Checking Out The Juniper AP45 Access Point: AI Powered Enterprise WiFi!

Mist AI demo: juni.pr/3KKY4bw
Mist AI product tour: juni.pr/4bjD1I5
**********************************
Check us out online at the following places!
linktr.ee/leve...
IMPORTANT Any email lacking “level1techs.com” should be ignored and immediately reported to [e-mail].
-------------------------------------------------------------------------------------------------------------
Intro and Outro Music By: Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0 License
creativecommons...

[@pyroslev]

When Wendell goes down a Rabbit Hole, we all benefit from his time in Wonderland.

[@BBWahoo]

When I do it, I get arrested for beastiality lol

[@abavariannormiepleb9470]

A suggestion for a Level1 WiFi Guide: A step-by-step manual how to set up a WiFi that might also be used by potentially evil unkown devices, think of a small mom-and-pop shop that offers WiFi to customers or if you have guests visiting. A general short checklist might be helpful with additional details how to protect against client VLAN hopping etc.

[@KastanDay]

I asked GPT-4o: # Guide to Setting Up Secure WiFi for Public Use ## Objective Set up a WiFi network that offers internet access to customers or guests while ensuring network security and preventing potential attacks from malicious devices. ## Checklist 1. **Separate Networks**: Use separate networks for internal and guest access. 2. **Strong Encryption**: Use WPA3 for WiFi encryption. 3. **Network Segmentation**: Implement VLANs to separate internal and guest traffic. 4. **Guest Network Isolation**: Enable client isolation on the guest network. 5. **Firewall Rules**: Configure firewall rules to limit guest network access. 6. **Regular Updates**: Keep all firmware and software up to date. 7. **Monitoring**: Implement network monitoring to detect suspicious activity. 8. **Access Control**: Use MAC address filtering and RADIUS for access control. 9. **DNS Filtering**: Implement DNS filtering to block malicious sites. 10. **Bandwidth Management**: Use QoS to manage bandwidth allocation. ## Detailed Steps ### 1. Separate Networks - Use a router that supports multiple SSIDs and VLANs. - Configure one SSID for internal use and another for guest access. ### 2. Strong Encryption - In your router settings, select WPA3 for both internal and guest WiFi networks. - If WPA3 is not available, use WPA2 with a strong passphrase. ### 3. Network Segmentation - Create VLANs on your router or managed switch. - Example configuration for a managed switch: ```sh vlan 10 name Internal_Network untagged eth1 tagged eth2 exit vlan 20 name Guest_Network untagged eth3 tagged eth2 exit ``` ### 4. Guest Network Isolation - Enable AP isolation or client isolation in your router settings to prevent devices on the guest network from communicating with each other. - Example setting: ```sh interface wlan0 ap_isolate 1 ``` ### 5. Firewall Rules - Configure firewall rules to restrict guest network access to only the internet. - Example iptables rules: ```sh # Allow guest network to access the internet iptables -A FORWARD -i eth3 -o eth0 -j ACCEPT iptables -A FORWARD -i eth0 -o eth3 -m state --state RELATED,ESTABLISHED -j ACCEPT # Block guest network access to internal network iptables -A FORWARD -i eth3 -o eth1 -j DROP ``` ### 6. Regular Updates - Set up automatic firmware updates for your router, or regularly check for updates manually. ### 7. Monitoring - Use network monitoring tools like Wireshark or PRTG Network Monitor. - Set up alerts for unusual traffic patterns. ### 8. Access Control - Implement MAC address filtering to limit access to known devices. - Example setting: ```sh interface wlan0 mac_filter 1 mac_list 00:11:22:33:44:55 ``` - Use RADIUS server for additional security. - Example FreeRADIUS configuration: ```sh clients.conf: client guest_network { ipaddr = 192.168.1.0/24 secret = your_shared_secret } users: guest_user Cleartext-Password := "guest_password" ``` ### 9. DNS Filtering - Use a service like OpenDNS to block access to malicious sites. - Example setting: ```sh interface eth0 dns_nameserver 208.67.222.222 dns_nameserver 208.67.220.220 ``` ### 10. Bandwidth Management - Configure Quality of Service (QoS) to prioritize internal traffic and manage guest bandwidth. - Example setting: ```sh interface eth0 qos enable qos max-bandwidth 5000kbps ``` ## Conclusion Following these steps will help you set up a secure WiFi network that can be safely used by customers or guests without compromising your internal network's security. Regular monitoring and updates are crucial to maintaining the security of your network.

