Meraki

CameronMoody · ‎Jan 9 2020

@c-o-e Meraki support absolutely does provide support for Dashboard APIs, so if the engineer assigned to your case closed it for that reason, that was a mistake and we apologize. Do you happen to have a case number we could reference, so we can correct that for the future? To @PhilipDAth's point about ability/willingness, different engineers have strengths in different areas, and there are some who do specialize in APIs. If a support engineer is not able to help with an API issue well enough, they should consult with another engineer who can.

CameronMoody · ‎Dec 19 2019

The lighter colored ones in that article are a non-standard visio stencil set that we do not keep up anymore. The ones linked in Caroline's community post that look more like product photos are another set we update, usually provided on-request if people need very model-specific iconography. The ones linked in the blog (with thicker black outlines) are a standard set we plan to keep updated. This is our standard set for new/ongoing documentation. @Happiman-v2 The quality of Meraki topology Icon vs website is very different. We're always looking to make improvements. Can I ask what you prefer about the set in that article, compared to the other sets?

CameronMoody · ‎Oct 2 2019

Hey @user3 , The documentation was incorrect. Local windows password policies cannot be enforced via MDM. I've removed Windows from that list. Thanks for pointing that out. Sorry!

CameronMoody · ‎Sep 19 2019

Meraki Reference Architecture - Small Office Business Change: New article This is the first in a series of detailed reference architectures that we'll be releasing, which are intended to be used as a baseline for generating ideas about deployment planning. I'd love feedback on what is or isn't useful on this article, or what sort of environments would be most useful to see documented. We plan on releasing a Branch site reference architecture next, followed by many others of various sizes and types (if they're useful!).

CameronMoody · ‎Sep 19 2019

@jdsilva wrote: Site-to-Site VPN Settings - IKEv2 & FQDN Change: In MX15, aggressive mode is no longer supported. If User FQDN needs to be configured, IKEv2 needs to be enabled in addition to the user FQDN NFO. I don't see these changes. Am I missing something? That one was a mistake, and wasn't changed. Apologies. Removed from my post.

CameronMoody · ‎Sep 19 2019

Oh wow, I never realized this didn't have its own article before, but I'm super glad to see it now! Yes, me too. Using the latest version of Chrome this image is blank. Thank you, fixed that. Under the "Auto VPN Configuraiton Details" section this sentence hurts my head: I agree, that was a bit awkward. Try this new version instead: "If the MX is configured as a Hub, it will build VPN tunnels to all other Hub MXs in the Auto VPN domain (in the same same dashboard organization). It will also build VPN tunnels to all Spoke MXs in the Auto VPN domain that have this MX configured as a hub. If all MXs in the Auto VPN domain are configured as Hub then the Auto VPN has a full mesh topology." And lastly, please please please document what the current encryption cipher is on the AutoVPN tunnels. It's a 128-bit AES cipher. I added that it's an AES cipher to the "How Auto VPN Works" section under #3, it's in the image that you mentioned was grayed out, and it's in the "Auto VPN vs Non-Meraki Site-to-Site VPN" section. I am personally always negotiating with our internal teams to find a balance of detail we can share, and I appreciate the feedback around why this information is helpful. I understand why missing those details is frustrating, and I'm always pushing for more.

CameronMoody · ‎Sep 19 2019

@PhilipDAth wrote: This existing page seems to have become broken. https://documentation.meraki.com/MR/MR_Splash_Page/Changing_the_Language_on_a_Splash_Page It is linked to on this page: https://documentation.meraki.com/MR/MR_Splash_Page/Customizing_the_Splash_page#Changing_Language My mistake, moved the content to a new page and missed that link. Thank you @PhilipDAth

