Hoping someone can offer some advice.
We’ve purchased 2x Cisco Catalyst C9300X-24Y-M switches running IOS XE with Meraki cloud management.
With traditional Meraki switches, I’ve never had any issues pre-staging them. You configure the management IP on the dedicated management interface, connect them to the internet, and let them pull down their configuration.
With these switches, the management interface is now handled through the IOS XE Layer 3 configuration, which also provides connectivity to the Meraki cloud. I understand how Catalyst switches work, having worked with them for years, but I’m struggling to get a reliable pre-staging process in place.
Ideally, I want to configure the switches in the Meraki Dashboard, connect them to a temporary network, allow them to download their configuration and firmware updates, and then deploy them on-site. Once installed, I would simply move the cables over to the correct network and have them come online using the intended management IP addressing.
However, I’ve had nothing but problems trying to achieve this. I attempted it on Friday and again today when I took the switches on-site. Despite having internet connectivity and being able to communicate with the Meraki cloud, they complained about the management IP configuration and refused to download their intended configuration. Instead, they repeatedly reported that they were reverting to a safe configuration. When I checked them locally, all the switch ports were still in their default configuration.
My question is: what is the correct process for pre-staging these switches?
How do you get them to download their intended configuration and firmware in advance, so that when you install them on-site with the correct management IP addressing, they come online and work as expected?
I’m keen to embrace cloud management, but after spending so much time troubleshooting this, I can’t help thinking that having full CLI control from the outset would have had these switches configured and ready for deployment within an hour.
Any advice from someone who has successfully pre-staged these switches would be greatly appreciated.

How do you manage your IP Addresses now if you are using Meraki network products? Especially if you have 16-20k subnets to manage?

It appears that binding a Meraki MX to a configuration template locks down static routes, DHCP settings, and VLAN configurations at the network level. This makes templates impractical for deployments where each site has unique IP addressing and routing requirements.

Has anyone found a workaround for this limitation? Ideally, I'd like to use a common template to standardize firewall rules, Geo-IP, and content filtering while configuring static routes, DHCP scopes, and VLANs independently at each site.

Does anyone know why the MS390s are sending RAs over the network? They are not acting as routers, and there is no OSPF configuration, nor do they have any interfaces configured. They should only be doing Layer 2 with a few VLANs. The router handles all VLANs, not the switches on this network.

Thanks!

This is a crosspost. No clue if its allowed. Please DM me if you want something.

Ordered back in August, still waiting but wondering if my mr33s will stop functioning before the new stuff arrives??

Yesterday I tried to login on my Meraki Dashboard.

Menu on the left is not showing, so I’m forced to stay on Clients page. I don’t have organization and network-wide Pages and their configuration part, and it’s quite a issue because next week new devices are arriving and I cannot add licenses (claiming devices is available through iOS app).

Needless to say that I’m full admin.

Tried different accounts (all full admin), same behavior. Tried another dashboard I manage for a different customer, same. Used another browser (Firefox and Chrome), same.

Are you experiencing same issue or am I just the lucky one?

We just had all of our locations experience a simultaneous loss of WAN connectivity for a few minutes. We have 40+ locations nation wide. And I see that Meraki is reporting service degradation. Anyone else experience this today?

https://status.meraki.net/

Anyone have a link to a KB or announcement with anymore details? All I can find is the note in this KB

https://documentation.meraki.com/Switching/Cloud_Management_with_IOS_XE/Product_Information/Compatibility_and_Firmware/Independent_Firmware_Releases_for_Meraki_and_Catalyst-based_switches

Seems kinda sudden, well i guess not really given the date of the KB being in May.

What's everyone's plan? Have these upgrades been pretty straightforward?

Created a new vMX in Azure.
2 subnets like the documentation says.
Route table for production subnets next hop to be appliance and ip of the MX on the wan side.

Site to site VPN setup -Hub
Added the production subnet -VPN enabled

Added a static route on my main network core switch to test.

I can ping other subnets on the VPN and their clients from the new vMX.

I Can’t ping the new vMX from other MX’s on the VPN.

I can’t get out to the other sites from a vm on the production network.

VPN status page shows new network is green.

At a loss here. Followed documentation. I have to be missing something obvious.

Any thoughts?

We have a large vendor who has decided to implement ip whitelisting. We are a remote heavy workforce and dont use VPN. My thought to solve for this need is to utilize one of our larger MX firewalls and setup split tunnel rules to either the ip addresses or hostnames of the vendor. The MX is in routed mode with a static public IP address, and has enough capacity and bandwidth to handle the vpn users. Is there any limitations to having a public ip address or hostname in the MX split tunnel rules? If not anything i need to look out for or consider?

Hello All, after going round in circles with AI, I'm really hoping you can help me wrap my head around whether this is possible.

