Cisco Meraki MR32

From TechInfoDepot
Jump to navigationJump to search
abgn+ac (AC1200)
802.11ac Wireless Indoor Access Point
Homepage Product page
Wikipedia Cisco Systems
WikiDevi.wi-cat.ru Cisco Meraki MR32
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Partial Support
Tomato any flavor Status Unknown
Gargoyle Status Unknown
Platform
BrandModelRev Cisco Meraki MR32-HW
Model Part Number LIC3YR
FCC ID (fcc.io) UDX-60031010
FCC ID (fcc.report) UDX-60031010
Type managed access point
CPU1 checkY Broadcom BCM53016A1
CPU1 Type ARM Cortex A9
CPU1 Speed 1.0 GHz ( 2 cores )
Flash1 Chip Brand? Model?
Flash1 Size 32 MiB 33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br /> (NAND)
RAM1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (DDR2)
RAM1 Chip Brand? Model?
ETH chip1 Broadcom BCM53016A1
Ethernet Port Count 1-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: none specified

Stock bootloader U-Boot
Expansion IF types none specified
PoE 802.3af, standard
Power ? VDC, ? A
Connector type barrel
Serial Port (UART) yes, 3.3V TTL, (115200 8N1)
JTAG Port yes

Flags:
Bluetooth 4.1

Additional chips
Bluetooth Chip;Broadcom;BCM20732;;1;
2.4GHz Power Amplifier IC;Skyworks (SiGe);SE2623L;;2;
5GHz Power Amplifier IC;Skyworks (SiGe);SE5003L;;2;

Other
Manuf/OEM/ODM Senao
3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Retail
Availability End of Life
End of Life date 2017
FCC approval date 09 December 2014
ASIN B00SU4M042
Country of manuf Taiwan
Radio 1
Chip1 Broadcom BCM43520
Wireless interface OUI none specified
Antenna Connector Type U.FL
MIMO status 2x2:2
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 1300 Mbps
802.11n up to 300 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz
Radio 2
Chip1 Broadcom BCM43520
Wireless interface OUI none specified
Antenna Connector Type U.FL
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 3
Chip1 Broadcom BCM43428
Wireless interface OUI none specified
Antenna Connector Type U.FL
MIMO status 2x2:2
Wireless Standard IEEE 802.11a/b/g/n
802.11n up to 300/300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 2.4 or 5 GHz

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Cisco devices with specifications, see Cisco.

867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.),
300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = AC1200 class

Overview

Per the FCC photos: the Air Marshall radio is a BCM43428 (2T2R 802.11abgn).

PSU: PowerTron PA1015-2HU (100-240VAC ~50–60 Hz, 0.4A -> 12VDC, 1.5A)

PoE: PowerDsine PD-9501G/AC (100-240VAC ~50–60 Hz, 1.5A -> 55VDC, 1.35A)

Links of Interest

Flashing

Flashing OpenWrt

Target: bcm53xx
Subtarget: generic
Package architecture: arm_cortex-a9
Supported Since Commit
Support started version: 21.02.0
Current supported version: 24.10.4
Unsupported Functions:
WiFi 2.4GHz partly, WiFi 5GHz partly
WLAN Hardware: Broadcom BCM43520, Broadcom BCM43428
WLAN Comment: 2x2, WIFI1 and WIFI2 (both BCM4352) unsupported
Installation method(s):
see git-commit
Recovery method(s):
see git-commit

Flashing needs a serial adaptor (due to the lack of a working dropbear on the original firmware).

This flashing procedure for the MR32 was tested with firmware: "r23-149867:150252-aacharya".

0. Create a seperate Ethernet LAN which does not have access to the internet.

  Ideally use 192.168.1.2 for your PC. Make sure to reserve 192.168.1.1 it
  will be used later on by the OpenWrt firmware. The original Meraki firmware
  will likely try to setup the network via DHCP Discovery, so make sure your
  PC is running a DHCP-Server (i.e.: dnsmasq)
  '# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
  Furthermore, the PC needs a supported ssh/http/ftp server in order to
  retrieve the initramfs + dtb file

1. Disassemble the MR32 device by removing all screws (4 screws are located

  under the 4 rubber feets!) and prying open the plastic covers without
  breaking the plastic retention clips. Once inside, remove all the screws
  on the outer metal shielding to get to the PCB. It's not necessary to
  remove the antennas!

2. Connect the serial cable to the serial header.

3. Partially reassemble the outer metal shielding to ensure that the SoC

  has a proper heat sink.

4. Connect the Ethernet patch cable to the device and the power cable.

5. Wait for the device to boot and enter the root shell.

  (rooting is not discussed in detail here please refer to
  Chris Blake - "pwning the meraki mr18" blog post:
  <https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/>
  (The same method works with the MR32's r23-149867:150252-aacharya)
  Wait for the MR32 to enter the "<Meraki>" prompt and enter:
  <Meraki> odm serial_num read
  (Verify that it matches what's on the S/N Sticker on the back!)
  <Meraki> odm serial_num write Q2XX-XXXX-XXXV
  <Meraki> odm serial_num read
  (Verify that the S/N has changed - and the LED start to flash)
  now to flash the firmware:
  <Meraki> odm firmware part.safe "http://192.168.1.2/mr32-initramfs.bin"
Once OpenWrt booted use sysupgrade to permanently install
OpenWrt. To do this: Download the latest sysupgrade.bin file
for the MR32 to the device and use sysupgrade *sysupgrade.bin
to install it.

WARNING: DO NOT DELETE the "storage" ubi volume!

To flash later MR32 Firmwares like r25-201804051805-G885d6d78-dhow-rel
requires in-circut-i2c tools to access the I2C EEPROM AT24C64 next to
the SoC. The idea is pretty much the same as from Step 5 from above:
Change the serial number to Q2XXXXXXXXXV (should be around 0x7c), then
attach a serial cable, ethernet (but make sure the device can't reach
the internet!) hit "s" (the small s!) during boot to enter the root-shell
and add the following commands to the /storage/config there:

serial_allow_odm true
serial_access_enabled true
serial_access_check false
valid_config true