Posts on Boldly Going Nowhere

AU 6GHz Upper band access

Fri, 20 Dec 2024 00:00:00 +0000

In Australia, the Australian Communications and Media Authority (ACMA) is the regulatory body responsible for managing the radiofrequency spectrum, ensuring that it is used efficiently and effectively to meet the needs of various sectors including telecommunications, broadcasting, radiocommunications, and online services. The ACMA’s role includes planning, allocating, and licensing spectrum resources, as well as enforcing compliance with regulations to minimize interference between different services and technologies.

Unlike other countries when it comes to Wi-Fi, and specifically 6GHz, we have been hampered with limited spectrum availability, thus limiting the channels available for use. Currently, Wi-Fi (or RLAN as it’s referred to by ACMA) is limited to the lower 6GHz band.
The full 6GHz spectrum is hotly contested space, being shared with Earth-to-Satellite services and TV Outside Broadcasts, as well as being wanted by other services like 5G.

Cisco Live Melbourne '24

Thu, 21 Nov 2024 00:00:00 +0000

Having been to, I think, 10 now Cisco Live events, this year was a bit different as I was presenting.
One thing as an attendee that you don’t get is an appreciation for how much time and effort goes into a 90-minute presentation. For me, it was about 1 hour of prep per minute of presentation in the lead-up to the event. I know for some others they spent even more time again.
My session covered Automating the deployment of wireless networks (9800 WLC’s) using Catalyst Center (formerly DNA-C).
If you’d like to watch the replay or review the deck, you can find it all here.

Meraki PCAP Analyser

Wed, 18 Sep 2024 00:00:00 +0000

Aside from the Proactive PCAP feature, this would have to be the best addition to the Meraki dashboard in recent times.
Not only can we view a PCAP that’s been taken, but we can also get some auto analysis (Meraki Assurance) on what the potential problem may be. This is handy for the seasoned Wi-Fi professional, but even more valuable for an inexperienced engineer as not only can it guide them to the issue, they can also learn from the problems at the same time.
Landing on the analysis screen, we are given an overview of the problem with the option to expand out the relevant sections for more detail. We can also view the PCAP in a Wireshark-like view straight from the dashboard as well, so this saves the hassle of downloading and opening the file for just a quick look. Given that the analysis has already been done, we are given a pretty good guide that in this instance we had a problem with DHCP offers not being received by the client. This gives us a quick answer, but sometimes we might still want to dig into what went on and actually investigate the flow of frames. For this, we can expand out the packet capture to view the frames just as we would in Wireshark. I’ve selected a bit more interesting capture for this exercise. From here we are presented with a default view or profile, which is okay, but not great. So down the bottom right-hand corner of the panel, we can adjust the profile depending on the scenario of the capture. Selecting the OTAWireless profile, we are shown the more relevant columns, and like most wireless engineers prefer, we get color-coded Frame Types. Just like in Wireshark, we can then create display filters. For a proactive PCAP this might not be as useful, but for a manual capture that you’ve then selected to store in the cloud, this is of more use. If we are investigating issues with retries for example, then we can use the following to filter all of the frames that are being retransmitted.

Meraki Proactive Packet Capture

Sun, 15 Sep 2024 00:00:00 +0000

The Proactive Packet Capture is a tool that I’ve used for a long time now in Catalyst Center (formerly DNA-C), so it’s exciting that it’s now been introduced to the Meraki side of the world as well.
With over 100 event triggers that can occur during the client onboarding process or normal operations, there is a fair chance that whatever issue a client is experiencing in the network will be captured automatically.
The Proactive PCAP does require MR31 or higher, and the APs need to be Wifi 6/6E or 7 to support the feature.
The retention time for proactive captures is 7 days, so when enabling the feature, you do need to decide if you want to enable it for some or all devices. You can select which APs you enable, which if you have a large/busy network would probably be the better way to go. Since I’m running this at home with only a couple of APs, I’m happy to turn it on for all devices. The other thing to note is that once this feature is GA, you will need an MR-ADV (Advanced) license to use the Proactive PCAP feature. This will be enforced in the future.
As this is for my home, I had to leave it to run for a few days, and I came back to find plenty of captures. Most weren’t ones to worry about, as they were ones like EAPoL timeouts that happened as we were leaving the house, but there are certainly real-world examples of where this would be important. Looking down the right-hand side of the page, we can see which step of the onboarding process the trigger occurred at (Authentication, Association, DHCP, etc.), and we have the option to analyze the capture directly on the dashboard or download the PCAP to review in Wireshark on our local machine.
These options are available regardless of if the capture was proactive or manually run. In the next post, we’ll have a look at the analysis view that we get on the dashboard.
Again though, this is another instance where the smarts of the product can help save time and effort by capturing events before you even know that they’ve happened, and can save many hours trying to recreate problems or disrupting users even further to try and reproduce.

