Maraki and Cisco AP integration issues.

So We received an upgrade to the Meraki Router + Access Point replacing our Cisco 881W. I have a question about seamless transition/roaming between the Cisco and Meraki AP's .

After sitting in Sacrament meeting I headed to the RS room for Sunday School - My tablet and phone (my wife's phone as well) Nexus 2nd Gen, Galaxy S8 + LG G4 all kept their connection with the Cisco AP they connected to during Sacrament meeting even though it showed 'no bars' for the signal and the Meraki AP was sitting at 5 bars based on my wifi app. I had to cycle the Wireless on my device for it to associate with the closer and stronger signaled Meraki.

Are we sure these are configured correctly to transition seamlessly like clients should between AP's - is this just a scenario I need to help my SS Teachers understand as they transition to classes on the 'Meraki' side of the Building following Sacrament Meeting?

-John

There's been complaints about that before. I've seen similar on my phones with a all Cisco AP system. I'm not sure what settings on the network side would affect this and how much is the client responsibility.

In one of our buildings, we have four hallways forming a square. There is a Cisco WAP at each corner. It is rare that a device switches from one WAP to another, except when you make a kitty-corner move. Even then, devices struggle to hang on as long as possible.

I wonder if it is a device thing and not the network firewall. My laptop, for example, is fairly quick to switch. But my phone lingers longer.

lajackson wrote:In one of our buildings, we have four hallways forming a square. There is a Cisco WAP at each corner. It is rare that a device switches from one WAP to another, except when you make a kitty-corner move. Even then, devices struggle to hang on as long as possible.

I wonder if it is a device thing and not the network firewall. My laptop, for example, is fairly quick to switch. But my phone lingers longer.

Pretty sure our buildings (at least when I was in that style, I've moved since so I'm in a U style now) were the same, my phone / tablets would routinely transition as I walked around the Building. I know of certaintity that iPhone products which are designed to be consumer friendly and not enterprise friendly had issues like the above. I would test by walking around when people weren't in the building and watching the green/blue light on the AP.

I routinely transition in other buildings where Cisco is implemented all around. I explained in the OP that I've seen this on at least 3 different clients - and if it was just the same thing as I always experiences I wouldn't have posted.

As this is a new church implementation it's likely that there is a config that needs to be addressed rather than each member being told that their client is the problem - If they were Apple products I could go along with it, but since I'm confident about the client devices I use and what they typically do in those environments, the change that was introduced is the more likely target of scrutiny. That just my thinking.

Question: I'd suspect the new Meraki AP's would be dual-band. Could that be an issue? (Client staying locked on 5GHz and not switching to a stronger 2.4GHz signal.)

This is probably more up your alley than mine, but what kind of setting might a network have that prevents a client from jumping from one AP to another?

In our Stake we have buildings comprised of all Cisco APs, all Meraki APs and one with a mix of both. We are still in the trouble shooting phase but handoff from the Cisco to Meraki / Meraki to Cisco does not appear to happen. Members can disconnect / reconnect and it will grab which ever has the stronger signal but roaming between the systems is non exsistent. I use the Meraki systems at work and have experienced the same issue. No amount of configuring on the back end seems to resolve this issue (we have had to make sure the SSD on the none meraki systems is different then the clients will release the Meraki and connect to the new SSD when the signal change is appropriate). We are in the process of trying to re allocate what we have to avoid any mixed brand AP systems. Will post results if we learn anything new.

blanerjensen,

Thanks for lending some actual experience to the forum question. Let's hope the Church teams have some kind of idea on what's going on. This is going to get really annoying very quickly.

This is somewhat of an educated guess and could be totally off, but it is my understanding that the Meraki devices are cloud managed while the regular Cisco devices talk to the Church's on-premise (in a datacenter somewhere probably) controllers.

Because these are two different systems, it is possible that the Meraki and Cisco APs don't even know about each other to even attempt handoff. If it's the same system (eg. all Meraki or all Cisco) the handoff is a lot more seamless because the devices coordinate client load.