[@jtkachlmeier]

The timing on this video is perfect. I have a Wi-Fi 7 mesh network fed by 10gig ont to 2.5gig switch. It's super fast but it's literally line of sight or it's as slow as 2.4ghz. We need software to combine and switch the frequencies to make it more viable.

[@gtvwill]

This already exists....Its more that it should be automatic where as at the moment you have to do it manually. You basically have to walk around your site and log the strength of each wifi node and take note at the "crossover" points. Like doorways between rooms. You then have to set each node to basically only accept wifi devices within X strength. X strength being available everywhere you need within that room and not in the room next door where there is a stronger signal available. Its a tedious thing to correctly setup at the moment but its definitely possible. Its how you can setup a place like a school hall that gets hundreds of users sitting in one giant space, using a bunch of low cost nodes across the ceiling in a grid. Basically only allowing them to accept connections with a signal @ strength that is just under them, and kick everything under that off. A lot of these mesh devices use omni directional radios, so you get wifi basically in a sphere around them, the further away the lower the signal. Sorry if thats not clear, its hard to explain. I havent had a dense enough network yet to need to implement it though.

[@ahslan7304]

The fact that Wendell also uses Teracopy makes me so happy 😊

[@Destroyer954]

KDE wallpaper on windows 11? what an absolute troll :D

[@wendelltron]

New to my vfio setup I see 😂

[@sziehr]

Greetings, from a network eng just a state bellow you. I have deployed mist and I call it a help desk force multiplier, as it lets my guys engage on issues quicker and faster, while reducing the escalation to my desk at the top of the stack. The sore spot is the cost, they are not cheap, however they do not just die when the license lapse like there meraki cousins. I am a big fan for the right customer of mist, with a juniper switch. That said I had some issues with roaming when your RSSi is close the client and the AP get confused at times. This arguable was years ago so, and that was my only issue. I think you will like them, and with the BT beacon radio you can then so position location of users based on the RSSi of the users handset. If you have juniper questions let me know, least I can do, your videos on UBNT have helped me translate my enterprise eng back to my house and small biz deployments with UBNT.

[@IT10T]

they call it UI now

[@spidersj12]

Wendel, isn't it "the lay of the LAN"? 😂

[@Alichakkour39]

Another cool feature with these APs is that the 2.4Ghz Radio can be converted to an Extra 5Ghz Radio. Essentially giving you two APs in one which loadbalances the client amount per AP.

[@larrylarrington9229]

I work at a hospital we recently switched from Cisco wireless to juniper mist and we are really liking it so far. We have a very high density ap45 deployment

[@MikeDawson1]

hey i hate your icon, made my wipe the screen - thanks :D

[@MrSkyl1ne]

I have some experience with the TP-Link Omada wifi 7 AP's, these also work surprisingly well and don't require any subscription. Ofcourse the cloud controller subscription offers more enterprise level features, but for small businesses and home users, the basic hardware controller works great. I think WiFi 7 APs are somewhat misunderstood, you can either use them as high density APs due to their fast 10G or dual 10G backhaul, or for low density high performance situations. The implementations i've seen use WiFi 7 APs for a few locations with high demand on speed and/or density inside a building, the rest of the building would use simple WiFi 6 APs. 320Mhz wide bands aren't used in real world situations for now. It's a waste and very few clients support it. Generally you'd limit a wifi 7 AP to 160 or even 80Mhz for higher density usage. Yes, that would make it more like a WiFi 6E AP, but I don't think WiFi 6E will be sold for much longer. It will just be called WiFi 7 and used as a WiFi 6E AP. Why? Because of marketing, 7 is better than 6, and the cost of the chipsets and other materials won't make a significant difference. Most manufacturers will both in consumer aswel as in business networking offer either wifi 6 or wifi 7 products and phase out 6E completely.

