I recently had issues getting my Cat9300 onboarded to Meraki. I was getting the error "Cloud is not able to login to device". It ended up being an issue with my AAA config.   I had the following AAA config so that when I SSH to my VTY lines it would use my TACACS servers first, and then fall back to local if they were unavailable: aaa authentication login default group TACACS_GROUP local aaa authorization exec default local group TACACS_GROUP local   But Meraki doesn't seem to like that. I tried a ton of things and came up with Meraki requiring those "default" auth-n & auth-z policies to be only local aaa authentication login default local aaa authorization exec default local   So how I solved this was to create a separate policy just for SSH (tied to my vty lines) so that I can still enforce using my TACACS servers when connecting remotely into the switch, but be able to have those "default" policies as local aaa authentication login default local aaa authorization exec default local aaa authentication login SSH group TACACS_GROUP local aaa authorization exec SSH group TACACS_GROUP local   line vty 0 31 authorization exec SSH login authentication SSH     Once I made those changes I was able to successfully onboard my switch to Meraki Dashboard for Monitoring.   ... View more