CameronMoody · ‎Sep 18 2019

Hi Community, Below are the most important changes to our documentation between July 29 - September 13, 2019: Week of August 5-9 Band Steering Overview - Note on RF Profiles Change: Added link to Enabling Band Steering via RF Profiles. MAC Enrollment - APNS Needed Change: Updated KB to notify readers to have APNS prior to macOS enrollment. The Cisco Meraki Dashboard API - api.meraki.cn Change: Added a note to use api.meraki.cn for China host. Meraki Auto VPN Change: New article SSID Tunneling and Layer 3 Roaming Change: Removed mentions of VM concentrators. SNMP Overview and Configuration Change: Added note that SNMP traps use SHA1 for authentication and AES for privacy. OSPF VPN Concentrator Change: Added a link to "Using OSPF to Advertise Remote VPN Subnets" in the OSPF section. Week of August 12-16 SNMP Overview and Configuration Change: Corrected security piece mentioning that SNMP polling uses SHA1 & DES. SNMP traps use SHA1 & AES VPN Concentrator Deployment Guide Change: Added link for “Using OSPF to Advertise Remote VPN subnets”. Updated with new hub-hub and spoke-spoke NFOs. Configuring SAML SSO with Azure AD Change: New article Wired Sentry Enrollment for MS Change: Added a note explaining that sentry enrollment is available for MS switches, but is only compatible with MacOS devices, not Windows or other. Facebook Login (Chinese) Change: New article MS220 EOL Change: Updated replacement switch to be MS120, not the MS225. Resetting Cisco Meraki Devices to Factory Defaults - MV Change: Added MV Week of August 19-23 Motion Alerts Change: Rewrote to include info about motion sensitivity and areas of interest. Change: Added note - "To ensure that alerts are not being lost to a spam filter, please be sure to add alerts-noreply@meraki.com as a trusted email source." SM - Enrolling Devices Change: Added clarification for supported Windows 10 editions: "Profile installation is only supported on Windows 10 Pro." Floor Plan Geoalignment Location Analytics Change: Added section explaining floor plan geolocation data and how to geoalign existing floor plans. MX Routing Behavior Change: Expanded Non-Meraki VPN section to include configuration with overlapping networks. MX Warm Spare (VRRP) Overview Change: Added note - "Warm spare switches cannot be stacked or have OSPF enabled." Creating and Applying Group Policies Change: When a group policy is applied to a VLAN, that policy becomes the new "network default" for any other group policies applied to clients in that VLAN. Staged Upgrades for Meraki Switches Change: Updated FAQ to note that individual stack members cannot be upgraded using this feature. Meraki Insight Introduction Change: New article, splitting previously existing Web App Health article into an MI intro, and Web App Health details. Hostname Visibility Change: Updated "Enabling Hostname Visibility" instructions to reflect differences between combined and uncombined networks MX Layer 2 Functionality Change: New article Week of August 26-29 Switch Cloning Change: Adjusted switch cloning steps. Meraki Reference Architecture - Small Office Business Change: New article Week of September 2-6 Extending the LAN with a Wireless Mesh Link Change: Refined verbiage around supported topologies Switch ACL Operation Change: Listed examples of unsupported inputs Band Steering Overview Change: New article Week of September 9-13 Meraki and Cisco Cloud Calling Connected Branch Solution Change: New article

CameronMoody · ‎Jul 15 2019

@BrechtSchamp Any details available about the specifics? Our switch team updated the document with a bit more detail regarding "basic" vs "enhanced" storm control and related protocols. https://documentation.meraki.com/MS/Other_Topics/Storm_Control_for_MS

CameronMoody · ‎Jul 9 2019

Hey @BrechtSchamp , At the beginning of the article: "All MS series switches include some degree of storm control mechanisms to ensure Meraki Cloud connectivity." While basic storm control exists on all models, configuration options are only available on the supported models listed.

CameronMoody · ‎Jul 9 2019

@SoCalRacer wrote: Thanks for the update! Regarding LTE carrier compatibility, please confirm. MX = T-Mobile is supported Z = T-Mobile is not supported If that is true then AT&T is the only US support carrier on both MX and Z series? Yes, AT&T is the only US carrier, so far, that has certified both the MX67C/68CW and Z3C devices. But just to clarify again, the carriers list is a list of which carriers have certified Meraki, not which carriers are compatible. So it's more like: T-Mobile = MX has been certified T-Mobile = Z-Series has not been certified