[@17wasSquared]

Nit: Most enterprise deployments use 40MHz for 5GHz and likely 80MHz only in 6GHz 160MHz is somewhat in play for 6GHz, but 5GHz is too congested in real world deployments to use anything larger than 40MHz

[@spiralout112]

Yeah i picked up a wifi 7 TP-Link eap773 because i didnt want to spend $500 on the eap783 with the better antennas. Was kinda shocked at how bad the range is, although not much worse than the unifi ap ac lite it replaced, but still it's at the point where a few walls will leave you with basically no signal.

[@NobleHays]

At the university we assume we need to cover 3 devices per student, and we have classrooms that seat 50+ so we've been running 5-6 APs/room for years. I'm on a 3 building "small satellite" and i've 200 devices to replace this summer. We're moving from extreme 3935i's to their 5010s right now, so just now offering 6, it's already been a headache.

[@t8pguw8ejbwgp9e2]

Please do Ruckus also. And take apart APs in the videos. 8x8:8 is cool but sacrafices a little sensitivity in most designs. 4x4:4 is sweet spot for raw sensitivity. HE80 MCS11 on 5GHz sensitivity is arguably the most important spec. Never gonna use more than 80MHz in enterprise. 4K QAM MCS12 / MCS13 needs at least 6db more signal than 1024QAM MCS11, yet only nets you ~15% speed boost. And -50dbm is hard enough to target as it is. If client even licks -56dbm for a second, you'll loose MCS11 so need target -50dbm real world. The Ruckus self hosted virtual appliance gives you control. Mist aka missed wireless. Misses all the users. If the product just works, maybe you dont need all the extra troubleshooting features😂

[@shenidan2023]

The same ruckus that refused to fix wifi ap vulnerabilities for some of their models rendering them destined for landfills around the world. Nice play ruckus..

[@t8pguw8ejbwgp9e2]

​​​​@@shenidan2023if you're referring to root, some homelabbers actually love root. And anyone who doesn't want root also isn't using anything that old. The fact you can download firmware without a login, cross-flash between Unleashed, standalone, and managed at will, and unleashed is free leaves not much to complain about IMO

[@LackofFaithify]

Well damn. Someone finally put out a perfect definition of what anything called, "Enterprise" should be. All too often it just seems to mean, "not complete hot garbage, but a lot more money," and that is about it.

[@jessedunn3766]

Customers were shocked at the AP density increase between 2.4ghz and 5ghz. I can't imagine how crazy 6ghz would be with it's poor signal propagation and penetration. If you model it in Ekahau it's about 5x like you said and don't forget about having to add switches if you want to do it right without slower mesh backhaul. Cost versus benefit is just not there. Who even needs more than gigabit wifi?

[@Gearbhall]

Some people in the comments don't realize how much the price per unit changes when you order a few thousand of something.

[@druxpack8531]

maybe they all work at small/medium businesses...where i work, we have 2000k employees across 25 buildings and have under 300 APs..

[@danieljonsson8095]

As long as the need $900 for a 5 year license to even use the features, then they're not IMO reasonable to use even in the enterprise space... And I say that as someone that in general likes Juniper gear. But their AP licensing is IMO ridiculous. Even a minimum 1 service license is $350 for a 5 year license.

[@LabiaLicker]

insanity

[@Alichakkour39]

I disagree the amount of time savings mist has allowed me at my enterprise job environment has been well worth the money. I run Aruba, FortiAP, Cisco Meraki and Mist. They charge a premiun that sucks but compared to all my other environments the amount of management is minimal tbh.

[@danieljonsson8095]

@@Alichakkour39 Had it been per site or whatever it would be fine. But 900 at 5 years, means 15 a month per ap... 60 ap per building, 4 buildings and it's 3600 a month for this site alone. That's about what a full time, well educated tech costs here in wage. And you can forget that the time saved is THAT much... It may very well save you time, but for it to be worth it, you're looking at absolutely ridiculous time savings required.

[@kellymoses8566]

You should see how much Meraki costs.

[@danieljonsson8095]

@@kellymoses8566 I know how much they cost. It's way cheaper. About 400 for the full enterprise license for 5 years. Giving you the same features as the Juniper $900 license. For one equivalent to Juniper's 350 license, Cisco costs 150... So they're less than half the cost for license... Still ridiculously expensive, but way better than Juniper's price.

