it yet, so we just wasting the time. unless ... you are ready to not to simply copy-paste quotes from all kind of docs but to help me guiding with real configuration steps that will allow me to bypass splash page on the second SSID
... View more
This link you posted has nothing to do with Splash pages... we are going in cycles. If you have SSID A (VLAN 1000) with Splash page and SSID B (VLAN 2000) with Splash page as well then there is no way to let to guest to login only once in any of them and then let it roam between them without showing the Splash page second time.
... View more
Oh, I see that people asked for the same behavior, without proper answer as well https://community.meraki.com/t5/Wireless-LAN/How-to-use-both-MAC-based-authentication-and-Click-through-sign/m-p/120627 It is simply not implemented "yet" (that was 2 years ago) ... That's sad.
... View more
Really? Then how you would implement VLAN roaming?
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 1333 | |
| 2 | 1157 |
© 2024 Cisco Systems, Inc.