CameronMoody · ‎Jul 9 2019

Hi Community, Below are the most important changes to our documentation between June 24 - July 1, 2019: Week of 6/24 Configuring ACLs Change: More detail added. Removed overlapping information which was present in “MS Switch ACL Operation” which is linked in this article. Active Directory Issue Resolution Guide Change: New article MX 67/68 Cellular Interface - Supported Carriers Z3C Cellular Interface - Supported Carriers Change: Added note clarifying that Meraki does not certify/approve carriers, but rather that carriers certify Meraki devices. "Carrier compatibility is based on Meraki device certifications being approved by the carrier. A carrier being listed above means that they have certified Meraki's product for their cellular network. Although Meraki can test networks and many unlisted carriers may be functionally compatible with Meraki devices, the list of certified carriers is based on the carrier validating Meraki, and not the other way around." Storm Control for MS Change: Updated list of supported models Change of Authorization with RADIUS (CoA) on MR Access Points Change: Adjusted wording to state that the “audit-session-Id” is learned from the access-REQUEST message, not the access-ACCEPT message.

CameronMoody · ‎Jun 26 2019

@Uberseehandel , I think our documentation was unclear, so I rephrased and added some clarity for all documents mentioning compatible carriers. "Carrier compatibility is based on Meraki device certifications being approved by the carrier. A carrier being listed [on the certified carriers list] means that they have certified Meraki's product for their cellular network. Although Meraki can test networks and many unlisted carriers may be functionally compatible with Meraki devices, the list of certified carriers is based on the carrier validating Meraki, and not the other way around." EE Limited is a GCF-listed carrier and likely works with the product, but they have not certified our devices yet. Hopefully that's a bit more clear now!

CameronMoody · ‎Jun 26 2019

@SoCalRacer The MS125-48FP definitely doesn't cost $270015... So that's wrong on our part. I just tested and saw the calculator produce that number once, but... now I can't reproduce it again, no matter which browser I use. It only gives the MSRP-with-no-license number for me now. However, it looks like the access switches don't apply the correct license cost, while all other switches do. I'll send a note about that. I'd also be happy to give the team responsible for the cost calculator a heads-up about the $270015 error, but they might have a hard time fixing it unless we can figure out what conditions trigger the error.

CameronMoody · ‎Jun 24 2019

Hi Community, Below are the most important changes to our documentation between May 24 - June 24, 2019: Week of 6/17 MX84 Overview and Specifications Change: Updated maximum LAN clients to 200 to match the datasheet. Run Dark Mode Change: Added MR45 and MR55 to list of models that support dark mode. Added a note that the “Blink LEDs” tool overrides dark mode. Auto Channel Change: Updated navigation steps for excluding DFS channels. Week of 6/10 Supported USB Modems Change: Moved modem “Novatel Wireless Global Modem USB730L” from current to EOS table. Packet Capture - MS Switches Change: Added note stating MS120 and MS125 do not support dashboard-based packet captures from ports connected to other MS switches in the same network. MX Cellular - TMobile Support Change: Added TMobile as a certified carrier. Location Analytics - Proximity Graph Change: Added note stating “If clients are using randomization techniques, location analytics may be detecting falsified/anonymous client IDs, and this should be considered when analyzing location data.” Client VPN Change: Added note stating “Establishing a client VPN connection when the client is located on the LAN of the MX is unsupported.” Port Management Privileges Change: Clarification on where settings for port privileges are located for combined and non-combined networks. Billing for Wireless Access Change: Removed a step from "configuring SSIDs" for billing regarding adding specific "free users" as this is no longer an option. Week of 6/3 Product Firmware Version Restrictions Change: Add MS450 and specified min firmware as MS11. Switch Ports Change: Added loop guard under the STP guard options. Site-to-site VPN Settings Change: Added note that subnet translation is only supported for AutoVPN and no non-Meraki peers. Scanning API Change: All technical content moved to the Dev Hub

CameronMoody · ‎Jun 13 2019

Hi @nmemmert , Yes, both the MR45 and MR55 can run in Run Dark mode. @SoCalRacer, thanks for the heads-up. I just tested this myself and Run Dark does disable both the status LED and ethernet LEDs on the MR45/MR55. I also tested and discovered that the "Blink LEDs" tool overrides Run Dark mode. I updated the Run Dark Mode documentation to reflect this. Cheers!

