Possibly a faulty controller? Let us know how you go. ... View more

Hey @cabricharme, Re: the pcap. 1.) Just run a raw capture, no filters at all. 60-second duration is fine. 2.) Enter "STP" in the filter of WireShark. 3.) Check the STP frames for the Server/Host Mac Addresses. If so, it is running Spanning-Tree.  4.) Log into the KVM or Web UI etc for the Server/Host to turn off Spanning-Tree. See example below;   STP Pcap Example   Re: The similar issues you've come across in the past. This comes from my Personal experience. Not sure if customers have posted here or not. I've also run into this during deployment.  ... View more

BPDUs are never sent untagged. It must have a VLAN-ID. So then yes, you must tag on the non-meraki switch Trunk ports. Which is more manual work to do and get working, and a pain to tshoot..  You don't have to use Option a. You mention the non-meraki switches can run MST. If you run the same Spanning Tree Protocol across all switches. Then it's very easy to design and tshoot.  Here is the rest of the quote: "MS series switches to participate in spanning tree a spanning tree instance must be running on VLAN 1 of all switches and VLAN 1 is allowed on all trunk ports running PVST+ so that BPDUs are seen by the Meraki switches in the topology." ... View more

"47.2W for each APs." 40Watts is the Maximum for the MR57. Did you mean 47.2 Volts? https://documentation.meraki.com/MR/MR_Overview_and_Specifications/MR57_Datasheet#Specifications Judging from that Screenshot; perhaps Spanning Tree could be shutting ports??? That would make sense if configured in 'Power Sharing' mode'.  As you have an Agg/Port Channel configured. Make sure it is configured correctly and matching on both the switch and MR57. See below details. https://documentation.meraki.com/MR/MR_Overview_and_Specifications/MR57_Dual_Uplink_High_Availability#Prerequisites ... View more

Agree with the native part. But here you would Tag VLAN 1 and not leave it native anywhere. It would need to be pruned from Access Ports to end devices, PC, Printers, etc. So you're after Option b.)  MST is completely compatible with STP/RSTP. It is just an expansion to the protocol. It adds a per-VLAN Spanning Tree to better use the paths on each VLAN. Which is why it is recommended.   ... View more

Hi @Sakul , The BPDU's are exchanged on ALL VLANs; per the RSTP standard. That said, you can set up VLAN 1 like a Transit for PVST/PVST+. But it can get messy. It is recommended to use MST. https://documentation.meraki.com/MS/Deployment_Guides/Advanced_MS_Setup_Guide#Protocol_interoperability   ... View more

Hi @cabricharme , I've come across similar issues like this in the past, where the host/server has Spanning Tree and or mismatched VLAN set to default. Run a packet capture from the MS120 Port to the Host to confirm. You can set up Port Mirror if needed. https://documentation.meraki.com/MS/Monitoring_and_Reporting/Packet_Captures_and_Port_Mirroring_on_the_MS_Switch ... View more

Hi @allywenzel , I do see this type of situation often. Usally something changes to cause this.  That log "stp_tcn_error" 'Topology Change Notification". Meaning the Layer 2 path or Spanning Tree is changing where all traffic should go. Most of the time, someone plugged in something. Or in your case, most likley a cable or device is misbehaving. As @RaphaelL reccomended, check you RSTP Root and make sure it is it is in fact the Root. Use the following guides to assist in the investigating and mitigation.    https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS   https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MS_Switching/General_MS_Best_Practices       ... View more

Hi @GIdenJoe , Those are some valid points you make. And there are certain business and use cases where an Airgap soultion is better suited than Cloud based. However, I would argue that;   - "CLI you immediately now at what command you just fumbled". This is not always the case. In the Configuration Shell the problem might not error or be seen in Syslog at all. E.g. if there is a certain traffic flow conditions being hit and the configuration is 'correct' you won't be able to see it from that Shell. i.e. Logs will need to be pulled from the controllers on the Line Card or Module directly. This can be very tedious & time consuming to discover this condition at all.    - Regarding the disconnects to Magagement and or the devices. I have certaily worked on cases where, sites are out in the sticks, only have Sateliete (RTT of 300ms) and perfrom very well all things condisered. That customer had the the proper design considerations in place to achieve this. i.e. VLAN Pruning, STP following best practice, traffic shaping policy in place. etc.   Yes, things can go wrong sometimes. Which is why i love the Dashabord, because you can very quickly discover these then spend the time drilling into root cause. Just my Two Cents.     ... View more

"Would have been 15 seconds at CLI.  I am not a fan of GUI, give me terminal any day." That's what I said when I started at Meraki... Now?... I won't go back to CLI ever. The Meraki Dashboard wins hands down. 'Want to enable a new VLAN across multiple sites?'. Can be done in less than 15 seconds.  'Want to see why all of a sudden end users are complaining about slow speeds?. The Meraki Dashboard gives you a nice live toplogy view of the network and you can see if a device is misbehaving or it's just a subset of clients only' "Firmware upgrades for remote sites with only a Satelite link?' Dashboard does all the work. Honestly. Go through our Documentation site. Very easy to read, images of configs examaples. We even have videos showing you how to set things up. https://documentation.meraki.com/Getting_Started_with_Meraki Anyway, hope you enjoy the journey.  ... View more

Hi @carlto , This might interest you 😉 "BGP peering over IPsec VPN tunnels can be enabled on the Meraki Security Appliance. This unlocks new dynamic routing use cases for customers in addition to enabling resiliency and redundancy over IPsec VPN peers. "   https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN         ... View more

Hi @SysOP , Do you perhaps have RADIUS VLAN Override configured on that SSID? if so, what does ISE see when this issue occurs? https://documentation.meraki.com/MR/Access_Control/MR_Meraki_RADIUS_2.0#RADIUS_VLAN_Override ... View more