Meraki Intelligent Capture

Sat, 14 Sep 2024 00:00:00 +0000

Packet captures have existed for a long time on the Meraki platform and have saved me great amounts of travel time over the years. But now they have had a refresh and not just a GUI makeover (okay, well it did get that as well), but new features added too. Proactive PCAP and cloud storage are the main stars here.
The old view served us well and was clean, easy to use, and just did its job. Now called Intelligent Capture, it still does what the old feature did, but with a newer, fresher look, and now includes cloud storage (so no more losing files) and the newest feature, Proactive PCAPs, which we will have a look at in the next post and create a bit of a series rather than one long post. Nothing overly exciting in the Manual capture, but if we select to save to the cloud, then it will be retained for 90 days before being deleted. We can apply our capture filters here if we need to only capture specific frame types, certain mac or IP addresses or even certain traffic types. Examples are also provided to get you started.
Really though I’ve only ever previously applied a capture filter for a specific mac address for the client I’m trying to troubleshoot, and then used display filters after to narrow down the specific information I want to see. Capturing as wide as possible (without getting too much unccessary data) and using a display filter after is always a much better solution I find, as then you don’t end up in the situation where you have to take multiple captures as you keep realising that you didn’t in fact capture all of the information that you need.

9166 Dual 5Ghz

Fri, 09 Aug 2024 00:00:00 +0000

A quick post today covering an issue that I’ve observed coming up a lot recently, which is catching engineers out, leading to deployment issues and poor user experience.

The 9166 AP behaves a bit differently from other models in that when it’s operating in a country where 6GHz has not yet been approved, obviously the 6GHz radio can’t be enabled, but it’s the behavior of the radio that catches people out.
From the 9166 datasheet: Note: In countries where the use of the 6GHz band is not allowed or authorized or if there is no current software support, the 6GHz radio will be disabled and will switch to 5GHz and operate as a dual 5GHz access point. The 6GHz radio may be enabled with future software, once the product is certified to operate at 6GHz for that country.

CWAP

Fri, 28 Jun 2024 00:00:00 +0000

I’ve collected that set!!!

The hardest of them all was left to last, after previously attempting the CWAP-402 exam a few years ago and falling one question short, I reset and started from scratch with my studies.
Off the bat, I will say that the exam itself isn’t harder than any of the others in the P series. What is harder is the topics covered. Know the topics and then the exam is okay. BUT just because I passed the exam, I still feel like there is so much more to learn, which isn’t necessarily a bad thing as learning should be constant, and no one knows everything. For context as well, this experience is based on the CWAP-404 exam, which is soon to be retired for the 405 exam, but I wouldn’t expect that too much would be changing as generally, it’s about a 105 difference from one to the next as old standards are removed and new ones added.
I won’t go into what the CWAP exam is, as if you are here, then you probably already know…
What I will say is that the first place you should start on your journey is the blueprint. Ignore the blueprint, and you probably won’t get far in passing.

Understanding Preferred Scan Channels (PSC)

Thu, 25 Apr 2024 00:00:00 +0000

Navigating the 6GHz Spectrum: Understanding Preferred Scan Channels (PSC)

I feel like I’m late to the party with 6E, but in reality, not having 6GHz approved for use in Australia for so long has just meant that there is more real-world experience to learn from that others have already gone through when it comes to discovering 6E networks.