[@abavariannormiepleb9470]

What sucks: Some new WiFi 7 APs don’t support 6 Ghz, be careful when selecting a model!

[@SwirlingDragonMist]

Did the Battle for Naboo teach us nothing about wifi enabled Drone Swarms?

[@Alichakkour39]

Some industry colleagues told me that Juniper/Mist teased their upcoming 802.11be / wifi 7 AP at WLPC Phoenix!

[@17wasSquared]

I didn’t stop by their booth at this year’s conference, but they gave away an AP45 to every attendee who showed up to their dinner. The atmosphere was extremely chaotic with how many people showed up! Juniper very clearly has some smart people working for them. They caught the industry on the back foot and are reaping the benefits. Will be interesting to see how things shake out post-acquisition.

[@FrenziedManbeast]

I recently bought and returned a WF7 AP (Zyxel) to try and upgrade my old Netgear Nighthawk AC in AP Mode. It had multiple seizures whenever I connected certain clients like a Roku TV (yes I know Roku is practically Satan at this point, but it was a free TV so *shrug* hail Satan?) So I had to return that. I'm still looking for something with multigig backhaul and WF7 at non absurd prices but seems like I'll be chillin with WF5 for now. Edit: Love the look of that Framework Laptop. I'm over here licking my chops hoping to see a nice Zen5 refresh with a better GPU option on their lineup soon!

[@abavariannormiepleb9470]

Just to be sure: Did you try reflashing the entire firmware of the Zyxel AP (not just updating the existing installation)? Have an older Zyxel Enterprise WiFi 6 4x4 AP and it took quite a few firmware updates until it became stable.

[@FrenziedManbeast]

@@abavariannormiepleb9470 yes I think I got a lemon - sent it back to amazon after a full weekend piddling with it. Wifi5 gets 'it' done around my place for 90% of tasks anyway so I'm not in a rush. I'll wait for 7 to mature a bit more in terms of firmware and price in the meantime.

[@hongtanke]

Meraki is way cheaper than juniper. The mist license is $300 a year, then you need per device license cost then it's $1500+ per device.

[@Soullego]

Comparing meraki and mist kind of stupid, sorry man.

[@Alichakkour39]

Depends on who and where you are. Meraki quote was about 15% more expensive than mist.

[@wiziek]

there is no comparison.

[@AgentLokVokun]

Wifi 7 does not need the same density as Wifi 6 or 6e. You make it **strategically** dense where it makes sense. Meeting rooms, class rooms, places that are not hallways etc. If you replaced every wifi 6 AP with a Wifi 7 AP you'd have a good enough solution with out going crazy.

[@BobBobson]

So does "AI powered" mean it's gonna suggest putting glue on pizza?

[@Saphykitten]

I did it, don’t do it. The computer is out to get you

[@adampope5107]

From my understanding, it's a help desk type chatbot and problem ticket generator so nothing new. Basically a google search on the knowledge base and collation of statistics for people who don't understand what they're looking at so they don't have to "waste time" figuring out what's wrong. I haven't used juniper software so I could be very wrong about that. We have infrastructure monitoring software that uses machine learning now but it generates a ton of misleading tickets that'll claim processes are dropping way more packets than are even being generated, and system resources being maxed out way longer than they actually are. It's super annoying because the old system was based on utilization over set time periods which generated tickets based on real average and peak utilization rather than making it up. The model seems to detect any peak over very short time periods and then extrapolates it out over an hour. My KPI looks great though because I'm closing like 20% more tickets and much more rapidly so...

[@808jpm]

I have 3 older AP41s in a 2k sf area. One is even wirelessly uplinked (mesh) with a couple (rarely used) wired devices hanging off it. I'm going to add a 4th to extend the perimeter coverage. I have had drops on teams calls in one area, possibly just a bad spot blocked by a refrigerator. My Mist trail expired years ago and the Wi-Fi 5 APs are quite inexpensive surplus...just make sure they are unclaimed. Besides that one spot I have seamless roaming and enough coverage that a single AP can reboot without noticing.

