Important note to make: While all switches do support IGMP snooping this does not guarantee a multicast installation will work. You still need a device like a switch that supports L3 interfaces as SVI's or a upstream router/firewall that does the IGMP querier function or PIM routing function.  Without this you won't have much luck getting your multicast between switches. Also good to know: MS switches do not support fast leave in IGMPv2. ... View more

I see.  Well for modern workplace kind of customers that don't want to run own server, you can use access manager as the radius solution.  that gives you 802.1x + MAB with an easy tagging method. However you can just put an adaptive policy tag on a switchport if you want 😉 What I took away from the whole trustsec/adaptive policy is that the solution is meant to do away with VLAN sprawl which I really get.  Because yes I have customers with small branch sites that sport 20+ VLANs just to have some policies between them. ... View more

That's a default security measure so when folks bring up a Meraki AP for the first time they don't accidentally have an open SSID that is bridging to their internal network. ... View more

If your client is wired, then the policy will apply on the MX.  That means the client could connect fine to the switches but will have no luck in connecting to internet or other VLANs. If your client is on an MR access point, it will apply there and the client won't have any connection. ... View more

Aww crap. Thanks for the info.   Then it's just a waste of time doing this then. 🙂   Switch focus to certificate-based is a better direction. So i don't spend time on the username/password solution and then it stopps working. ... View more

Aha I found official documentation from Cisco that says you CAN have 2 powerstacks within 1 datastack: https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9300-series-switches/white-paper-c11-741945.html ... View more

On the pc you can temporarily fudge with the subnetmask but please on the MX do use the 255.255.255.254 mask to configure the uplink.  This works fine in recent releases. ... View more

Ok for the -M mgmt IP, you will probably need to run the native IOS-XE version, not the CS version to get this to work. And if the mgmt IP is sticky on a DHCP IP then search for my article about sticky behavior of the native IOS-XE versions.  You'll have to go back an forth between an SVI in the DHCP range and then back to the wanted SVI.  It's a bit of a mess 😉 But when doing this design please do have a failure check so you can observe the behavior on the C9300 switches with the OSPF default routes. ... View more

If you're using the container based CS version that could still be the case. Do mind if you upgrade to native IOS-XE that other rules will apply. Check here: https://community.meraki.com/t5/Switching/Native-IOS-XE-17-15-3-1-sticky-DHCP-management-IP-issue-with/m-p/277498#M21152   ... View more

Yes, I would like them to put all their energy in the IOS-XE native builds.  I see no joy in the CS versions since you can't see what the box is doing under the hood. ... View more

I tried again and the switch port disconnects when the cable test is run...   But at least the MR56 reconnected at 5Gbps this time! ... View more

Sorry, force of habit, active mode. ... View more

What you want smells alot like location specific services which is available on the C9800 controllers. I also believe this will be a possiblity on the new campus gateway. However MR AP's or CW AP's operating natively in cloud mode do not yet have this function. ... View more

What model MX is this?   What does the summary report show about the device utilisation?   ... View more

You are supposed to use the WAN IP peer ID, not the FQDN. You told us before that FQDN support was not there on the Palo on IKEv1 so just stick to the WAN IP instead. ... View more

Thanks GldenJoe for clarifying this.  ... View more

Thanks, SFP - Fiber - SFP is the route we ended up going and it seems to be working much better. ... View more

Check this link: https://documentation.meraki.com/MS/Meraki_Campus_LAN%3B_Planning%2C_Design_Guidelines_and_Best_Practices   Thanks ... View more

I'm in the EU so we also only have access to LPI and 500 MHz. Designs in 6 GHz should be limited to 40 or 80 MHz. But in some cases you could have a bad channel. Without puncturing you would lose the entire block of 80 MHz for use in your environment. If your client is WiFi 7 validated then it must support it. So I guess this will be a problem if you have WiFi 6E clients in the same environment.  In that case you will have to lose that entire block. ... View more

@jimmyt234 Sometimes we are speedy 🙂 We just want to fit in!! 🙂 ... View more

Yes it is a bit convoluted. I wish I could talk to Martin directly about this issue. It would be great if another SVI is configured that the switch would periodically try to install the static routes to dashboard that way and try to establish the Meraki tunnel so we don't have to do this merry-go-round. ... View more

Why thank you.. I passed by reading that book 😜 ... View more

You can even pre-configure the module ports by using the new C9300-NM-DEFAULT/1 - 8 ports. The config on these ports will be copied to the actual ports of the module you install.  Great stuff! ... View more

Hello,   do you know if something in the meantime changed and MX68CW now supports CoA?   Thank you in advance! ... View more

The MX at this time does not support ECMP so you can only enter 1 route for each destination. However in your example you might run into an issue where you try to add an aggregated subnet 10.10.0.0/16 for where you already have a local VLAN 10.10.51.0/24 which is more specific. Normally you can have routes to less specific subnets and routes via several local subnets. But I would try to add a more specific route than the 10.10.0.0/16 first or remove the 10.10.51.0/24 subnets just as a test and see if you can add the aggregate route then.  Usually you can also see the error in a red banner on the top of the dashboard page.  But sometimes these can be hidden and show themselves when you push via API, ... View more