New articles:
Change: New article.
Workflows:
Change: Added release notes for the "November 19, 2025" release.
Security & SD-WAN:
Change: Added "SD-WAN Internet policies are processed in a top-down manner based on their configured order."
Change: Updated behavior on QUIC: "Content Filtering cannot inspect and block QUIC connections The payload of a packet is protected so the MXs cannot analyze the traffic to see the attributes that are normally used to filter traffic on an application level. Content filtering will not work for sites using the QUIC protocol. We recommend blocking UDP ports 80 and 443 using the Layer 3 firewall to force the use of TCP."
Switching:
Change: Added section "Before You Upgrade or Migrate: Key Considerations"; added section "UAC Automatic Fallback to Preferred Uplink"; added section "UAC Manual Fallback to Preferred Uplink".
Change: Added section "Firmware Upgrade Visibility for Cloud-Managed IOS XE Switches".
Change: Added "Switches operating in "Configuration Source: Device" mode are not supported for cloud-initiated firmware upgrades".
Change: Added "Full encryption IOS-XE is required for migration. No Payload Encryption (NPE) versions are not supported for this purpose. For example, the NPE version of cat9k_lite_iosxe.17.15.3.SPA.bin is unsupported. Furthermore, install mode is required, attempting to migrate using bundle mode will result in an error."
Change: Added note regarding CS to IOS-XE pre-check alert: "Highly recommended: ICMP pings blocked".
Wireless:
Change: Added "The "Modern" splash theme is required for Microsoft Entra ID splash page integrations."
Change: Updated behavior on manual overrides for MX and Z products: "To perform a manual override of the regulatory domain on MX and Z-Series products, the network will need to be an appliance-only network."
Change: Added section "Network Assurance and Device Classification Enablement".
Change: Added "In addition, a variable such as $MERAKI:NETWORK_NAME$ which is intended to return the value of the attached SSID, will only do so if splash for this client is assigned to a specific SSID, and not a VLAN on an MX (which can have multiple associated SSIDs). If the splash page is assigned to a specific SSID, this variable is substituted for said SSID as documented below."
Platform Management:
Change: Updated section "Alert Severity".
Change: Added "VLAN Databse is an Early Access feature which requires enabling at Organization > Configure > Early Access."
Change: Added "Follow the same steps when integrating with Secure Access. The only difference is the scope of the API key. For Secure Access DNS integration create secure Access API key with scope of: Admin/Organizations : Read/Write AND Deployments/ Network Devices: Read/Write."
Change: Added "Removing a camera from a network permanently deletes all footage from the device."
Change: Added "This will need to be requested by either a full organization administrator or the shipping contact on the order."
Change: Added "Additionally, administrator account emails are automatically converted to lowercase, regardless of how they were entered during sign-up."
Change: Added "This behavior is specific to CW917x Access points".
Change: Article re-write.
Change: Added "Client tracking is not available for Configuration Source: Device C9300s without a DNA Advantage license."
Change: Added "You can only claim a trial on the new Inventory page (Organization > Configure > Inventory). If you use the old page, you will see an error. To switch to the new page, click "Try New Version" at the top right. If you are not an organization admin, claim trials on the new Add Devices page."
Change: Added "As of February 28, 2025, the CMNA promo renewal has been retired and automatic renewals will no longer occur."
Change: Added section "Staggered Upgrades".
Change: Added "Note that some DHCP options (like options 3 and 15 for default router and FQDN/domain name) cannot always be configured using the custom DHCP options field, but are available with a dedicated option on the page. Small variations exist depending on the variation of switch model and firmware."; added "Options 3 (default router) and 15 (domain-name) are available for Catalyst based switches running IOS XE 17.15.4 and later."
Cameras:
Change: Added "WPA3-Personal (PSK / SAE)".
Sensors:
Change: Added "While we aim for reliable operation, the performance characteristics of any connected system may be influenced by various environmental and network factors. We recommend customers use their best judgment, thoroughly evaluate the MT30's suitability for their specific operational requirements and conduct comprehensive testing to ensure it meets their desired outcomes, especially in time-critical use cases."