[@RogerHorine]

Let's send him more Juniper gear to set up a larger test sandbox. Everyone benefits with his thorough testing! (Disclosure: I am a Juniper contractor.)

[@sheepieee7096]

Just implemented 40 of these in our head office. So far so good but MIST is still a work in progress!

[@VeniVV]

It is, but they are actively working on it. I'm seeing many changes all the time! And our rep has been very responsive to our feature requests and ideas.

[@jfkastner]

Complexity can come back to bite you RE Troubleshooting, buggy Firmware or Exploits. Sometimes I rollout more APs but with reduced Antenna Power output so they don't interfere with distant ones.

[@adampope5107]

Meraki gives all sorts of logs on client issues like not being able to communicate with DHCP or DNS, and SNR, etc. It doesn't automatically do packet captures but you can toggle it on. I haven't used that yet though because all the issues I've worked on so far have been the initial configuration by the installation team.

[@whalesmiff5712]

"The man's thorough... He's very thorough." - The Big Lebowski

[@TheJensss]

License requirements = Not interested. Cloud base = Not interested. No support for a local self hosted controller = Not interested.

[@MikeBob2023]

01:13 Suffering empowers learning. 🎓

[@jasonchia9478]

Moving to the cloud also means corporate offices are getting smaller, less office space, less density. Would enterprise solutions continue to make sense especially needing more APs to cover the same area?

[@davidbronke5484]

I'd love to see a good reliable consumer grade mesh wifi system that can be run without cloud connectivity. The best I've found so far is Netgear Orbi, but it does introduce some friction when using it with a separate router and with VLANs to segregate traffic... And apparently my Orbi Pro set is already EOL even though I bought it less than 3 years ago.

[@IT10T]

I always wonder how to correctly say Meraki, it seems like Asus, where half say it one way and the other a different way.

[@ishu87]

Majority of the time I watch your videos to learn because majority of the time I have no idea what you're talking about and I'm curious... Majority of the time 😅

[@RedScare67]

These are WiFi 6E, right? Tri-band - 2.4, 5, and then the 6-ish?

[@abavariannormiepleb9470]

Yes, “just” 6E (= WiFi 6 + 6 Ghz support), not 7 (2.4 + 5 or 6 GHz at the same time to a single client).

[@proxgs7703]

So I can run a Minecraft server inside my AP, nice!

[@Jerrec]

I liked the Mist ones, but I utterla dislike how they developed at Juniper.

[@thomaslindell5448]

Those are not supposed to be mounted to a wall vertically like that

[@TheRealStevenPolley]

11:28 lmfao

[@daikucoffee5316]

Just send us your phased array antenna and we’ll figure out how many Watts your brain can take. 😎

[@OsX86H3AvY]

Ive had a HUGE problem at the school I work with the Chromebooks that have either Realtek 8822CE or Qualcomm QCN-something-cheap wifi where it will almost be like the connection gets 'stale' and it will show connected but not actually work. The Intel wifi chipsets haven't ever had this issue but realtek especially does and the QCN one does occassionally...it drives me NUTS because theres nothing wrong with the card itself...i forget the AP brands we have but we use them with Extreme wireless and it just makes me pull my hair out

[@MStrong95]

So if you have ever tried using the Windows Server editions before for more normal personal computer stuff, you'll probably have discovered that not everything likes to run like it would for the home and professional editions of Windows. Is there a way to port the server features (like data deduplication) into a more typical version of Windows anymore or is there perhaps a way to make a Windows server edition report to programs that they are actually running under a more typical version of Windows like professional or home?

[@50PullUps]

You will want Windows 11 Professional For Workstations.

[@50PullUps]

Data Deduplication is available on all modern NAS operating systems. If you need Data Deduplication you should buy a Synology or spin up a TrueNAS.

[@TomPotato-f7v]

Fedora wallpaper but it's windows 11? Wait, whut? ^_ ^ Also, RIP Ruckus.

[@philliumo]

Running microservices on the WAP? PiHole anyone? Don't even bother the router with the request, just deny the ad right at the source!

[@MikeDawson1]

so i can get these as a home user, and not have have a yearly license cost or a cloud dashboard?

