I believe it is normal not to be able to SSH into a Cisco host, so this is not a valid test. Do you have DNA Essentials or DNA Advantage? Pre-Onboarding Confirm that the switch(es) designated for onboarding are one of the following: Catalyst 9200, 9300, or 9500 series hardware Running IOS-XE 17.3.1 - 17.8.x IOS-XE upgrade instructions and release notes: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-3/release_notes/ol-17-3-9300.html#id_67613 Current recommended IOS-XE release information can be found at: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9300-series-switches/214814-recommended-releases-for-catalyst-9200-9.html#anc4 A full list of supported hardware can be found at: https://documentation.meraki.com/Clo...ud_Monitoring Have access to the Meraki dashboard Verify the ability to log in to https://dashboard.meraki.com/ Or create a free account. Instructions are available at: https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Creating_a_Dashboard_Account_and_Organization. Get your organization's dashboard API key. To find or generate an API key: In Organization -> Settings verify that the checkbox for “Dashboard API Access” is selected and saved in the “Dashboard API access” section From My Profile, choose "Generate new API key" or use an existing key. Note that a full admin account must be used. SAML log-in is not supported for API key creation The API key must have full read/write access for the organization to which switches will be onboarded. Additional documentation regarding enabling API access is available at: https://documentation.meraki.com/General_Administration/Other_Topics/Cisco_Meraki_Dashboard_API#Enable_API_Access. If an "invalid API key" error message appears, confirm the key and try again. API keys may take up to 15 minutes to become active in the onboarding application after creation. Ensure reachability The computer from which the onboarding application is run must be able to reach api.meraki.com on TCP port 443 The onboarding application is a stand-alone executable file; security settings on your local device must permit running this application and accessing the API server HTTPS proxy servers that modify the certificate in transit are not currently supported The Catalyst devices to onboard need access to the Cisco cloud Ensure any firewall rules in place allow communication with the gateway corresponding with the dashboard region on TCP port 443: Americas: us.tlsgw.meraki.com EMEA: eu.tlsgw.meraki.com Asia Pacific and Japan: ap.tlsgw.meraki.com HTTPS proxies to access the API endpoint and the TLS gateway are not currently supported. If necessary, ensure rules are in place to allow direct HTTPS connections to each. Connectivity must be via a front-panel port (not the management interface). Only the default VRF is supported. IP routing (ip routing) must be enabled on the switch or will be enabled as part of onboarding. Ensure routes are in place to reach external addresses including a default route (use of ip default-gateway is not supported). Ensure DNS is enabled on the switch (ip name-server {DNS server IP} configured). Ensure DNS lookup is enabled (ip domain lookup). NTP needs to be enabled on the switch (ntp server {address}), and the switch clock must reflect the correct time. AAA on the switch must be configured using aaa new-model. SSH access to the switch CLI must be enabled and accessible via the computer used for onboarding. The user account for onboarding must have privilege-15 level access on the switch.
... View more
