Meraki

RWelch

Exciting stuff!!! Cloud EVPN Fabric: provides the simplicity of a unified layer 2 network combined with the stability, speed, and scalability of layer 3 routing, all easily managed from the cloud with minimal manual configuration. Cloud EVPN Fabric Overview Cloud EVPN Fabric Installation / Lab Guide

RWelch

It would be ideal if the images depicted in the Cloud EVPN Fabric Installation / Lab Guide were a bit larger to be able to see what is being displayed in each (or able to open them by clicking on the image). They are too small to view as published.

RWelch

AI assistant suggests these troubleshooting steps: Check Umbrella Reporting Integration Replace the Umbrella Reporting API key in Secure Connect. Go to Secure Connect > License & API Keys and use the "Replace API credentials" option on the Umbrella Reporting credentials card. Follow the instructions to retrieve and apply a new key, then verify if stats appear in Secure Connect. Cisco Secure Connect - Account Setup Troubleshooting Confirm Data Storage Location Alignment Check the data storage location in both dashboards and ensure they are paired correctly (e.g., US with North America, Europe with Frankfurt). If misaligned, follow Umbrella documentation to correct the region pairing. Reserved IP Guidelines Review Firewall and Routing Configuration Ensure firewall rules in Secure Connect allow agent traffic to the Internet. Traffic to Meraki and ThousandEyes backend should be excluded from HTTPS Inspection. DNS traffic (port 53 to Umbrella resolvers 208.67.222.222 and 208.67.220.220) should be bypassed from Secure Connect tunnels to avoid policy mismatches and reporting gaps. Umbrella SDWAN Connector Deployment Guide Use Umbrella Reporting Tools for Verification Verify egress source IP addresses and traffic details in Umbrella by using the Activity Search page and filtering by egress data center. This helps confirm that traffic is being processed and reported correctly in Umbrella, even if Secure Connect is not showing stats. Umbrella Reporting Tools General Integration Checks Ensure the Umbrella and Meraki dashboards are properly linked via API. Confirm that the correct policies are assigned and that UDP 443 traffic is allowed to Umbrella endpoints. Manually Integrating Cisco Umbrella with Meraki Networks Summary of Next Steps: Replace the Umbrella Reporting API key in Secure Connect. Verify and align data storage regions between Meraki and Umbrella. Review firewall and DNS exclusion rules. Use Umbrella’s Activity Search to confirm traffic visibility. Double-check API integration and policy assignments. If these steps do not resolve the issue, please provide more details about your Secure Connect and Umbrella configuration, or contact Cisco Meraki support for further assistance. Sources: Cisco Secure Connect - Account Setup Troubleshooting Reserved IP Guidelines Umbrella SDWAN Connector Deployment Guide Manually Integrating Cisco Umbrella with Meraki Networks

RWelch

You will likely need to work with your Meraki partner and/or support.

RWelch

Organizations using active legacy licensing models, such as Co-term or PDL, are unable to claim subscription license keys. Mixed licensing modes are not permitted. Subscription - Licensing Claim Cloud Subscription License keys can only be claimed by an expired organization, an organization in a grace period, or a newly created organization (this includes ones created via Organization split).

RWelch

What firmware are you currently running? Initial thoughts: this doesn't sound like a community fixable issue however you might consider opening a support ticket with engineering. Ways to Contact Meraki Support

RWelch

Meraki Support

RWelch

Normally an indication of a client being further away from the AP. Dense building materials could factor into that equation a bit too.

RWelch

Perhaps so (kinda expensive) but it is an outdoor option.

RWelch

Cisco Wireless CW9179F Access Point

RWelch

Are you an organization admin? You can also customize this setting Organization > Configure > Settings by adding your e-mail address for licensing, hardware defects, and maintenance.

RWelch

The WAN breakout switch should be in it's OWN (separate) network - not part of your downstream switches.

RWelch

Give your feedback (previously Make a Wish)

RWelch

Give your feedback (previously Make a Wish)

RWelch

There is no method to delete Meraki AP connection logs or timeline logs from the Wireless > Overview section in the Meraki Dashboard. These logs are retained for network monitoring, troubleshooting, and historical analysis, and the Dashboard does not provide an option for administrators to manually clear or delete them. You can filter and view up to a month's worth of connection history, but deletion is not possible.

RWelch

I'm not aware of any backend tweaks. If this hub doesn't truly need to be full mesh hub, you could consider the idea of converting it to a spoke to reduce tunnel count and traffic.....or keep it as a hub and disable the multi-uplink with WAN2 tunnels only in a failover scenario.

RWelch

Too bad the documentation couldn't outright lay it out explicitly. I opened a support ticket a year+ ago just to make sure my single MX95 edge and MX95 VPN concentrator (both) were set correctly for client tracking. Glad to say support assists when it's needed but would be ideal if the examples laid it out clearly. Just my 2¢.

RWelch

And the winner is…… Cisco is not responsible for any network interruptions or outages caused by using trial equipment in a production environment. 😊

RWelch

Meraki Go Portal Alternatively, you can also open a case from your Meraki Go portal, by selecting Contact Support from the user icon dropdown in the top right (or by clicking this link). Meraki Go - Support or you can try emailing help@meraki-go.com, though submitting a case via the dashboard/app is usually preferred for quicker resolution as it links your network info.

RWelch

If this were my project, I'd be inclined to have the both MX250s in HA and MS350 stack in one combined network. If the MS350 stack is using L3, you'd use unique identifier. If you keep it at L2 then use MAC address — Default. Separately, I'd put the other MX250s (pair) in their own separate networks as an example MX250-VPN-A (it's own network - same organization) MX250-VPN-B (it's own network - same organization) You would then use "Track clients by IP address" for client tracking, and its deployment mode is "passthrough" (VPN concentrator mode). This is the correct client tracking option for a standalone MX in VPN concentrator mode, as tracking by IP address is recommended when the MX is not the layer 3 gateway for clients. Client-Tracking Options

RWelch

Thanks for sharing the video (had not seen it before) but have seen BRKEWN-2046 slide deck before. Good stuff.

RWelch

I've seen the ability to "clone an existing network" (not organization) which still doesn't protect one if the organization is deleted.

RWelch

I'll be sure to check back on this post to see if you are able to find a solution outside of the PCI compliance, if one exists. Best of luck and cheers!

RWelch

A close alternative: Meraki is certified as a PCI DSS Level 1 Service Provider (the most rigorous audit level). You can learn more about Meraki's own PCI DSS compliance at https://meraki.cisco.com/trust#pci PCI Compliance with Meraki

RWelch

If interested, you can use the search box at the top of the page to see previous posts and responses about the need for backing up dashboard configurations.

About RWelch

RWelch

Community Record

Badges