With the introduction of the 6GHz band, Wi-Fi technology continues to evolve, offering faster speeds and reduced congestion. However, discovering 6GHz networks requires a new approach, and that’s where Preferred Scan Channels (PSC) come into play. This is actually the only method by which Wi-Fi 6E client devices are allowed to send probe requests when searching for 6GHz networks.

WPA3 Transition Mode

Mon, 18 Mar 2024 00:00:00 +0000

I’ve had WPA3 SAE transition mode configured for home now for a while, and whilst I wouldn’t use it in an enterprise deployment (too many bad drivers out there) it works (most of the time) for home and I’m not as concerned about PMF benefits. I would like to move to WPA3 SAE solely, but unfortunately there are still too many devices around the house that don’t support WPA3 and the overhead of running two SSID’s isn’t really worth it.
My home production network is Meraki, with the lab being Catalyst, but today we’ll look at the Meraki deployment.
Configuring the SSID for transition mode on the dashboard is straight forward. We select WPA3 Transition mode for the encryption type and make sure that 802.11w (PMF) is set to enabled. This means that clients that don’t support PMF and still only support WPA2 can still connect, but if the client supports PMF they can use it regardless of if they are connecting with WPA2 or WPA3. Within a few seconds the config is pushed to the AP and it’s now running in transition mode for this particular SSID.

9800 WLC Cat9k AP Default Console Baud Rate

Tue, 10 Oct 2023 12:21:35 +1030

The current long term 17.12 release of the IOS-XE 9800 WLC is feature packed, but tucked away in the release notes is a one liner that is sure to catch people out in the near future(or me the other day):
From this release, the default console baud rate of the 802.11AX APs is changed from 9600 bps to 115200 bps. What does this mean?
Well, digging a bit deeper, it only covers the Cat9k range of AP’s, so 9120, 9130,9136, 916x, etc
AND
It only impacts new (or factory reset) AP’s when they join the controller running 17.12 or higher. So if AP’s are already joined to the controller and are upgraded from 17.9.x to 17.12.x then they will still use the old 9600bps rate, but then if you add a new AP to the controller, that will use the new setting of 115200bps.
If an upgraded AP is set back to factory default though and joins the controller again, it will assume the new 115200bps config. So you could/will end up with some AP’s on the old 9600bps config and some on the new 115200bps config. Or, once upgraded to 17.12 or higher then factory reset all AP’s from the CLI/GUI (not recomended unless you are bored and have a lot of time and a real reason to do this), and then you’ll have a standard across the board, no matter which AP you connect to (that’s a Cat9k AP anyway, Wave1/2 are not impacted by this!).
WHY?
Turns out the reasoning for this is simple, it’s so that the AP can boot faster!

Introducing Wifi 6E

Sun, 25 Jun 2023 14:44:12 +0930

Because marketing people like to make things confusing, we have Wifi 6, and now Wifi 6E. So what is the difference?
Both are based on the 802.11ax standard, so no difference there.
What 6E does is introduce support for the 6GHz frequency, which means more channels, less CCI, and the ability to deploy wider channel widths.
Like the 5GHz spectrum though, different countries have allowed different parts of the spectrum to be available for 802.11 use, and like 2.4GHz and 5GHz, this is unlicensed spectrum*. Another thing to note is that currently 6E is only approved for indoor use.
Let’s break down what 6E actually introduces:

