Meraki

Mloraditch · ‎Oct 16 2024

Does it work if you query against a public DNS server? If so you have an issue with your internal DNS servers which is going to be hard for us to help with. If it doesn't return against a public server you can try turning it on and off in the dashboard or calling support. There is very little configurable on the customer side except on or off and the hostname.

Mloraditch · ‎Oct 16 2024

It could be that NPS is not responding which is the same net effect as a denial. There are also other NPS logs that may not be enabled for whatever reason which may help. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/troubleshoot-network-policy-server You can do a packet capture on the NPS server to make sure you are getting the radius traffic and if you are what responses are (or aren't) being sent. If the requests are getting to NPS and NPS isn't responding or is sending back denials you at least know you have a Microsoft side issue. If the packets are occasionally not getting to the server at all, may need to check along the traffic path to see where they may be dropped.

Mloraditch · ‎Oct 16 2024

They will operate with their last good config, but its impossible to know the exact reason with just knowing they are offline. Likely multiple somethings in this document are not working: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity Could be vlan issues, could be firewall issues, could be routing. May be helpful to hook a laptop into the port the AP is using and seeing if you get dhcp and can get online and get to the internet in general. You may also be able to download logs from the local status page and provide them to Meraki support

Mloraditch · ‎Oct 16 2024

I don't have an answer, but can say there has been zero talk of monitored mode even in stuff I can't talk about yet. The focus is on getting managed mode working.

Mloraditch · ‎Oct 16 2024

In general I like the idea, but maybe there could be groups. A good number of these fixes apply to everything MX75 and above and it would make it less busy.

Mloraditch · ‎Oct 16 2024

It would be great if screenshots/instructions were added showing what rules need to be added to allow these default services to continue to run as they did previously with the feature enabled.

Mloraditch · ‎Oct 16 2024

It does not appear to be. I would expect you to be steered towards either a 9300L model if buying new or the C9300-NM-8X-M if you need to migrate an existing unit. I suspect it could be more easily added down the road with the new Native IOS-XE but haven't heard anything specific.

Mloraditch · ‎Oct 15 2024

I had the same issue a few months ago and also asked support to add notes to the documentation. Guess that hasn't happened.🙃

Mloraditch · ‎Oct 14 2024

Here is a good explainer: https://techfieldday.com/video/next-generation-cloud-management-for-cisco-catalyst/ The way I understand it is they use the built in YANG/NETCONF support to do all config and the main thing added to the IOS-XE code is the management tunnel vs the previous container that had to run on top and interpret meraki config. Now most of the coding is in the meraki backend as far as doing new features. Some of the reporting appears to be somewhat customized and I'm not sure I quite understand how that works but it's still simpler.

Mloraditch · ‎Oct 14 2024

Whatever the issue with 9300Ls was, has been fixed as RN have been updated to remove that caveat. Another note has been added about 9200CXs not being supported and "Meraki Auth is unsupported" as well. Will be curious how they fix things going forward as the new architecture is the dashboard sending regular IOS commands via the tunnel. There is no longer an abstraction layer on top of things so there should be less to fix in the actual device firmware and more backend work to just make sure commands and output are sent back and forth in the correct format.

Mloraditch · ‎Oct 11 2024

Make sure you have block all access until sign on is complete selected under advanced, captive portal strength. Without that everything but port 80 is allowed, which would make it rather easy to use the internet.

Mloraditch · ‎Oct 9 2024

I've definitely seen internet connections where despite the ISP being restored the firewall (of whatever vendor) doesn't come online without a restart. Outside of an over 8 hour dashboard outage, which certainly could happen, but has not in my memory, I'm curious what other scenarios folks think of that could cause issues? At least with my customers no internet means no operations.

Mloraditch · ‎Oct 7 2024

The modules and cables you have listed seem to be compatible from a general specifications standpoint. If the patch is not direct you can try flipping the pairs. You may need to engage one or both vendors support. While the Meraki doesn't require specific settings to make the SFP work, your Korenix might. Perhaps another member has heard of them and knows something, but I hadn't until your post. Meraki support may have something in their internal databases as well.