In mixed systems, roaming is a lot more painful because it's completely up to the client device to decide, rather than the APs "nudging" the devices around to different APs with stronger signal. In the end it's still up to the device to actually roam.

Anyway, I could be totally wrong about the different controller setups but that's my best guess.

jamiep39 wrote:This is somewhat of an educated guess ... it is my understanding that the Meraki devices are cloud managed while the regular Cisco devices talk to the Church's on-premise (in a datacenter somewhere probably) controllers.

Because these are two different systems, it is possible that the Meraki and Cisco APs don't even know about each other to even attempt handoff. If it's the same system (eg. all Meraki or all Cisco) the handoff is a lot more seamless because the devices coordinate client load.

In mixed systems, roaming is a lot more painful because it's completely up to the client device to decide, rather than the APs "nudging" the devices around to different APs with stronger signal. In the end it's still up to the device to actually roam.

Jamiep39 is correct. Cisco APs connect to CHQ wireless controllers and Meraki APs are cloud managed. Since the control systems are separate, the Cisco and Meraki APs operate separately. Client devices are responsible for selecting and connecting to AP beacons, but some devices better switch between APs than others. APs connected to the same controller (either device or cloud system) better manage AP settings like channel and power level.

While the Cisco 1041N APs broadcast on 2.4 GHz, the Cisco 702i and Meraki MR33 APs broadcast on both 2.4 and 5.0 GHz frequencies. The 2.4 GHz frequency has less channels (and generally gets clogged faster) than 5.0 GHz, so having APs broadcasting on 2.4 and 5.0 GHz is generally better.

IMPORTANT NOTE: Meraki APs are activated against specific meetinghouse networks. This means if a Meraki AP is moved (and connected to) a different meetinghouse network, then the AP must be "Removed" from the previous MH network and then "Added" to the new MH network through Technology Manager (TM > find network > Devices > Access Points). A Meraki AP should never be moved between networks without "Removing" and "Adding" the AP as described. A moved AP will not be manageable in TM in the new network until it is activated against the new network.

This is quite frustrating, really. It appears that the decision to move forward with replacing the 881w would require a Mixed AP environment that we knew ahead of time would cause roaming issues but were callous enough to say that it's really the client's attachment to the AP that is the issue -KNOWING that the Cisco hand-off worked well already.

I've done more testing since. I've used a Galaxy S8, Galaxy Note 5, Nexus 7, LG G4, Windows 10 Laptop - All of them reacted exactly the same. I don't think this should just be written off 'not my problem' kinda thing . (As a note, my devices also interacted with a corporate cisco environment flawlessly and roam just fine)

Again, my point is that prior to the Meraki mixed-environment my clients roamed really well. I don't ever recall sitting in RS after having been in the chapel and looking a 1 bar, or nearly 1 bar holding on to that signal rather than switching to the one 10 feet above my head.

How is an STS supposed to help people manage their devices so they roam better in this new environment? It's a near impossible task. It's a bit embarrassing, really, to say, well, you'll just have to disable and enable wireless as you walk through the meetinghouse now.... we don't have any other options.

johnshaw wrote:This is quite frustrating ...

The Cisco 881W firewalls need to be replaced; but since the 881W hosts a wireless AP a replacement WAP is need in many locations. CHQ could have opted to ship a 701i AP instead. But with the decision to replace Cisco with Meraki firewalls, it made sense to implement Meraki APs instead. Granted the mixed AP environment is challenging, but the new hardware will provide additional (future) network capabilities. Eventually the Cisco APs will need to be replaced; when that time comes, the device will likely be a Meraki AP model. If a building were outfitted with the same type hardware (Cisco or Meraki) then activities like roaming might be better. But as my previously reply mentioned, if a Meraki AP is moved to a different building--then that AP must be "Removed" from the old network and "Added" to the new network through Technology Manager.

I reported this issue a couple months ago when we first set it up and my HQ contact didn't seem aware of it. So I used an extra 1041 we had from another building instead of the MR33 that came with the new firewall. But this week my FM said I absolutely had to install the Meraki. So I talked to another person at HQ on Friday and their answer was that roaming wasn't in the requirements they had to meet. But that the Meraki is better and that we had to use it because they already paid for it. They still don't seem to understand the issue.

