Skip to main content

 

Cisco Meraki Documentation

Regulatory Domains for MR, MX, and Z-Series (Legacy Version)

  1. Last updated
  2. Save as PDF

For information on how to configure regulatory domain enforcement in the Meraki dashboard for MR devices, refer to the MR Regulatory Domains article.

MX and Z-Series products will not support a manual override of the regulatory domain. Contact Meraki Support in case of alerts.

Cisco traditionally sells a unique product SKU per country/territory. These devices have features enabled or disabled as necessary. Cisco Meraki’s philosophy is making IT simple and a software implementation is used to automatically set the right features based on the identified regulatory domain for an MR. This simplified software implementation allows Meraki to ship a single SKU worldwide and is applicable to MR access points (APs) and MX security appliances with Wi-Fi (MX-W) capabilities.

The regulatory behavior defined in this document does not apply for LTE and users may need to buy region-specific products for LTE support with MX devices.

Regulatory Domain Setting for a Device

A device's regulatory domain is determined based on the ship-to location when a device is sold and the IP geo-location (Geo-IP) when the device checks into the dashboard. If the Geo-IP lookup matches the ship-to country, then the device will operate within the country’s regulatory domain. If the Geo-IP lookup and ship-to country do not match, an error will be shown in the dashboard and users must manually change the regulatory domain. Devices and dashboard networks can only function in one regulatory domain at a time.

From a device management perspective, it is recommended to create separate dashboard networks per geographical area or regulatory domain per building, floor, etc., and assign devices to those networks accordingly. A more in-depth conversation about the dashboard organization and network is discussed in the Cisco Meraki Best Practice Design document.

If new APs are added to a network and this causes a regulatory mismatch, the new APs will be placed in worldwide safe mode (WWSM).

Regulatory Domain Setting for a Network

The regulatory domain can be set manually after being created or can be automatically determined when devices are deployed into the network. The regulatory domain can be set manually by navigating to Network-wide > General > Country/Region and selecting the appropriate country.

The first device added to the network is used to determine the regulatory domain if it is not manually set. This will also automatically set the regulatory domain for the network.

Worldwide Safe Mode (WWSM)

When devices initially boot up and have not assigned a regulatory domain, they will boot up into WWSM. WWSM only includes channel 1 on 2.4 GHz frequency; 5 GHz will not be used on firmware newer than MR 26.X.

Causes of Regulatory Domain Mismatches

Regulatory domain mismatches typically occur when Meraki devices are deployed in multiple countries but managed within the same dashboard network or when full-tunnel VPN or multiprotocol label switching (MPLS) circuits are used to have traffic tunneled back to another country. Regulatory domain is defined on a per-network basis, and it is strongly recommended that devices are grouped into networks based on a smaller related criteria such as country, site, floor, etc. This eliminates the possibility that two devices within the same dashboard network are deployed into different regulatory domains.

Below is a list of cases when the dashboard might give regulatory domain mismatch errors or devices might not be allowed to be added to a network. The cases are divided based on AP and network.

Ship to country

Geo-IP location

AP location setting

Dashboard error

Country A

Country A

Country A

No

Country A

Country B

WWSM

Yes

Table 1: Regulatory domain mismatches based on Geo-IP on the AP and which produces a dashboard error.

Dashboard network location

AP regulatory domain

Action

Result

Country A

Country A

Add AP

Allowed

Country A

Country B

Add AP

Allowed with notification

Table 2: Actions allowed for networks based on the APs regulatory domain.

Best Practice 

Options to Correct Regulatory Domain Mismatches

The device may report an error stating "This AP may be operating in a reduced state" or an alert similar to this image:

Country/Region regulatory domain mismatch

stating:

  • Country/Region mismatch
  • Regulatory domain mismatch
  • Country detection mismatch

The two ways to resolve a regulatory domain mismatch are:

  1. Correcting the network's regulatory domain

    • This is recommended if all of the devices in the network are affected

  2. Move the affected devices to a different network

    • This is recommended if some of the devices in the network are affected

Update the Network's Regulatory Domain

If the dashboard detects that all of the devices' regulatory domains differ from the network's regulatory domain:

  • Change the network's regulatory domain under Network-wide > Configure > General > Country/Region

network-wide general country timezone.PNG

The network's regulatory domain is set to the United States, but all of the devices are detected to be in Japan.

If all of the devices were shipped and staged in a different regulatory domain and the network is set to a different regulatory domain:

  • Change the network's regulatory domain to the appropriate one under Network-wide > Configure > General > Country/Region > Change
  • Read the terms and conditions
  • Enter the requester's full legal name
  • Accept the terms and conditions to change the regulatory domain

All APs must be online and successfully communicating with the dashboard to be able to change the regulatory domain. The option to change the regulatory domain may take 15 to 20 minutes to appear after a mismatch has been identified.

unnamed.png

Move the Affected APs to a Different Network

If some devices are deployed or originally shipped to a different regulatory domain than the rest of the network, the quickest way to correct this issue is to:

  1. Create a new dashboard network.
  2. Add the APs into the new network.
  3. Navigate to Network-wide > General
  4. Next to Country/Region Click "Change"
  • All APs must be online and successfully communicating with dashboard in the new network to to change the regulatory domain.
  • The option to change the regulatory domain may take 15 to 20 minutes to appear after a mismatch has been identified
  1. Update the regulatory domain.
  2. Move the devices to the appropriate network.
  3. Delete the new dashboard network.

A device removed from a network will remember its last known regulatory domain until it is claimed into a new network.

Error While Claiming New APs 

This is typically seen when devices are shipped to a distribution center in one country and then shipped to another country, and the equipment has not come online to be identified via Geo-IP. You may see an error such as:

Cannot add an XX (XX) regulatory domain to a XX (XX) regulatory domain network.

These are the steps to resolve this behavior:

  1. Create a new dashboard network.
  2. Add the APs into the new network.
  3. Navigate to Network-wide > General
  4. Next to Country/Region Click "Change"
  • All APs must be online and successfully communicating with dashboard in the new network to to change the regulatory domain.
  • The option to change the regulatory domain may take 15 to 20 minutes to appear after a mismatch has been identified
  1. Update the regulatory domain.
  2. Move the devices to the appropriate network.
  3. Delete the new dashboard network.

Removing a Device from an Organization or Network

When a device is unclaimed from an organization, the regulatory domain is set to the one associated with the ship-to address.

A device removed from a network will continue to use its last known regulatory domain until it is claimed into a new network.

Using Geo-IP to Automatically Update Regulatory Domain

An extra feature can be added to a dashboard organization allowing Access Points from different organizations/network with different countries (regulatory domains) to be updated automatically based on the Geo-IP of all devices within a specific dashboard network. Please contact Meraki Support to enable this feature.

Dashboard administrators are responsible for confirming and monitoring that the regulatory domain identified via Neustar's Geo-IP database is identified correctly in the dashboard.

FAQ

  • When and how often does the dashboard check if the regulatory domain is correct?
    • When initially adding a device to a network
    • Checks are run every 10 minutes to confirm the Geo-IP location of the device has not changed
    • Checked when updates are saved for the devices radio settings
  • What could affect the regulatory domain of a device?
    • Full-tunnel VPN or MPLS connection terminating to an IP outside of ship-to country or operating region
    • Device is staged outside of the ship-to region than where it is expected to be operated
  • Are there any recommended best practices?
    • Depending on the deployment, ship to the location where the equipment will be operating or country
    • Segment the dashboard networks based on a smaller related criteria such as country, site, floor, etc for multinational deployments