I'm using pseudo addresses for the example.

I have an IPsec peer configured for a remote EC2 instance hosting a web page - 170.31.20.1

Public IP - 18.128.10.22

Local ID - my meraki ip address

IPSec subnets - 170.31.0.0/16

I have multiple VLANs enabled for VPN

1, 10, 20, 60, and 90

Currently I can ping a local host in VLAN 1 (10.0.1.2) from 170.31.20.1

I am trying to restrict 170.31.20.1 to only access VLAN 10 but I cannot seem to do this. Is the only way via AWS security group because the Meraki only does outbound firewall??

We have the following Meraki cameras left over from a large installation/project:

• MV63 × 9 pieces
• MV93 × 5 pieces

The cameras are unused surplus and can be confirmed as unclaimed/ready to claim in Meraki Dashboard.

If anyone is interested, please feel free to DM me. I’d also appreciate any recommendations for the best place to sell these, preferably within the EU or UK.

Thanks!

Are there any specific settings in Meraki that controls bonjour flooding from wireless to wired network?

This is one big 1 vlan network with Apple devices.
Printer share goes offline sometimes. # of devices shows up in Mac Network list shrinks as more WiFi devices gets on the network. Devices appear again after WiFi devices leave the network. Devices can be pinged using IP addresses.

Any ideas what may be causing this ?

Has anyone in British Columbia configure the new Time Zone on your hardware yet?

If so, what did you use? We are now in the PCT, but I don't see it listed in available time zones.

Did you just pick any old time zone that is UTC-7?

Thanks

Providing guest wifi to an indoor track at a gym.

APs all around the perimeter, signal coverage is excellent.

Have the SSID setup as a bridged VLAN with Layer 3 roaming enabled (and isolated to its own guest network subnet obviously)

The Layer 3 roaming test is successful, but users are reporting as they walk around the track listening to streaming audio it disconnects and reconnects on them.

Wondering what else I can check

This document is very helpful https://aws-quickstart.github.io/quickstart-cisco-meraki-sd-wan-vmx/ however our AWS architecture is slightly different.

We already use a TGW as the transit hub and a third-party firewall for traffic inspection. All inbound and outbound internet traffic passes through the firewall before reaching the TGW and workload VPCs.

We are considering deploying the vMX behind the firewall in concentrator mode, with the firewall handling NAT.

Has anyone run a vMX behind a third party firewall?

1. Can the vMX operate correctly when the Meraki Dashboard sees the firewall's public IP?
2. Will HA/failover still work when the vMX is behind the firewall
3. Any limitations with this design?

This docuement is very helpful https://aws-quickstart.github.io/quickstart-cisco-meraki-sd-wan-vmx/ but our AWS architecture is slightly different.

We already use a TGW as the transit hub and a third-party firewall for traffic inspection. All inbound and outbound internet traffic passes through the firewall before reaching the TGW and workload VPCs.

We are considering deploying the vMX behind the firewall in concentrator mode, with the firewall handling NAT.

Could you please confirm whether this is a supported/recommended design, particularly:

1. Can the vMX operate correctly when the Meraki Dashboard sees the firewall's public IP?

2. Will HA/failover still work when the vMX is behind the firewall

3. Are there any specific NAT or firewall requirements for this deployment?

Hi, sorry fairly new to meraki networking world.

I've been tasked with replacing our meraki VPN concentrators. Our units are in a HA pair configured with VIP. As I'm replacing with new models (replacing MX100s with MX95) I'm aware i can't replace the standby first then failover and replace the primary as they need to be the same model.

With this in mind is the simplest way to do this as follows:

1. Power down old units

2. Remove old units from network

3. Plug in new units (configure local IPs on local status page)

4. Add to network

5. Configure as HA pairs

Will this re-establish all of our sites AutoVPN sessions (we have 150 ish sites so could really do without having to do any changes at sites)

Has anyone done this before and know of a better way of doing this?

Thanks

I have been using Meraki MX products for years but I am always struggling with the troubleshooting utilities within the Dashboard...The Security Center most of the time is empty...Traffic capture most of the time can not show me the blocked traffic...Alerts gave me most of unrelated stuffs...

How do you really troubleshoot effectively or efficiently using Dashboard OR you mostly use 3rd party tools?

Cisco has released Multicloud fabric in Meraki

https://www.cisco.com/site/us/en/solutions/multicloud-fabric/index.html

Reading through the documentation, I feel like I’m missing something.
If you already have onprem connectivity to the cloud through vMXs and are advertising the necessary subnets, I’m struggling to see why anyone would use this.

From what I can tell, the pitch seems to be:“Click Connect, tell the AI what you want, and it handles the configuration for you. ThousandEyes tells you whether it’s healthy.”

That’s great for simplifying deployment, but is there a deeper technical benefit I’m overlooking?