Catalyst cloud monitoring: IP routing required?

[cparishjr]

Why is IP Routing required on a switch for cloud monitoring?  The switch is able to access cisco for licensing using the interfaces' default route (front panel). 

1/27/2023, 9:32:02 AM Device is not eligible for onboarding. Reason: IP Routing must be enabled.

[alemabrahao]

• HTTPS proxies to access the API endpoint and the TLS gateway are not currently supported. If necessary, ensure rules are in place to allow direct HTTPS connections to each.
• Connectivity must be via a front-panel port (not the management interface).
• Only the default VRF is supported.
• Ensure routes are in place to reach external addresses including a default route (use of ip default-gateway is not supported).
• IP routing (ip routing) must be enabled on the switch or will be enabled as part of onboarding.
• Ensure DNS is enabled on the switch (ip name-server {DNS server IP} configured).
• Ensure DNS lookup is enabled (ip domain lookup).
• NTP needs to be enabled on the switch (ntp server {address}), and the switch clock must reflect the correct time.
• AAA on the switch must be configured using aaa new-model.
• SSH access to the switch CLI must be enabled and accessible via the computer used for onboarding.
• The user account for onboarding must have privilege-15 level access on the switch.

[alemabrahao]

It's a requirement, maybe it would be better for Meraki.

[cparishjr]

I know it is a requirement.  ( I said so in my message)   The question is why is it a requirement? 

[alemabrahao]

Ask Meraki support.

[PhilipDAth]

I don't know the answer.

I'm going to guess it is a restriction in IOS-XE when running containers.

[cparishjr]

It does not run in a container. 

I am new here but do both of you comment just to run up your numbers even if you don't know the answer?   

[alemabrahao]

No, I'm just explaining that you should ask for support, as they'll likely have a more plausible explanation. We are here as much to help as to learn. 😉

[alemabrahao]

By the way, the IP routing is necessary because of ip default-gateway is not supported. I don't know why, but Meraki team support probably has the answer.

[PhilipDAth]

Yes it does.  The Meraki management layer is not "baked in" to IOS-XE, but runs as a container on top of it.

Under the hood it uses KVM from Linux.  You (or anyone else) can use the same system to run code on top of IOS-XE.  It's the official way to extend functionality.

https://developer.cisco.com/docs/ios-xe/#!application-hosting-quick-start-guide

[cparishjr]

The question is about Meraki MONITORING, not management.   Meraki monitoring is compatible with the 9200 catalyst switches which can't run applications.  That tells me that Meraki MONITORING does not run as a container.