It could be a bug and I'd recommend opening a support case and asking for clarification. ... View more

The current clients is live connected clients, the performance tab is historical information.  if you have a large environment with a lot of roaming I could easily see where the performance tab could show X clients in its window of time vs the Y live connected. ... View more

Not with just the native authentication. You need to either use radius or more ideally get licensed for Secure Client (AnyConnect) that will have a better end user experience One example For Microsoft Authenticator with Radius: https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/Configuring_RADIUS_Authentication_with_Client_VPN_IPsec https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension   ... View more

Hey look my old post about this! We created a dedicated API user and key for the clients we manage to work around this. It was causing all sorts of problems with our tools because most of our nightly/weekly routines run get orgs as the first step. ... View more

Meraki Group Policies are applied on the network level on either a client or vlan basis and your vSwitch being tagged or untagged has no relevance.  If you have a  Meraki group policy on vlan 255 it will apply to all clients on that vlan no matter how they arrive on that vlan. They can be on an access port on 255, they can be on a trunk port where the native vlan is 255, they can be on your ESXi host if you had the native vlan set to (as an example) 299 and vSwitch with vlan 255 tagged. There are few more possible combinations as well. The native vlan going to your ESXi host will work fine for a vswitch, That vswitch would just not have the vlan field defined. It may behoove you to work with your partner (either Cisco or VMWare) or a more senior coworker if available so they can go through this with you in your environment and show you what this all looks like live. Your goal of a management network that is isolated is generally a good one but I'd recommend consulting as I stated above or at least reading and labbing more with both the Meraki and VMWare documentation at a minimum. ... View more

Great Job Everyone! ... View more

Yes you can't tag packets with VLAN 255 if your native vlan on the switch side is 255. You either need to move the VMs to the native vSwitch or change the native vlan on the switch ports to be a vlan you aren't using tagged. ... View more

You can split off networks into their own orgs, but you can not easily merge networks from one org into another. Unless your setup is small and simple, the API is going to be the best way to do this. There are Marketplace products that do this: https://www.boundlessdigital.com/product/migration/ as an example. There is an early access API that Meraki has been developing https://developer.cisco.com/meraki/api-v1/create-network-move/ but as far as I know it's still restricted to orgs on the same shard which makes its use limited. Lastly see here for a general overview of everything with moving: https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Design_and_Configure/Organizations_and_Networks/Best_Practices_for_Merging_Networks_and_Organizations ... View more

It does apply as far as compatibility goes and can be tested on the existing lineup. Supports recommendation was probably based on the specific issue you were having and knowing it was fixed OR the fact that the old CS firmware is basically not getting anything done to it at this point and the IOS-XE native firmware could either fix the issue or at least allow it to be investigated and fixed much more easily. ... View more

I believe it's only considered stable for the 9350 switches for which 17.18 is the minimum release. That may also include the other models that got cloud connectivity in 17.18 as well. It's in the other available versions category on my dashboard which is where special releases sometimes go that don't apply for all HW skus. ... View more

Just open a support case. They will send you a disclaimer that its permanent and they can’t tell you exactly what your new expiration date will be and you could be expired when done and then do it.   Ive done a few and its worked out okay  ... View more

You can as of a few weeks ago transition PDL back to Co-Term and once you are there you have an easy path to switch to subscription since everything will now expire at once again. ... View more

Both folks are correct, it depends on the situation. Support is the first place to ask, they will definitely do it if you have proof of a pending (Cisco Sales order or similar) or already but not yet implemented purchase. Regardless proceed with asking them. If however they refuse for whatever reason, your Meraki account rep can submit a request and have it done. ... View more

See here: https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Troubleshooting_and_Support/Troubleshooting/Troubleshooting_Group_Policies#What_is_the_order_of_priority_for_Group_Policies.3F The quick answer is yes, but the one applied to the client will be the highest priority ... View more

I'm unsure what model you are referring to as MR16s have been EOL since 2021: https://documentation.meraki.com/@api/deki/files/17019/meraki_eol_mr16.pdf?revision=1 and MR36s are not EOL. There are a number of APs that do EOL on the date mentioned. Mostly 802.11ac Wave 2 models. Regardless they should continue to work, but after that date there are no guarantees: https://meraki.cisco.com/meraki-support/policies/#product-end-of-life-eol-policy check that out. ... View more

What you have will work. You can either have them native on any vlan but 50 with 50 specified in the ip settings like you have or you can make 50 the native  vlan and then you leave the vlan field blank in the ip settings ... View more

The management VLAN setting under switches is for Switches Only. APs management VLAN is specified either by the native vlan on the trunk OR by setting it in the IP Settings of the AP (works both static and DHCP).       If the native vlan you provide the AP doesn't have DHCP it will try to source an IP from any other VLAN it can see. If you set a static IP in another VLAN once it gets online once it will get it's config and switch to the static IP. While I generally recommend APs have DHCP for management if you must use static IPs, I'd setup a small pool on the VLAN to allow new devices to get online and then get their static configuration. Failing that you can put them on a native VLAN that provides DHCP and then allow them to switch their management to your VLAN 50 once they download the config. ... View more

are you saying the API doesn't show what the dashboard does or the dashboard (and thus the api) is not showing the info at all? Either issue is a support case, although at least with the  latter you could do some packet captures to see if the info is being sent. If it's being sent and the dashboard is not displaying it, there's some sort of bug before the API is even involved. If the dashboard has it and the API doesn't, probably an API bug. Either way support probably has to diagnose it. ... View more

Sorry for the location mixup, that's fascinating though that the taxes are different between the models.  ... View more

The equivalent models have the exact same MSRPs here in the US and the same discount programs apply so we are getting the exact same prices between 6e and 7. Is that not the same in the EU? ... View more

For outdoor there is nothing newer than Wifi 6e, 9163s. While it is probably a smart bet that there will eventually be an outdoor 9173 model, I haven't heard anything on timing.  For Indoor the models are equivalent 9162/9172, 9164/9174 and so forth. They are also equivalent on published pricing which should make your end customer pricing be the same once discounts have been applied by your AM/Partner If you need indoor with external antennas, 9174 has this option https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/wireless-9174-series-access-points-ds.html and 9176 https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/wireless-9176-series-acc-point-ds.html does have a directional antenna option ... View more

I would  have your edge firewall and switches in one network and the concentrator by itself. The Edge Firewall and Switches can then use unique identifier tracking.  Your concentrator would then track by IP address in it's network. ... View more