Well it does confirm that the requirements for replacing the 881's in the meetinghouse networks didn't include a smooth or pleasant end user experience only the anticipated 'better' network stuff with the Meraki Cloud implementation. I imagine the benefits are great in this area, particularly as it relates to the International Church, however, I can't imagine a service out there that wouldn't include end user usage as an important aspect.

Just another reminder that we, as members of the church, are not the 'clients' of these teams at the Central Office.

As a former CHQ employee I can say that in general the meetinghouse technology group recommends the right solution but the facilities budget doesn't allow it.

Craig, while I understand the sentiment, I'm not confident that those things should be mutually exclusive. How can a solution be 'right' if it isn't within the budget? And is it OK to move forward with the solution the network team thinks is 'right' even though they know it will be substantially intrusive to members over the years until FM is able to pay to make it 'right'. Those Cisco AP's aren't going anywhere anytime soon, they'll last years and years.

Based on both items, the 'right' solution and the FM Budget, it seems that the solution should've been to replace the firewall with Meraki and the Wireless with a Cisco AP. Or at least instructed that a meetinghouse, as much as possible, be either all Cisco AP's or All Meraki AP's. It wouldn't be that hard in most Stakes... Stake Center with 2 or 3 other buildings - But regardless FM's can figure out that every third one put all the Meraki in and move the Cisco's to the other buildings to cover the new router w/o an AP built in.

An STS who cares will get this going easily, while FM's contract work out to get things done, they'll not worry about it because they don't have to support the local end users, that's the STS.

This is the Meetinghouse Internet Project all-over-again, the Come Follow Me project roll out, where teams all make decisions, roll them out and FM can't actually support them. When are we going to learn?

johnshaw wrote:Those Cisco AP's aren't going anywhere anytime soon, they'll last years and years.

I think the real question is when does support end? I think on the computer/network side of things, the church tends to get rid of things when the support lapses, not when it quits working.

Ya, those 881's just weren't all that popular as I understand it, my company ordered a few pallets of them and never actually used them because by the time we started to deploy them for what they were going to be used for a RaspberryPI device could do the same thing.... I don't think that's the same for the AP's I think those AP's are really sticking around.

But I just looked it up... Looks like end of Life is September 2018 for the 1040 Series..

http://www.cisco.com/c/en/us/products/c ... 27650.html

End of Life for the 881 W seems to be July 2019... a year or so later than the 1041 AP's

http://www.cisco.com/c/en/us/products/c ... 30681.html

I think more troubling is the end of software updates for the 881: July 3, 2015. If there's another date for security patches, I'm not seeing it.

That's not good for something that connects to the "wild" side of the Internet.

The APs seem to have the same date, but they're far more protected.

We are not able to disable wireless on the Cisco APs now that the Meraki firewall was installed. During stake conference that was really nice to use TM to disable wireless to conserve bandwidth. Does anyone else have the same issues that they can no longer disable the Cisco APs?

jkentner wrote:We are not able to disable wireless on the Cisco APs now that the Meraki firewall was installed. During stake conference that was really nice to use TM to disable wireless to conserve bandwidth. Does anyone else have the same issues that they can no longer disable the Cisco APs?

It must have been a timing issue. Our Cisco APs now show up in TM and they can be disabled!

jkentner wrote: It must have been a timing issue. Our Cisco APs now show up in TM and they can be disabled!

The TM enable/disable feature is done through the firewall controller for Cisco APs. After a firewall upgrade it may take a while for the Cisco APs to find a network controller. The message "Not found" flashes in TM for APs that have not found a controller. Pressing the refresh button on the "Access Points" tab will fetch the current AP/controller status. Note that a controller is not listed for Meraki APs (since they are cloud managed). When a Cisco AP is connected to a controller then the TM "Enabled/Disabled" feature works.

