Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Become a member of the Cisco Meraki Community today
Get answers from our community of experts in record time.
Join nowAbout FCU_JE
FCU_JE
Here to help
Member since May 1, 2025
Thursday
Community Record
10
Posts
6
Kudos
0
Solutions
Badges
a week ago
@Brash and @cmr - responding to both of you at once. >Hybrid mode is still new. It is replacing the old "Cloud monitoring" mode. It has only been released around a month ago and is still in the process of rolling out to all regions/dashboards. According to support case 13057290 this is incorrect, quote "Hybrid mode is already available for our entire customer base. The current documentation is outdated and needs to be updated accordingly." This makes sense as after all, new organizations can't even onboard the previous cloud monitoring method as of May 1st, so it stands to reason they would enable it for all customers. >In my experience, having off boarded and then on boarded several Catalyst switches, the Meraki cloud ID is derived rather than random, so does remain consistent for each device. I can confirm (sample size of one) that this does appear to be the case - toggling the `service meraki connect` off/on does not change the Meraki serial/claim id. >For now, I suggest engaging Meraki support to confirm the procedure. It's likely something that is internally documented but yet to make its way to external documentation. I mean idk about you guys but lately I've found Meraki is pretty slow to respond to my cases and even if I call in, I have to get triaged to someone on the Catalyst team and almost every time that's been quite difficult to do. It would be far more efficient for all customers if Meraki just published the documentation now, even if it's incomplete. I will resist a full rant, but it's really telling that Meraki has this available to all customers but hasn't even completed publishing documentation.
... View more
a week ago
Just to put this up-front : I have been playing around with the new Cloud-Native IOS-XE and to say I'm unimpressed would be an understatement. So I'm biased and I may not be thinking entirely straight. Meraki has documentation here on how to offboard switches from Cloud Monitoring for Catalyst. I think the documentation leaves something to be desired, but it exists. Meraki does not appear to have documentation for how to offboard switches from Cloud-Native (Hybrid Operating Mode). My focus is on hybrid, not cloud operating mode so I have blinders on in that respect. The problem and reason for this post is - unless I'm missing it - there isn't documentation on how to offboard a switch from Cloud-Native mode. Is it as simple as deleting the device from the network? But then should I remove it from my organization? Is there a benefit in doing so? What about on the switch itself, should I run `no service meraki connect`? Are the cloud IDs deterministic for each switch or randomly assigned if I choose to run `service meraki connect` again in the future?
... View more
a week ago
1 Kudo
I'm still in rapid testing mode and in hindsight I may have exaggerated just how much luxury I have with regard to timeline. I will skip over the case for now but my original post should give anyone in Meraki the ability to try and reproduce the problem. It's as simple as onboard a switch, offboard a switch, then observe the config post-offboard.
... View more
2 weeks ago
1 Kudo
I'm not in a hurry on this one yet. I made this as a post vs a support case mainly to create awareness and I figured it might get more visibility/treated as a bug rather than the support approach (which I've noted is slower than I've been used to with Meraki in previous years). Plus by sharing broadly, maybe people will try to reproduce it to see if they see the same thing. I'm still working out my process for deployment of new 9200L switches so I have the luxury of time to test the new cloud-native hybrid mode to see if it will work for us (and ultimately save me time later/post-deployment).
... View more
2 weeks ago
2 Kudos
Not really the point though. If Meraki installs a config during onboarding it should (subject to reasonable exceptions) remove it during offboarding.
... View more
2 weeks ago
I've made a new post over at https://community.meraki.com/t5/Switching/Catalyst-Cloud-Monitoring-Offboarding-Feedback/m-p/271271#M20341 with one result from my initial testing of offboarding from cloud monitoring specifically. I have a lot more testing to do but generally over the last few work days I can only say that Meraki is really not impressing me with their Catalyst monitoring - very sluggish to respond to changes that I make to the switch stacks. Fingers crossed Cloud-Native/hybrid operating mode is a lot better.
... View more
2 weeks ago
2 Kudos
I'm investigating the transition from "Cloud Monitoring" to "Cloud-Native IOS XE" (Hybrid Operating Mode). I took one of my stacks running in cloud monitoring and went through the removal steps in the dashboard. Easy enough by itself but on further investigation, I think Meraki is failing to completely clean up the configurations it makes as part of onboarding. Below are what I found which are configurations Meraki applies to switches/stacks but DOES NOT remove as part of offboarding. In no particular order: aaa authentication login MERAKI local
aaa authorization exec MERAKI local
!
lldp run
!
ip ssh server algorithm authentication publickey password keyboard
!
line vty 16 17
transport input ssh
line vty 18 19
access-class MERAKI_VTY_IN in
access-class MERAKI_VTY_OUT out
authorization exec MERAKI
login authentication MERAKI
rotary 50
transport input ssh
!