[@MikeBob2023]

02:03 To be clear: I'm strictly a 'Walmart crap' kinda guy (but every once in a while a crumb falls from the table 🤔).

[@riffzifnab9254]

"Come with me on a journey of suffering and learning!" Yup, sounds like a tech channel

[@13loodLust]

Can you actually do this for other stuff from Aruba, Arista, etc?

[@frzen]

I am looking at putting aruba 655 in for a refresh taking out ancient sonicwall aps. Mist isnt making the shortlist... 10 aps 150 person company but only maybe 60 on site average.i think i just need the aps and a 10 unit license for the on prem controller vm for 5 years plus the APs themselves?

[@JoriDiculous]

and here i am trying to figure out how to get internet from house a cross the yard and into the other building as easy and costless as possible and not going the mesh-way. Been sniffing lightly on Ubiquity and its not exactly cheap. And do i really need a whole infrastructure of "ubi"

[@mattd5136]

@JoriDiculous if you can stomach the brand, TP-Link have been ripping off Ubiquiti hardware for a while now but sticking with standard WiFi specifications. IMO it's a reasonably priced option that plays well enough with others. I'd definitely not use it for enterprise level stuff but for plumbing a low-speed link across a SOHO yard to another building it works pretty solidly.

[@cdoublejj]

interesting

[@erictrauman2879]

4x4x4 is were its at

[@0mnislash79]

1.5k for one 😟

[@Vincentl2189]

My level 1 and 2 cant spell PCAP

[@rekire___]

*the what now?*

[@Renull55]

more

[@LabMonkey-k2j]

getting radiated to the bone but at least i have fast internet 🤪🤪

[@pooticus2087]

enis.

[@ddzwiedziu]

Wow an AI black box in na enterprise black box. Wow.

[@MelroyvandenBerg]

noo ai lol

[@LordSaliss]

I think these are still pretty overpriced, even with how stable they are and ow fast they can be. Sure you get some very nice features, but still $1800 per AP is a lot. I have migrated to Unifi at home and it has become quite nice too this year. They have been extremely stable as well, and I havent had a single issue with the hardware or any clients on them. My house is a mix of Android and Apple devices too. And with their Wifi 6E APs for $350 I can saturate my 2.5gb link the AP has on it. So the speed seen on these Juniper ones isnt really anything special IMO. The only special parts are the pcap features and things like that. Useful in an enterprise sure, but outside of that I dont see its place and dont see why anyone would be willing to pay and extra $1450 per AP for that feature.

[@sziehr]

1800 is peanuts in the enterprise. The fact these can hold up so many clients and enable a help desk to get the job done quickly is worth its weight in gold. These are not targeted at even moderate size single place businesses.

[@TheNinjaMarmot]

Watch out with these wifi 7. They may not be backwards compatible with WPA2.

[@NobleHays]

That's because wpa3 is mandatory on 6ghz by regulations

[@TheNinjaMarmot]

@@NobleHays yeah but imagine having to separate out your bands so clients can connect on wpa2. You'll have no choice but to disable 6ghz to make sure clients are able to connect and not call up helpdesk because they aren't connecting to the correct ssid (more ssids = bad), making WiFi 7 almost pointless.

[@17wasSquared]

@@TheNinjaMarmotWPA2/WPA3 mixed mode and OWE transition exist for deployments with older clients. As Noble said, 6GHz clients must support WPA3, so this isn’t really an issue

[@TheNinjaMarmot]

@@17wasSquared that's not the only issue. PMF is a requirement for wifi7. It's not optional anymore. Which is problematic on older clients.

[@17wasSquared]

@@TheNinjaMarmot From my understanding working in the WiFi industry, that’s incorrect. PMF is currently only required when an AP configures WPA3-only SSIDs. WPA3 is only required in 6GHz, but clients/APs may still use WPA2 (which does not require PMF) in the 2.4GHz and 5GHz bands. This includes WiFi 7 clients/APs as well.

[@simonpalmer123]

How do they cope with various clients? 802.11r/k/u/v? Are transition times good? (Sansung etc v Apple client experience differs massively) Aruba instant shop here

[@mikescott4008]

Soon to be part of Aruba. Shows where UniFi is not…