Since dot1X happens before receiving an IP.  Isn't that logical that there is no last known IP? ... View more

Still testing?  what's happening with this version? ... View more

I think you have to look how your method lists are setup. If you primarily look at tacacs server for your aaa authentication login... and aaa authorization exec... then you won't be able to use the Meraki device config method. ... View more

The Meraki issue is decent multiple vlan support over the wireless backhaul.  If you only have a few devices that are all on the same VLAN then sure you can use it. If you want complete transport you could look at Cisco industrial portfolio with CURWB which is a real low latency method using the same frequencies. ... View more

On regular MS switches all the possible VLAN numbers are created automatically (1 - 1001, 1006-4094).  So you can just use the VLANs on your ports.  This however can be seen as a waste of TCAM space. On a Catalyst switch the TCAM allowed for VLAN definitions is smaller on C9300 and C9200 switches.  This is why by default the Catalyst switches create vlans 1-1000 (and now 1-995).  If you run IOS-XE native you can actually see the VLANs that are created by using the Cloud CLI. However if you want to use VLAN's above the 1000 number you should use the VLAN database feature @Slayton already explained.  In fact if you can always use the VLAN database and only create the VLANs you actually need.  Then you are sure to not run out of space if you like to put your management SVI in VLAN 2002 like I do 😉 ... View more

If you mean the CDP/LLDP from connected devices then I can confirm there are no issues on native IOS-XE version on C9300-M switches. If you mean that you can't see any hostnames of clients that are connected to a C9300-M switchport then yes that appears to be an issue.  I can see the mac address and the IP.  But the typical hostnames like you can see on native meraki switches is not shown.  So I believe you are referring to missing info on the clients themselves. I am currently running 17.15.3.1. I do see in the 17.15.4 release notes that there are two related fixes where one is closest to the issue you are describing: Resolved an issue that prevented some clients from being correctly displayed on the Network-wide > Clients and Switching > Switch Summary pages Maybe check this version out.  Do mind that if you are running CS software the change to native ios-xe is impactful and needs plenty of downtime. ... View more

This is normal behavior.  Usually the tunnel will re-establish sooner than the seconds expiry.  I believe there also is a data limit but the MX will rekey sooner than the configured and this should be relative to the amount of seconds configured. So your logs will show initial IKE_SA where the CHILD_SA is instantiated in the same message which means you will probably get a log for the initial CHILD_SA.  And then after a while you will get the established for the new CHILD_SA and a closing of the old CHILD_SA.  You will also see the sequence numbering <remote-peer|90177> count up in the newer SA.  The log does show separate entries for inbound and outbound CHILD_SA. ... View more

You sure?  I haven't caught anything about that. I know about the org-wide GPO since Cisco Live EUR 2024 already. They could just fix the GPO's to apply it statefully on the MX. ... View more

What I mean is that the Org-wide group policy only is a dashboard logic that translates into a simple old regular network-wide group policy.  And that construct has always been to apply to both MX and MR and was later also used as group policy ACL on switches.  The issue I have with that construct is that is is extremely limited.  You can't have multiple destinations per line, you can't even have sources and you can't have comma separated ports and worst of all, a group policy is always applied statelessly (even on an MX). This is why I see the org-wide policy construct being expanded into multiple lines on the regular group-policy to accomodate it.  And here I ran into a bug where the logic failed to add multiple destinations into the group policy. Outside of the GUI and expand problems which are simple bugs that will be resolved in the future I fear the way it is implemented makes it unsuitable for any kind of east-west traffic due to the fact that regular group policies are stateless.  I would have loved to have the L3/4 firewall rules in a orgwide fashion where you do have rules that allow return traffic in due to state table.  And to have the whole paradigm changed where you could choose L7 and IPS rules per L3/4 rule isntead of having to allow or block globally. ... View more

Ok, I think Meraki needs to pull this feature and do some more testing. Removing the groups and adding the individual objects does nothing, OR when changing rules they don't get pushed?  Not sure yet.  When you initually create the group and apply it it shows it is working.  However if you edit it you don't have any indication if it is changing the local rules.   When trying to select objects and you filter then your selection is not respected and it just selects some other object for your destination addresses.. really weird. What happens when you edit the created group policy?  It does seem to allow you to just edit the thing without any repercussions. ... View more

