Strange Behavior with MR34

[vassallon]

So we were having issues in one of our classrooms with iPads (iPad Air) not connecting other than the teacher's iPad (iPad Air 2). We reset the MR34 and even went so far to replace it with a Spare MR34. Now the student iPad Airs are connecting but teacher iPad Air 2 are not. Error Log for Teacher iPad

Even when trying to MacBook on the AP for troubleshooting we see the same type of messages. Both MR34 are running the Current version: MR 25.9 firmware. We are only broadcasting on 5 and have 2.4 turned off (Power 0). A cable test to the AP is also showing no issues.

Cable Test

Any thoughts as to what may be causing issues in this haunted room of ours?

[simple818]

The devices work when connected to other access points on the same network (in the same building) just not one of them? Because the error would seem to indicate an 802.11 issue. You could make a temporary SSID with WPA2 to test and verify.

[vassallon]

@simple818 It's the same SSIDs that are broadcast and working everywhere else in the building. It just seems to be specific to this one classroom and there has been strange behavior with now two different MR34 in the room.

[Asavoy]

It's easier to troubleshoot one device not connecting, rather than multiple devices.

Since it's currently just the one Air2 that's not connecting, have you done a network settings reset on it?

The only difference between the Air and Air2 in terms of their wireless is that the Air2 is capable of 802.11ac, so that's a good place to look at the Meraki settings. I had a wireless docu-cam (2.4ghz) that wouldn't even see my SSIDs with bandwidth steering turned on. I've also seen some newer devices just not wanting to connect to the 5ghz band, and with bandwidth steering on, they couldn't even see the 2.4ghz band with inSSIDer.

[vassallon]

@Asavoy It is multiple iPad Air 2 having issues and also my test MacBook. We have tried resetting Network Settings on the teacher iPad and even tried a second iPad for her with the same issues. The iPads are running iOS 11.3 and 11.3.1 and the MacBook is OSX 10.13.4.

[Asavoy]

@vassallon If you're also having the issue on a Macbook, then definitely run a program like inSSIDer to see what bands the Macbook is seeing. Depending on your setup, you should see each of your SSIDs and WAPs listed for each band that are broadcasting. I had a problem room like that where the Chromebooks wouldn't connect to the staff network (or would have poor connectivity) but would connect to the open public network. When I scanned the room for signal strength, I could not see one of the bands in that room, but could see the adjacent room. Once I turned bandwidth steering off on the SSID I was able to see all bands. It hadn't been an issue previously, but it's possible the forced update I had to go through did something. (Yes, Meraki forced me to update and I couldn't opt out).

[vassallon]

Okay so this is even stranger now. The APs around the problem AP are showing a spoof with a MAC address that is remarkably similar to the MAC on the AP having issues.

[Asavoy]

That's not really out of the norm. I take most of the dashboard results like that as being 'false-positives', especially with that being around the time you added it into the network. (I'm assuming that anyhow).

Can you post a screenshot of a scan from a program like inSSIDer?

[Philip D'Ath]

I have seen this before. The "spoof" in the report is the key. What happens is Meraki thinks one of its own access points is a rogue, and sends de-authenticate frames to prevent people attaching to it.

If you are not running 25.11 - upgrade to that first. Failing that try rebooting all the Meraki APs in the area.

[vassallon]

@Philip D'Ath Right now our APs are reporting up to date on 25.9 and I have a support case open with Meraki so I want to see what they have to say before rolling 25.11.

Thanks for the information though it does confirm that I was headed down the right path on the issue.

[Asavoy]

@Philip D'Ath But, if that's the case, then how are the iPad Air connecting to it just fine? Unless they're picking up signals from other rooms, but those devices tend to try to attach to the strongest signal.

[Philip D'Ath]

Could be using a different band, could respond to de-auth frames differently, who knows. All I know is I would be upgrading to 25.11 (as 99% of our customers already are using).

[Asavoy]

Personally, I'm not trusting my wireless infrastructure to Beta firmware when the 'stable' firmware is buggy. The first answer to a problem should never be 'try beta firmware' unless the company is paying you to do it.

Besides, introducing a Meraki WAP into an existing Meraki infrastructure should never cause a 'containment' issue. I mix 34, 42, and 52 and have never seen this. Heck, I'm about to introduce an Ubiquiti device into my infrastructure for testing purposes. This will be fun!

[Philip D'Ath · Accepted solution]

Meraki firmware release cycles is not like what you are used to.

This is the general process:

https://documentation.meraki.com/zGeneral_Administration/Firmware_Upgrades/Meraki_Firmware_Release_Process

The bit to note is:
"When Meraki's install-base hit a specified threshold for a major version (roughly 10-20% of nodes), that firmware revision will be promoted to GA, pending a final formal review."

So you can have a "stable" release with bugs. A "beta" firmware version may have these bugs fixed and been out for quite sometime, and all round be far superior. But until 10% to 20% of the nodes in the world deploy that beta release it can't be considered to be declared a "stable" release.

So in the worst case, if everyone in the world said they were only ever going to run the "stable" release, you would never get a beta image promoted to replace it.

Change to 25.11. You wont regret it. 25.11 is all round much better than 25.9.

[Asavoy]

@Philip D'Ath I don't have much of a choice as Meraki is now forcing an update to 25.11 on one of my networks. Teaches me to come here and say anything bad about their software, right?

And I understand that the process of how they release the firmware isn't standard alpha/beta/gold type of thing, but I still look at their product as buggy as hell, especially updates that aren't "stable". I would rather not be forced to be a guinea pig for things of this nature- I can screw up my wireless infrastructure on my own, TYVM.