netconf-yang
! Now in fairness, there could be a few of those which might make sense to leave behind as they could hurt an admin's ability to troubleshoot/manage the switch/stack if it's already functioning (ip ssh and lldp) but as for aaa/netconf/the line configs? Those don't need to persist post-offboard. Below is some show log output if it helps show what *was* removed/done. switch#show logg | include HA_EM-6
May 6 20:08:19.107: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Start running
May 6 20:08:19.109: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: config terminal lock
May 6 20:08:19.223: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing brownfield device config
May 6 20:08:19.223: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps smart-license
May 6 20:08:19.550: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps config-copy
May 6 20:08:19.661: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps config-ctid
May 6 20:08:19.774: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps config
May 6 20:08:19.886: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1024
May 6 20:08:20.097: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1030
May 6 20:08:20.209: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1031
May 6 20:08:20.322: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1001
May 6 20:08:20.433: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1002
May 6 20:08:20.546: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1003
May 6 20:08:20.656: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1004
May 6 20:08:20.770: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1007
May 6 20:08:20.882: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 2002
May 6 20:08:20.993: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1011
May 6 20:08:21.106: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1012
May 6 20:08:21.218: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1013
May 6 20:08:21.329: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1014
May 6 20:08:21.441: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1015
May 6 20:08:21.555: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1016
May 6 20:08:21.665: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1017
May 6 20:08:21.778: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1018
May 6 20:08:21.894: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1020
May 6 20:08:22.006: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1021
May 6 20:08:22.118: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry transform MERAKI_INTF_STATS_DELTA
May 6 20:08:22.330: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry transform MERAKI_PORTCHANNEL_STATS_DELTA
May 6 20:08:22.645: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no device-tracking policy MERAKI_POLICY
May 6 20:08:23.086: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server host 18.232.244.158 traps version 2c public
May 6 20:08:23.297: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no logging host 18.232.244.158
May 6 20:08:23.416: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip route 18.232.244.158 255.255.255.255 Null0
May 6 20:08:23.629: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing tls config
May 6 20:08:23.630: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no crypto tls-tunnel MERAKI-PRIMARY
May 6 20:08:24.093: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no crypto pki trustpoint MERAKI_TLSGW_CA
May 6 20:08:24.206: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:24.425: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: % Be sure to ask the CA administrator to revoke your certificates.
May 6 20:08:24.425: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing user config
May 6 20:08:24.426: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no username meraki-user
May 6 20:08:24.539: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:24.758: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: ip ssh pubkey-chain
May 6 20:08:24.869: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no username meraki-user
May 6 20:08:24.982: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: exit
May 6 20:08:25.094: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip ssh port 2222 rotary 50
May 6 20:08:25.206: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip access-list extended MERAKI_VTY_IN
May 6 20:08:25.654: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip access-list extended MERAKI_VTY_OUT
May 6 20:08:25.767: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no interface Loopback1000
May 6 20:08:26.333: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Clearing VTY lines
May 6 20:08:26.333: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: do-exec clear line 16
May 6 20:08:26.445: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:26.556: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: do-exec clear line 17
May 6 20:08:26.670: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:26.780: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing VTY config
May 6 20:08:26.781: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: line vty 16 17
May 6 20:08:26.894: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no rotary 50
May 6 20:08:27.005: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no access-class MERAKI_VTY_IN in
May 6 20:08:27.117: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no access-class MERAKI_VTY_OUT out
May 6 20:08:27.229: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no authorization exec MERAKI
May 6 20:08:27.342: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no login authentication MERAKI
May 6 20:08:27.454: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: exit
May 6 20:08:27.565: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no event manager applet MERAKI-DASHBOARD-CLEANUP
May 6 20:08:27.776: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: end
May 6 20:08:27.789: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: write memory
May 6 20:08:32.812: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Finish running
switch#
... View more
2 weeks ago
Thanks for doing some testing. That doesn't inspire me with a lot of confidence that it's not a clean offboard experience. From your report it seems hybrid operating mode needs some more time in the oven. I hope to complete some of my own testing today - no guarantees if I'll be able to do that testing let alone report back.
... View more
2 weeks ago
Separating my reply by rough topic. I'll add the disclaimer here I'm still extremely new to catalyst management/monitoring via Meraki so I operate from ignorance here. Firmware: That makes some sense. I guess I'm not clear on the connection of what Meraki considers stable vs what the IOS-XE Cisco devs consider stable/GD. I think I'm going to test/try it out and see how it goes. Local Status Page/HTTP(S) server: Don't think that article applies here, quote: Catalyst switches onboarded for Cloud Monitoring will continue to run IOS firmware, which does not support access to the local status page. However, Catalyst switches operating in Meraki-managed mode will run CS firmware, which does support access to the local status page. In this case we're not talking about CS firmware so I doubt that applies here. Yes, SVI will help but not truly minimize exposure. Again, some indication from Meraki why this is required/justified would be nice. Onboarding/Migrating : Without any other info to go on, I'll just leave `ip routing` untouched but all the same, would be nice to have clarity as currently neither of the following articles reference it. https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Upgrading_Cloud-Monitored_Switches_to_Hybrid_Operating_Mode https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Hybrid_Operating_Mode_Switches_Configuration
... View more
2 weeks ago
I just learned about this change yesterday and have reviewed the available documentation. I have several questions around this seeing as Cisco looks to be wanting to move very quickly on this (terminating existing cloud monitoring end of Jan/2026). 17.15.3 is noted as the minimum required version but this version is still marked as Early Deployment. What is Cisco's timeline for this version (or a future interoperable version) to be GD/MD? The configuration documentation notes that the HTTP server is going to be enabled. Is this absolutely required for Meraki to manage the switch? From a purely "don't enable services you don't require" perspective I really don't like this configuration without strong justification. That webUI is bound to be exposed long-term to security vulnerabilities. If the HTTP server is required, can Meraki at least consider adding an access-class similar to the vty lines? One of the prerequisite configurations for cloud monitoring for Catalyst switch onboarding to Meraki is `ip routing` but this is not listed as a prereq in the configuration documentation. Can customers migrating to hybrid operating mode remove ip routing as a configuration, or is it recommended to maintain that configuration? Thanks.
... View more
Labels:
- Labels:
-
Other
My Top Kudoed Posts
© 2025 Cisco Systems, Inc.