CameronMoody · ‎May 31 2019

Hi Community, Here are some of the most important new articles or major updates that were published in May: New Articles: Wireless Issue Resolution Guide RADIUS Issue Resolution Guide MV32 Installation Guide Major Updates: MR45 + 55 Installation Guides Change: Added a note to inform customers about an end-device firmware-based "SSID not seen" issue. Combined Power on MS Devices Change: Added a note including firmware requirements. Deprecation of DES Encryption Algorithm Change: A note has been added stating DES Encryption algorithm is not supported in MX 15.12 and newer and a related FAQ #2 has been updated. MC Communications - All Change: As MC phones are now end-of-support, all MC phone documentation has been set to by-link-only/non-searchable and has been removed from the front page. Splash Page Traffic Flow and Troubleshooting Change: The flow-chart for click-through and sign-on splash with EXCAP has been updated. Returns (RMAs), Warranties and End-of-Life Information Change: Original and replacement modular power supply units and fans for MS and MX Products are included in lifetime warranty and not the 1year warranty for accessories. MS425 Overview and Specifications Change: MS425-16, MS425-32 has 3x MA-FAN-18K and not 4x. Configuring Clients for 802.1X and Meraki Authentication Change: Replaced every "Meraki-hosted RADIUS" mention with "Meraki Authentication" and removed XP, Vista and Windows 7.

CameronMoody · ‎Apr 19 2019

Hey folks, This is expected behavior. We'll be releasing that as a new section eventually. That top-level parent page is currently private and under construction. Coming soon!

CameronMoody · ‎Mar 15 2019

@PhilipDAth Good guess. You're correct, we're working on this with our MX team. We had an old version that had to be taken down to go through a few revisions based on improvements and changes we've made. New version coming soon.

CameronMoody · ‎Feb 25 2019

Hi @AndreasE, Hoping I can help clarify a few things and maybe improve our documentation a bit while we're at it. Site-to-site VPN cannot be enabled for a security appliance template unless VLANs are enabled, and at least one VLAN emits unique subnets. By default cloning templates sets VPN to off to prevent subnet overlap within the Organisation. Config sync doesn't work for "network tags" or "Template networks" (containing an MX appliance and a MS switch) 1. The "VLANs enabled" bit is mentioned in the "IP Address Range Allocations" section, as @PhilipDAth pointed out, but I agree with you that the "emits unique subnets" bit could be a bit more clear. 2. This is not mentioned, and I agree that it should be. I updated this section of the documentation with a couple notes to make these requirements a bit more clear. 3. As @PhilipDAth mentioned, the inability to clone combined networks is currently a shortcoming of the config sync feature. I can't personally speak much to our plans to address this, but we're aware that it is an issue. 1. "known issues": they never tell you, but just keep it under the blanket 2. software bugs: no bug bounty program, instead you get silly reply questions about settings they should better know about than we do (why are they asking for a device ref when they never look into the device whilst working on a case?) 3. really bad or aged documentation on the web 4. instead of an error message or at least a warning, the dashboard falls back into a default setting and doesn't tell you about the risks 1. It's not our intent to hide known issues, it's just difficult to always ensure that we're presenting them in a way that is helpful. Our support engineers use the same documentation site that our users do and help keep it up-to-date, so if it's not recorded, it is almost certainly not an intentional omission. I appreciate feedback like this when you notice we're missing something. 3. I'm personally working on cleaning up as much as we can. I agree that some items are a bit dated and deserve some attention. If something stands out to you as particularly misleading or inaccurate, I'll take a look if you let me know. I realize that doesn't address everything you were concerned about, but hopefully that helps a bit with the things I'm able to speak to. Thanks for the feedback!

CameronMoody · ‎Nov 20 2018

@Kirk Regarding VRRP over LTE, I don't have that information, sorry! Nolan has some clever suggestions for workarounds for now though.

CameronMoody · ‎Nov 20 2018

@NolanHerring That's an awesome blog page. Super kudos. We did fix the LED lights in the install guide, good catch.