Mloraditch · ‎Oct 4 2024

Without further details what you have shown seems ok. I would check to make sure your ssid is set to put clients on vlan 1. It should be set to External DHCP Server with no tagging based on my understanding of what you've written. If that's all set correctly and the DHCP Pool for VLAN is not exhausted you could try rebooting the AP or other equipment or call support. It seems you have an all Meraki environment so they should be able to quickly figure something out.

Mloraditch · ‎Oct 3 2024

If you've already tried a different browser, clearing cache, etc, I would suggest contacting support. That error does not coincide with what you are saying you are doing. You could also just delete them and readd them and see if that works.

Mloraditch · ‎Oct 3 2024

18.211.2 seems to be linked to 18.107.10 for common fixes so I would suspect that but hopefully someone can clarify.

Mloraditch · ‎Oct 3 2024

My understanding is AVoIP is like any other protocol that works on IP so from basic sense it should work. Now whether there is enough throughput and other performance characteristics for your specific scenario is something I can't answer. If you provide some more info some members might be able to help, but you may also want to loop in your partner or Cisco SE for verification.

Mloraditch · ‎Oct 3 2024

What are you trying to do? The Error indicates you are trying to give lesser perms to someone who already has full org perms. If someone needs access to only specific networks their org rights need to be read-only or none.

Mloraditch · ‎Oct 3 2024

Please read carefully and refer to the referenced documentation article. This reads like a true beta that you may only want on lab switches given all the caveats. Overview With the release of IOS XE 17.15.1 to the Meraki Dashboard, we are beginning an exciting transition from a container-based architecture to one that is based on native IOS XE, with support for Meraki cloud management. With this first beta release, your switch(es) will upgrade and transition from CS firmware to cloud-native IOS XE 17.15.1, managed by Meraki Cloud. This simpler architecture unlocks many benefits for your cloud-managed Cisco Catalyst switches, including the 9300-M, 9300X-M, and MS390 families. This includes faster boot and initialization performance, especially for stacks, and the start of a new generation of capabilities we will deliver with faster speed. It also introduces the ability to perform CLI show commands directly from Dashboard! Please note, CS16 or CS17 is a prerequisite before initiating this upgrade. For details on behavior changes related to L3 Switch Virtual Interface (SVI), LED Behavior, and STP behaviors, please refer to the cloud-native IOS XE Overview (https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Cloud-Native_IOS_XE_Overview). New feature highlights Introducing cloud-native IOS XE. Improved boot time for your Cisco Catalyst cloud-managed switches, especially for stacks. CLI access through the dashboard to run show commands for troubleshooting. Support for Intelligent Capture. Support for C9200L hardware platform. (See Supported Models below) Enhanced logging capabilities with native Catalyst logging support. Share Your Post-upgrade Feedback! We value your feedback on our latest release! Please take a moment to complete this brief 5-minute survey (https://forms.office.com/r/gHuK4bJRZ5) and share your experience with us. Fixed issues Fixed an issue that caused incorrect PoE usage data to be shown in the dashboard on MS390. Fixed an issue that prevented the application of fixed IP assignments if the IP being assigned had an active DHCP lease on MS390. Fixed a problem that allowed MS425 devices to perform client sampling on ports directly connected to downstream MS390 switches. Fixed an issue causing switches to restart after stack failovers. Known issues L3 Features: Management interface replaced by L3 SVI in IOS XE. If the switch management address belongs to the same subnet as an L3 SVI present in the configuration before upgrading from a CS to IOS XE release, the upgrade may fail and revert to the CS release, especially if the management address is statically assigned. RADIUS authentication may not work when the RADIUS server is in the same subnet as the switch management interface. Encrypted Traffic Analytics (ETA) is not currently supported. Please disable ETA/Netflow on a network before upgrading to Cloud-Native IOS-XE. If ETA is enabled, it will prevent configuration changes to the network until it is disabled again. C9300L is not currently supported. We recommend moving C9300L devices to a separate network that will not be upgraded before attempting to upgrade to this release. If you upgrade C9300L devices, please note that the uplink ports will not function. As a workaround, use the copper ports instead. Downstream clients may experience packet loss for 60-200 seconds in stacks while the standby switch takes over the active stack member role when the active stack member is powered off. Management plane connectivity may be interrupted when there are a large number of LLDP announcements. Meraki native MS switches move LACP ports to an active forwarding state if configured. This can cause loops when connecting to a Catalyst-based switch unless the bundles are configured on the Catalyst side first. All Meraki native MS switch ports are configured in passive LACP mode so that loops do not occur between Meraki native switches (always present) Stacks of 5 or more switches may experience a configuration mismatch when making multiple consecutive port configuration changes to several interfaces in a row Temporary feature gaps: cs/ms17 vs ios xe 17.15.1 We are actively working to bridge the feature gap between CS/MS17 and IOS XE versions. Please note that the following features are not yet available in cloud-native IOS XE but will be addressed in subsequent releases. SmartPorts MAC Blocklist / Allowlist Digital Optical Monitoring RSPAN / VLAN SPAN IPv6 RA Guard / DHCP Guard WarmSpare / VRRP FIPS / Gov Cloud HTTP Proxy for NextTunnel Storm control SNMP v3 Sticky MAC Encrypted Traffic Analytics (ETA) Dynamic ARP Inspection (DAI) Auto-Uplink Supported models C9200L-24T-4X , C9200L-24P-4X, C9200L-48T-4X , C9200L-48P-4X , C9200L-48PL-4X , C9200L-24PXG-4X , C9200L-48PXG-4X , C9200L-24PXG-2Y , C9200L-48PXG-2Y , C9200L-24T-4G , C9200L-24P-4G , C9200L-48T-4G , C9200L-48P-4G , C9200L-48 PL-4G C9300-24T-M, C9300-24P-M, C9300-24U-M , C9300-24UX-M , C9300-48T-M , C9300-48P-M , C9300-48U-M , C9300-48UXM-M , C9300-48UN-M , C9300-24S-M, C9300-48S-M , C9300X-12Y-M, C9300X-24Y-M, C9300X-48HXN-M, C9300X-24HX-M, C9300X-48HX-M, C9300X-48TX-M,  and its corresponding Catalyst switch SKUs for migration MS390-24-HW, MS390-24P-HW, MS390-24U-HW, MS390-24UX-HW, MS390-48-HW, MS390-48P-HW, MS390-48U-HW, MS390-48UX-HW, MS390-48UX2-HW