I'm going onsite to a very angry customer in two weeks to have a call with Meraki while capturing OTA while they will look at the backlogs.  Wish me luck. ... View more

Yes you can EASILY see that, but reason "reserved" says nothing about what is actually going on. Even in bad Wi-Fi you are supposed to be able to be connected to an AP at -82 dBm although slowly.  However these AP's seem to boot you off when you are at -62 - -65 already which is weird. ... View more

The biggest thing that is always missing from the MS overview documentation is the raw platform stats to truly compare the platforms. If you look up the datasheets for Catalyst platforms you get RAM, ACL maximums, QoS details, MAC and host/route maximums, SDM template layout and sometimes even forwarding delay/buffer sizes.  These details are never given on MS switches which is a shame.  We are still on a 128 ACE limit and have a very limited group policy ACL limit that even has to share TCAM with QoS rules.  So I can only summize that the CAM/TCAM capacity of the typical MS platform is quite a bit lower than the typical Catalyst platform. ... View more

I would personally counter following personal experiences: - In recent times I had two instances where after a power outage MS switches came online but mysteriously failed to forward traffic over port-channels (aggregates) on 1 link.  This issue happened at 2 totally different customers where one is on MS225's and the other on MS425.  You have zero troubleshooting methods, no debugs nothing, only a switch that has a white led and is online according to dashboard. - I have multiple C9500 core stacks running 24/7 where one is in a hospital where they don't even upgrade the switches unless it is absolutely necessary.  Outside of a power outage test to see how the system would recover that was the only time those switches went down. They have been purring along nicely doing port-channels, VTPv3, and basic PIM/IGMPv2 for TV streams. - With the Catalyst switches in dashboard we at least have some CLI available and can do some deeper troubleshooting than what dashboard offers.  The only thing that is missing is a full debug feature. ... View more

What do you mean exactly orderable as Meraki SKU's.  Do they have a -M variant now? Cisco places all 9200's 1 tier above the MS150. If you want some advanced possiblities, then go for 9200 however not too advanced.  Dunno if VRF's will be possible in C9200 based switches in Meraki.  Since that is a case for routed campus or at least routed distribution layer with adaptive policy and only inter VRF routing if you need traffic to pass a firewall.  Of course this is only for the C9200 since that one has 4 VRF instances while the C9200L only supports 1. The moment you want to go fabric then 9300 is the absolute minimum. ... View more

With incompatible do you mean non Cisco coded 3rd party or Cisco coded 3rd party? ... View more

Network locations with unstable Dashboard connectivity may trigger UAC to use a non-preferred uplink. Once stable connectivity is restored on the preferred uplink, management IP may not automatically fall back to the preferred one. Good to see they have acknowledged the issue here. ... View more

Is the MX the only firewall that does not use it's own lookup?  Most firewalls I've seen work just fine by doing their own lookups.  Might be a good idea to implement this on the MX too.  Too many rules I have need to double up by adding the IP's from the responses I do myself. ... View more

True, true.  This issue was flagged right from the beginning and it is strange it has still not been fixed.  That's the reason why I refuse to work with port profiles and the automations that can go with it because dashboard does not give the up to date information. The switch behaves correctly in all cases also with the automations but dashboard simply shows the default port config. ... View more

Oh okay nice.  So when a vlan is scoped it will behave like a group policy that overrides the local firewall but leave other vlans untouched. ... View more

It is also important that WAN2 is on a different subnet than WAN1 since otherwise you could have weird routing issues. ... View more

Aditionally you the gateways in each DC must be a separate router that also has a direct path between the DC's.  So basically the MX'es are the next hop from the DC router to reach the branches and BGP is used between the branch router and the MX there.  It is eBGP between the DC mx and the local router and iBGP between the DC MX and branch MX'es. ... View more

Normally when terminating AutoVPN hubs in datacenters you must run these in one armed concentrator mode.  That way you can have the same subnet across multiple DC's and you can use the fancy BGP features like path prepending to influence how each branch goes to each Hub.  You can even have an active-active design where some branches reach 1 DC while the others reach another DC.  And only in failure scenario they all go to the same DC. https://documentation.meraki.com/Architectures_and_Best_Practices/Auto_VPN_Hub_Deployment_Best_Practices/Auto_VPN_Hub_Deployment_Recommendations   ... View more