So;    currently in Meraki / Cloud mode the only option for full (small) Core resilience is to use physical stacking.   This is dependent on max. 3m cables, so:    same room.   If you absolutely need to separate the two core switches (and can't go to C9500 which supports Stackwise Virtual) then you'd look to configure through 'traditional' methods (e.g. SSH) and configure a first hop redundancy protocol like HSRP - but monitor through the Meraki Dashboard:   https://documentation.meraki.com/Cloud_Monitoring_for_Catalyst    (look at the info for 'Switching customers'   All I would say about using (solely) cross-stack etherchannel for resiliance;  consider what happens if someone introduces an unplanned physical loop. Note:   you will not be able to use etherchannel to MX(s).    Check out the documentation on warm spare in routed mode:  https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Routed_Warm_Spare   ... View more

I can't help feeling that, all things considered, if you want the full cloud dashboard experience and best value overall, your best bet would likely be to order new WiFi7 APs and manage them in the Meraki Dashboard (no WLC needed) ... View more

So;   your AP model cannot be converted to be fully managed directly in the Meraki Dashboard    (those APs all start CW) And your current Wireless LAN Controller (the EWC) cannot be monitored in the Meraki Dashboard. For cloud dashboard operations, I think you'd need to use your existing APs with a supported 9800 WLC.  Right now that would mean using a hardware Controller.   One of these: C9800-L-C C9800-L-F C9800-40 C9800-80 Note tht the latter two have, very recently, had End of Sale announced for them. If you adopted this approach, the configuration of your wireless environment would (still) lie with the (new) WLC, but you'd get a high degree of visibility from the Meraki Dashboard. https://documentation.meraki.com/Cloud_Monitoring_for_Catalyst/Getting_Started/Cloud_Monitoring_for_Catalyst_Wireless_Requirements   ... View more

Does the MX definitely see (route) the relevant DNS queries and responses? Appropriate visibility is needed to turn the domain name into the correct IP-layer rule Is there any chance the lookup involves CNAME responses? https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings#FQDN_Support I'd look to see if you can packet capture the full query & response Maybe think about a case with Meraki Support to assist with this - specifically and more generally ... View more

What makes you say that the usual c9300 doesn't support Virtual Stacking?    I wonder if you may be mixing up the product with its mode in the Meraki Dashboard..? If you have fully managed C9300 switches in your Dashboard, regardless of the model (9300 / 9300L / 9300X) they all support Virtual Stacking;    you see all ports in a given Network in one page and can configure combinations of those ports in one go. If you have C9300 switches where you are managing the configuration using more traditional methods (most likely, SSH) and just monitoring them in the Dashboard, then Virtual Stacking isn't applicable. ... View more

Really glad you were able to get this sorted 👍 Did you get to the bottom of what went wrong first time around? On the face of it, someone either ordered slightly the wrong SKU or in the supply chain someone changed it from the right (cloud) one to the wrong (on-prem) one - perhaps when lead times didn't match (?) Just keen to ensure you don't end up needing to do this again in future (especially if you have wiped your 9800-CL in the meantime!)    the right SKU for Meraki mode is CW9164I-MR and you'll need an appropriate license, probably LIC-ENT-xYR    (x = 1, 3, 5, 7 or 10) ... View more

As a general point, I'm entirely with you!    Unfortunately, if the WiFi7 ease-of portability ever becomes available to CW 6E APs, I'm not sure how that would help these particular 'adrift' CW9164s...   Given that from hereon I'd expect (recommend) the vast majority of new purchases to be WiFi 7 models anyway, it'd be a bit of stable-door bolting too, if you catch my drift.   I'm thinking there might be, from an engineering perspective, a bit more to it than <ctrl-c>, <ctrl-v> too  😉 ... View more

With CW916x in DNA mode you require a WLC, from which to initiate the migration to Meraki/cloud mode.   Assuming you don't have one / can't easily spin up a 9800-CL (virtual WLC), I suspect that initiating an RMA and procuring the correct (-M) SKU would be the best approach here.   Particularly if you ordered the right SKU and someone down the line switched it, for some reason. BTW:  this becomes so much easier with WiFi 7 APs...   While there's no 9174 (yet) maybe consider going up to 9176 (or possibly down to the brand new 9172) as that would give you some more functionality and greater longevity too. ... View more

If I recall correctly,  ICMP needs to age out.   Rules for more common actual application flows tend to take effect immediately.  ... View more

Agreed...   working for me now too ... View more

Where are people located and what ISP are you with?   (I too am having issues in the UK, on Virgin Media) ... View more

Es probable que necesites este cable en España, a menos que estés utilizando una PDU estilo centro de datos;   MA-PWR-CORD-EU Usamos solo cables C15, porque también funcionarán con dispositivos C13 (que funcionan con corriente más baja) ... View more

A case raised via Meraki Support would be the correct route for this kind of ask. ... View more

Can you document how the MXs are interconnected with the switching (and each other, if applicable) on the LAN side? This may or may not apply here, but I see lots of people trying to use their warm spare pair of MXs as a LAN core, when that's not best use of them.  Instead; aggregate LAN uplinks in the switching then use as simplified a set of trunk uplinks from switch aggregation layer into the MX pair as per the recommended topologies section here:   https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Recommended_Topologies ... View more

That sounds like MX warm spare to me -  you're trying to provide continued connectivity, should the MX fail..? https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Routed_Warm_Spare ... View more

The issue with keys leaking out could be offset, to a large degree, by use of MDM   (e.g. Meraki Systems Manager);   only distribute the relevant key via install of the appropriate WiFi profile...   If this general issue is of particular concern to your business though, as mentioned before;   Enterprise 802.1X with RADIUS would provide a lot more control. ... View more

Every Meraki device is managed by the Meraki Dashboard. What I think you're getting at though;    the built-in wireless of an MX64W (the W bit) is separate from the wireless provided by any MR Access Points.   Even if you place the MX and the APs in the same Network, the setups are configured via different menus and will not interact with each other.   You could, for example, configure an SSID on the MX (via Security & SD-WAN menu) and an SSID with the same name on the APs (via Wireless menu) but the APs and the MX would not co-ordinate channel and power settings (AutoRF), nor would a client device roam seamlessly between the MX and the APs. It should be noted too that the WiFI capabilities of the MX6xW are significantly less sophisticated than any of the dedicated APs shipped in the last half-dozen years. ... View more

Raise the case here:   https://meraki.cisco.com/meraki-support/open-a-support-case/ ... View more

I know that route filtering for BGP is generally under consideration, but can't provide any specific details.   In the meantime, definitely apply VPN firewall rules - controls traffic leaving the MX:  https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#VPN_Firewall_Rules   ... View more

I'm not in PM but my take would be;   IPv4 requires NAT - there aren't enough addresses to give each device its own public address.   IPv6 was designed to allow every device it's own address, so no NAT required. ... View more

My question would be;   what's the driver behind wanting four links? ... View more

Contact Meraki Support.  Calling them on the phone definitely recommended:   https://documentation.meraki.com/General_Administration/Support/Contacting_Support   ... View more