I'm not sure if you've come across this yet, but I had a similar issue and I believe it was related to my AAA config - more info here: https://community.meraki.com/t5/Switching/Catalyst-9300-Meraki-onboarding-Authorization-issue/m-p/262666/highlight/true#M19362   However while that fixed my issue on the first one, I am once again running into the same error with my AAA configured the same as my successfully onboarded switch. I've run AAA debug commands on the Catalyst switch while doing the onboarding and it appears the "meraki-user" account is able to login successfully so I'm not sure what the deal is.   I'm going to keep investigating, let me know if you make any progress! ... View more

I recently had issues getting my Cat9300 onboarded to Meraki. I was getting the error "Cloud is not able to login to device". It ended up being an issue with my AAA config.   I had the following AAA config so that when I SSH to my VTY lines it would use my TACACS servers first, and then fall back to local if they were unavailable: aaa authentication login default group TACACS_GROUP local aaa authorization exec default local group TACACS_GROUP local   But Meraki doesn't seem to like that. I tried a ton of things and came up with Meraki requiring those "default" auth-n & auth-z policies to be only local aaa authentication login default local aaa authorization exec default local   So how I solved this was to create a separate policy just for SSH (tied to my vty lines) so that I can still enforce using my TACACS servers when connecting remotely into the switch, but be able to have those "default" policies as local aaa authentication login default local aaa authorization exec default local aaa authentication login SSH group TACACS_GROUP local aaa authorization exec SSH group TACACS_GROUP local   line vty 0 31 authorization exec SSH login authentication SSH     Once I made those changes I was able to successfully onboard my switch to Meraki Dashboard for Monitoring.   ... View more