Mloraditch · ‎Sep 25 2024

Good to know I'm not crazy. The other thing I just remembered is I can't get 3rd Party VPNs to delete. They appear to but if you refresh they are back. Also realized the API doesn't have a delete function for these. Changes do save so I've made the ones I need to get rid of non functional for now.

Mloraditch · ‎Sep 25 2024

I'm seeing lately a higher prevalence of dashboard issues. For example having to reload an MX page 2 or 3 times before a WAN update will accept. Saw an issue updating notes today and just now changing the settings on an SSID. Reloading the page and reinputting the info eventually works. Example of the WAN change error: Notes update error: Additionally, found with three installs last night, in two different orgs, that LLDP/CDP data is not populating on the dashboard. Opened a case on that and support sent to the devs as devices are sending the LLDP/CDP packets. Are other folks seeing these anomalies? Is there something going on, on a larger scale?

Mloraditch · ‎Sep 23 2024

When we have clients run new fiber we always say go with single mode. At least from what I see here in the US there is negligible difference in cost for the physical infrastructure. The official optics are certainly more expensive but if you use third party optics and just a keep a couple of official on hand for process of elimination during support cases it's affordable and then you don't really have to worry about future speed upgrades (at least as the tech currently works)

Mloraditch · ‎Sep 23 2024

I've got this all over and have to presume it's also what OP is asking about.

Mloraditch · ‎Sep 12 2024

Yeah PDL Expirations have never worked and do not alert in my experience. Hence these weird situations. I once took over a completely expired org that was still working fully. Thanks!

Mloraditch · ‎Sep 10 2024

I've found an individual PDL license that was over 3 years expired. I know the documentation says you will only lose 30 days of the new license, but PDL has never worked like it was supposed to as far as expirations go. I think when I've encountered something similar that the new license actually was partially eaten up by the entire expired period. Does anyone else recall their real world experience in this situation?

About Mloraditch

Mloraditch

Matthew Loraditch

Community Record

Badges