MS120-8FP - not reaching cloud

[Sugarfree]

Have a production MS120 that is connected to a MX67 that is connected to a MG21 (rural county health dept.). Connection is showing stable between MG, MX and MS but the switch isn't getting any updates from the cloud.

[alemabrahao]

The MS has a configured IP?

[Sugarfree]

Yes

[alemabrahao]

I suggest you to open a support case.

[Sugarfree]

My supervisor did open a case with Meraki to figure out why the switch isn't able to access the cloud.

[cmr]

Are there any rules on the MX67 blocking the required ports for the MS to access the Meraki cloud servers? 

[Sugarfree]

not that I am aware of....I should update the device is a MX67C (4G Wireless). Uplink port on the switch is showing disconnected but users on site are able to perform job functions (ie: email, network drives, etc.)

I will admit that I am a FNG and trying not to ask my supervisors for help all the time.

[Ryan_Miles]

I took a peek at the case and your config.

I see other sites of yours with the same topology are ok. And the switch at this site was connect up until Aug 13th.

I see you use MG21s connected to the MX WAN port and also connected to the LAN switch for PoE purpose. On a working site the switch port connected to the MG is access, VLAN 1, no STP guard setting. On the non working site the LAN port connected to the MG is trunk, native 1, allow all, root guard enabled.

And at the problem site the MG event log is full of Internet martian and Source IP and/or VLAN mismatch events. And those events started occurring on Aug 13.

I would edit the switchport config to match a working site config (access, VLAN 1, no STP guard). You might need to reboot the entire stack (have have someone factory reset the switch) at this site to get it reconnected as the switch being unreachable right now won't allow it to pull a new config.

In general when powering a MG from a LAN switch or MX PoE LAN port I'd configure it for an unused VLAN, access mode, and remove that VLAN from any other trunk ports. And if it's an MX disable DHCP on that "Cellular" VLAN.

Both designs are not really official or recommended per se. But they work. I created a couple of general slides with what I feel is best practice when using this topology. This info is my own personal preferences based on my testing. Not an official guide, document, etc from Meraki.

https://docs.google.com/presentation/d/1yRjifi0x4oeBARk-oagAj92RIwxu5EfQcuVquVeElr4/edit?usp=sharing

[amabt]

If it helps. We have many sites that has a Switch and an MG. What we do what @Ryan_Miles  sugest. Plus also enable Port Isolation on that Switch port that MG is connected to