Is there a plan to re-integrate the ability to see what clients are connected to each AP? Before I could click on the AP and see what clients were connected to it. That was handy for troubleshooting.

At the training sessions for deployment of the Meraki equipment in our area, it was mentioned that by the end of 2018, some 19000 MX64s will be deployed worldwide. Assuming a delivered price of $500 each, we're looking at 9.5 million dollars worth of widows mites. Further assuming that to replace every single Cisco WAP would require no less than 50000 MR33s, likely much more, and now we're talking another 22.5 million at $450 a piece. We're at 32 million, assuming all of this equipment is installed by STSs or other "volunteers". I can confirm that this isn't happening because I've installed 12 of each so far as part of my job.

Why? So saints can check their social media feeds? I guess sports scores might be of interest as well. Don't tell me we need high-speed WiFi to view scriptures or hymn lyrics. I'm tired of telling people they need to download the videos they want to fill the gaps in their lesson plans before they come to the building. I only get concerned when people try to teach modern family history tools. Even then, I suspect the problem lies in church servers getting pounded on Sundays. A few years ago, I was floored when I learned our FM Group bumped the internet speed at a seminary building in my stake, to 4 times what we had at the Stake Center. The seminary building has spectacular cellular coverage, but do we had to throw dollars at faster internet speeds for a building with a whopping TWO wireless access points, one behind a powerline adapter? The vast majority of church WiFi connected devices HAVE CELLULAR DATA already! Again, I ask, WHY?

I for one am grateful for firewalls with gigabit ports. With them, I'll get rock-solid inbound HD broadcast feeds, super strong outbound Stake Conference broadcasts, and the opportunity to provide at least one dedicated spot in my buildings for truly good Wifi. Admittedly, my old CIsco881w was able to do some of that. But Cisco has these inconvenient "end of life" policies. I see no wisdom in heavily investing in soon to be retired 881s, 702s, and 1041s. If I've got to sacrifice seamless mediocre WiFi to get better-focused performance, I'll take it!

I think the deployment of MX64s and MR33s is necessary and about as good as it can get without unlimited funds.

I am having wireless issues in a building. Getting complaints. I have been watching this for 2 years, so I know the typical expectations and usage etc.

Background: 7 CISCO 700 series APs.

Internet provider: Comcast

speedtest from wired clerks computer: 75+ Mbps sometimes I get up to 130 Mbps.
wireless no matter where I am in the building: <15 Mbps.
Latest test was with <20 people in the building and scattered throughout.
Last week several people were thrown off the wireless, or could not connect back, that happened to me.

This is a problem that started three weeks ago. I have power cycled all the routers and devices, and nothing has changed.

Using my macbook pro it showed the wireless tx Rate of 75Mbps connected on the 5GHz radio.

Using Technology manager I can not bring up connected devices, or bandwidth usage statistics anymore.
I am at a loss on how to troubleshoot this farther.

Any ideas appreciated.

Kevin
Logan, UT YSA 4th Stake

kreeve wrote:This is a problem that started three weeks ago.

That may have been when the firewall was changed out.

kreeve wrote:Using Technology manager I can not bring up connected devices, or bandwidth usage statistics anymore.

Currently, there are no usage statistics with the new Maraki firewall, but you should be able to get a list of connected devices. What is the firewall's status listing in TM? It should be a green check mark.

I think there's some Meraki magic making speed tests useless. From the same iPad, connected to the same MR33 (we only have one in our building), I've measured speed through Ookla ranging from 32 Mbps sitting next to the MR33 in the attic, 53 Mbps in the Relief Society room just below, and 98 Mbps in a room 30 feet away with lots of water pipes, commercial HVAC equipment and powerlines in between. The fastest test was measured last.

Nothing makes sense.

I use a program called Wifi Analyzer it only runs on Android. I only have 2 meraki APs one is the only one in the building the other is mixed with some 1041 APs I did notice that the Meraki was at least 20 DB stronger than the 1041 at the same distance. The Wifi Analzer program helped me prove that I building had taken a lightning hit and it fried the APs. The APs still showed up in TM but had no RF out.