CWISA

Wed, 25 Jan 2023 10:37:09 +0930

This will be a short post, summarising my experience with the CWISA exam, which I passed recently. The Certified Wireless IoT Solutions Administrator, or CWISA is the assosciate level exam that starts you on the CWNP IoT certification track. It is also a requirement for CWNE certification.
As it’s an assosciate level exam, the depth isn’t huge, but the topics covered are broad. I took the newly released CWISA-102 exam. This exam will stay current until September 2025, as it was only recently refreshed.
For study, it’s first important to thoroughly read through the exam objectives to understand the topics covered, and the depth of knowledge required.
As I’ve already had quite a bit of experience with a lot of the topics through my home automation journey, this wasn’t a hard exam to study for, and using the study guide from the previous version of the exam was sufficient for me, with a couple of read throughs. My prior knowledge of zigbee, as well as having previously passed CWNA certainly helped to speed up the process.
I always ensure that I get the official practice exams, as they are a great gauge of where i’m at in my preperation, and they also help to prepare you for the typical language used in the exam. This is always important for me, as it gets my head in the right space and can help for some of those questions that are worded a little funny that you see in ever vendors exam.
Even with my confidence, I was still nervous heading in to the exam, as you do wonder if you are being over confident in your prior knowledge, and will it actually stack up when the time counts. Thankfully it was more than enough to get me through, and I was soon able to breath a sigh of relief when the confirmation that I had passed came up on the screen with a 51/60.
The exam is certainly fair, and covered all of the topics listed in the objectives, with the expected level of knowledge required for all of the topics in order to pass.

802.11 Roaming

Mon, 10 Oct 2022 16:28:49 +1030

What is 802.11r roaming and why is is so important to users (and you)?
Wireless roaming is an essential feature for any wireless network, especially for those that are deployed in large, multi-building environments such as universities, hospitals, and campus networks. A simplified explanation is that “802.11 roaming refers to the process by which a wireless client device seamlessly transitions between different access points (APs) or base stations within a wireless network while maintaining an uninterrupted connection. Roaming is crucial for mobile devices, such as smartphones, laptops, or tablets, as they move within the coverage area of a Wi-Fi network.”
The reality is that acheiving this is a hell of a lot harder! BUT we have some standards and nerd knobs that help us to make it a little bit easier.
These include:

Zigbee

Mon, 11 Jul 2022 16:36:25 +1030

Having had Zigbee in the home for a couple of years, and getting more and more devices spread across the home, I figured it was time to understand a little more about the protocol, and also work toward my CWISA certification.

Zigbee is a wireless networking protocol that is primarily used for low-power, low-data rate applications in the Internet of Things (IoT). Zigbee falls under the IEEE 802.15.4 specification, which covers a suite of high-level communications protocols for creating personal area networks (PANs) via low-power digital radios.

CUCM Convert LDAP to LDAPS

Tue, 18 Feb 2020 09:38:21 +1030

This post is applicable for both CUCM and Unity Connection, but for simplicity sake we will just cover CUCM here. The process of uploading and converting Unity Connection is the same. This process is also the same no matter which version of CUCM/Unity connection.

Cisco have released the following field notice that covers upcoming changes to connections between CUCM/unityCx and LDAP servers for syncronising and authenticating users.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/12_5_1/fieldNotice/cucm_b_fn-secure-ldap-mandatory-ad.html

The short of it is that Microsoft are enforcing that connections should now be over SSL rather than unencrypted transport methods. This was initially going to be enforced from March security patches onwards, but has now been pushed back. Regardless of the time frame though, it is important to make these changes now, rather than be caught in a rush later.

Google Chrome Revoked Self Signed Certificates

Fri, 03 Jan 2020 10:25:14 +1030

Google Chrome can block you from getting to your lab devices (like your WLC) or other devices that have self signed certicates. If you get an error like this, and you can’t get past, then there is still a way without having to buy a signed cert!

To get around this click somewhere on the page and then type thisisunsafe

Then like magic Chrome will load the page!

CWNP Certification Program

Thu, 08 Aug 2019 10:19:48 +0930

This post is more about finding where to start with the CWNP program, rather than focussing on any particular exam or level of knowledge.

The CWNP certification program is vendor neutral, and is seen to be the best way to learn about wireless without any specific vendors terms or proprietary information being thrown at you, and best of all you don’t have to remember any menu structure or config file structure for the exams…

Generating a Self Signed Certificate on Windows Server

Mon, 22 Jul 2019 12:04:17 +0930

When configuring a Windows server with the NPS Role in order to authenticate wireless clients using PEAP (Protected EAP), you may need to generate a temporary self signed certificate in order to complete testing, or finish the configuration. Configuring the NPS server for PEAP authentication is outside of the scope of this post, and may be covered in a future post, but this will at least allow you to generate a Certificate in order to get the services running and testing completed.