Hi @thomasthomsen , Correct. The Chain of Trust is a must.  😉  See the below excerpt from the AnyConnect Authentication Methods guide.   "AnyConnect server will use the uploaded trusted CA certificate to validate authenticating clients before requesting for the users' credentials. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#Certificate-based_authentication_with_Username_.26_password     ... View more

Hi @AVL , If the AP was connected to another device, sounds like could be IP Address issue and or VLAN towards the Meraki Cloud. Check the LED status of the AP and follow the suggestions in the tshoot guide below. https://documentation.meraki.com/MR/Other_Topics/Troubleshooting_and_Replacing_a_Faulty_MR_Access_Point#If_there_is_one_solid_orange_power_LED_and_no_other_LEDs_are_lit ... View more

Hi @JordanCN , This would be a web browser cookie situation, I've tested this many times. Here is how I resolved this. 1.) Go to the Dashboard page you prefer. Note the time/date. 2.) Logout of the Dashboard. 3.) In you broswer history. Delete all entries of the Dashboard. EXCEPT the page preference... NB, you might need to add a column to see time/date that page was visted. 4.) enjoy... 😀   ... View more

Hey there! In general, for most capable Layer 2/3 devices. You tag the port with your VLANs, then create virtual interfaces for each VLAN and add the layer 3 IP details; as shown in your examples. However, I am not certain about FirePower configurations. It's best to refer to the configuration guides or reach out to their support team for assistance. The Meraki Switch shouldn't be a problem as long as the port configurations are correct. ... View more

Hi @Acepak1 ,   Given the brief, if the Meraki Switch is only Layer 2 and will not perform any routing. Then the default config right out the box should be ok. See below guide for specifics.   https://documentation.meraki.com/MS/Deployment_Guides/Advanced_MS_Setup_Guide#Default_configuration   Essentially you could use the design on the right for VLAN 1 for Management (switches need IP address) and set the ports to match the VLANs needed for clients, dhcp, etc. just pay attention to;   1.) Ensure Ports being used have correct config. a. Ensure they are Trunked (only to other device ports that need specific vlans) or Access. b. Confirm Native Vlans match   2.) Ensure STP Root is set on the correct switching device. Don't know how many you have. So refer to guide. So something like on the Meraki Switch. STP = Managemnt VLAN 1. STP Priority = 32768   VLAN 1 = Management Vlan 10 = Data (DHCP, etc) Vlan 20 = Voice Port 1 -> other switch or AP Port Trunk Native VLAN 10 Allow 1,10,20 Port 6 - > to PC or Deskphone Access Native 10 Allow 10, 20       ... View more

Hi @Flip1365 , As @Brash mentioned, try the options in the guide. If stuck, you'll need to open a case. Note this can't be done via the Phone. In the Section Recovering Access to Accounts Protected by Two-Factor Authentication there is link to use. It should take you to the below.        ... View more

Hi @Blake-Larkan , I've seen issues like this in the wild before. Where, for some reason, the PoE client was not sending the PoE Flag in the CDP/LLDP packets to the switch. In those circumstances, was software bug. Something like this;     I would suggest running a packet capture on port 14 & 16. With one of the devices that are working on Port 13 & 15. Then visa versa for the "non working" PoE Clients.   If there is something funky in the pcaps. Raise a Support case for further investigation.     ... View more

Hi @Yash_03, Sounds like Asymetric path selection is happening here. I'm assuming you have a Switch connected to the MX firewall to service all these VLANs and Hosts. If so, I would recommend confirming the ports on the MX and any downstream switch have the VLAN configuration matching .i.e. Same Trunk details (Native VLANs & Tagged VLANS) or Access VLANs etc. The MX LAN ports do not behave like regular Switch ports. See below guide for further details. https://documentation.meraki.com/MX/Networks_and_Routing/MX_Layer_2_Functionality     ... View more

Hi @cscarpa , For Stacking it wont work. Port Aggregation it the way to go for connectivity between the two. See below guide for supported Accessories.   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Small-Form_Factor_Pluggable_(SFP)_and_Stacking_Accessories#Stacking_Cables         ... View more

  If it is happening Inbound too. Then that would mean that the problem is 'No Voice Path'. I.e. RTP/Audio streams. This is mostly due to a problem with signalling or due to Firewall/NAT/Port Forward issues.   Check the Voice Platform for indications of signalling problems. Check the configuration of firewall, switch, routers etc on the voice path. If you only have 2 VLANs, you might want to use 1 VLAN for Data and the other for ALL VoIP related traffic. Of course, always consult the Vendor's Platform guide. See below Meraki guide for common tips.   https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/VoIP_on_Cisco_Meraki%3A_F.A.Q._and_Troubleshooting_Tips#Internal_Notes_-_Additional_VoIP_Troubleshooting_FAQs   And remember, Packet Captures are your best friend. 😁 ... View more

Hi @J_Donegan , As @GreenMan has mentioned. Packet captures are the way to go to confirm issues or unexpected behavior. Do you know if the SCCM is using Multicast instead of Unicast traffic to communicate. This could explain the behvaior. If so, see below guide to ensure the set up is correct.   https://documentation.meraki.com/MS/Layer_3_Switching/MS_Multicast_Routing_Overview         ... View more

Hi @rhamersley , As @thaack mentioned, Group Policy is the way to go for seperation and security. However, if you are finding that they are not enough IP address being assigend. You can simply expand the subnet range. E.g. 192.168.1.0/22 would give you 1022 IPs to use.  ... View more

Hi @db3 , If your goal is to block IP/Subnets, there are a few ways this can be achieved. This does depend on your design though. E.g. Enabling a Group Policy to block traffic is a great way.   https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/MR_Firewall_Rules       ... View more