CameronMoody · ‎Oct 17 2018

Hi Everyone, @JasonCampbell, @jdsilva, @PhilipDAth @MoBrad I manage our documentation. Hopefully I can clarify a few things here. First: @GreenMan wrote: Whilst it's not related to the cabling, please note that, at this point in time, the new MX67 and MX68 models do not yet support VRRP (i.e. warm standby). This is not correct. MX Cellular models DO support VRRP/warm standby, just not using cellular. You can absolutely set up MX Cellular models in an HA pair configuration, we just recommend doing so without LTE. This is what your recommended failover options look like: On the left, you can use MX Cellular models just like any other MX model in a standard HA pair. The left-side design is the recommended HA design for ALL MX models. Notice that the topology matches the documentation. The design on willette.works is not an official Meraki design and is not recommended. So you might be thinking: "The design on the left is using cellular MX models but isn't using LTE failover at all. What's the point in using cellular models?" - If your priority is HA failover, you may not want to use an MX Cellular model. If your priority is LTE failover, we recommend the design on the right side. If you happen to have an MX Cellular model on hand and WANT to do HA failover, the design on the left side is officially supported and recommended. The design on the right side is how we officially recommend using LTE failover. On a single MX Cellular device, not in an HA pair. Alright so, the next question is: "Alright, well what would happen if I DID set up LTE in an HA pair?" This is answered in the HA documentation, as @NolanHerring pointed out. Cellular Failover Behavior Meraki does not currently support any cellular failover with a high availability (HA) pair; as we do not perform connection monitoring on cellular uplinks (as of MX 10.X+), which is necessary for HA uplink failover. At this time, if a cellular uplink is used in an HA pair, the following will occur in order: Primary MX WAN 1+2 fails > fails over to Secondary MX Secondary MX WAN 1+2 fails > fails over to Primary MX Cellular Primary MX cellular fails > fails over to Secondary MX Cellular What does that actually look like? Here's a diagram to clarify: This diagram shows what happens when you use LTE in an HA pair. Note the RED TEXT at the top saying that this isn't officially supported or recommended. This is just to clarify current device behavior. Cheers.

CameronMoody · ‎Oct 15 2018

@CarolineS @NickCalcutti Hey @NickCalcutti, I inspected the page and there doesn't appear to be a space. It looks to be "adb shell dpm set-device-owner com.meraki.sm/.DeviceAdmin" in step 8, as you wrote above that it should be. Maybe it's an HTML/font kerning issue that made it appear that way? Or maybe I'm not looking at the right part? I promise there haven't been any edits recently!

CameronMoody · ‎Sep 11 2018

@jdsilva Coming soon!

Meraki

Community

About CameronMoody

CameronMoody

Community Record

Badges

Re: Dashboard API - Security Events - End-points returned only partial sets...

Re: Nice Meraki Icons ?

Re: Set Password requirements Windows 10 - Meraki

Re: Documentation Digest: July 29 - Sep 13

Re: Documentation Digest: July 29 - Sep 13

Re: Documentation Digest: July 29 - Sep 13

Re: Documentation Digest: July 29 - Sep 13

Documentation Digest: July 29 - Sep 13

Re: Documentation Digest: 6/24 - 7/1

Re: Documentation Digest: 6/24 - 7/1

Re: Documentation Digest: 6/24 - 7/1

Documentation Digest: 6/24 - 7/1

Re: Documentation Digest (May 24 - June 24, 2019)

Re: Meraki Cost Calculator

Documentation Digest (May 24 - June 24, 2019)

Re: MR45 Dark Mode

Documentation Digest

Re: FYI | Documentation Links Broken: 'Architectures and Best Practices' -...

Re: MX NoNAT documentation

Re: Dashboard SW bug: Cloning a Config Template "looses" Site-to-Site VPN s...

Re: How to cable MX & MS for HA

Re: How to cable MX & MS for HA

Re: How to cable MX & MS for HA

Re: ADB install of Systems Manager

Re: Meraki Product Newsletter

Re: MR45 Dark Mode

Re: FYI | Documentation Links Broken: 'Architectures and Best Practices' -...

Re: MX NoNAT documentation

Re: Noticed a typo in a Knowledge Base Article

Meraki Help Widget - Support Chat for Licensing - Coming Mid October

[CLOSED] Share your favorite articles or new ideas for Meraki Documentation...

Dashboard - Packet Capture File Names and .pcap Default

MX - Client VPN Usability Improvements

Documentation Digest: June 21st - July 21st