Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Become a member of the Cisco Meraki Community today
Get answers from our community of experts in record time.
Join now- About FCU_JE
About FCU_JE
FCU_JE
Here to help
Member since May 1, 2025
yesterday
Community Record
15
Posts
10
Kudos
0
Solutions
Badges
Thursday
In hindsight I think I misspoke/was mistaken. I don't think I ever made a support ticket for *this* issue. I think at the time I created this community post I was so fed up with the (lack of) support I decided to give the community post route a try instead.
... View more
Wednesday
1 Kudo
Trying to reply to a lot of the back and forth here (but succinctly, so details won't be accurate): "From a customer perspective, it might feel like Support doesn't want to fix it. But I assure you it's absolutely not the case." I like to assume goodwill too, but I found this issue Q1 or Q2 last year and I've had no updates on it. "My understanding is this off-boarding issue has been an edge case that only happened like one in a million times and it's very hard to reproduce" Absolutely not the case for me. All my memories are of course faint now but this was *VERY* consistent in my testing. "What causes this script to fail still unclear." But what is clear is that the Meraki R&D/devs didn't actually test it. Otherwise they would've caught it. It's embarrassing. "they are a limited resource and there are other issues to investigate" Agreed, but if you want to (continue to) sell the service/product (in the interest of retaining Meraki's place in the market and as a result, ensure your own self-preservation), it's got to be stable. "They know the limitation above so actually they are saving your time" Except (last I checked) these limitations aren't even documented in the Meraki docs. "Now you got me curious about it. What was their IOS XE version? Were they all running the same version?" Not who you asked, but I was testing on a few different versions at the time of 17.12 and 17.15 and it was all consistently not removing the configs. Again, no one is testing this (chose your expletive). I don't have 130 switches like the other commentor. Order of magnitude smaller. All these issues with the Meraki ... whatever you're calling it ... monitoring for Catalyst while not large individually are adding up and make me MUCH less eager to recommend my managers to consider Meraki in the future. The only things that really separate networking vendors these days are security reputation, support quality, the management plane, and cost. Meraki (Cisco) is not leaps and bounds ahead of the pack on any of these metrics.
... View more
Tuesday
2 Kudos
Snarky and unsolicited response: If you have to ask Meraki if something was fixed, it never was, and they don't have an intention to fix it. I have several outstanding issues with Meraki. They appear to have zero incentive to actually fix product/service issues.
... View more
This will probably not be the productive/utilitarian response you need. Purely 9200L units for us. I think all I can say with regard to the Hybrid mode is that it is incredibly disappointing. IMO Cisco/Meraki engineering didn't actually test this new management model before rolling it out and deciding to deprecate the old method. While I like the change of not needing a separate onboarding application, the problem I have is that the new onboarding process is *really* bad for switch stacks. Not to mention that if you need to replace a stack member (or expand/shrink a stack for that matter) it's not clear how you are meant to do that as the administrator with hybrid mode. With the cloud monitoring model, I had tested this and found that you simply remove the old switch, put in the new one, and .... Merkai catches up automatically. No additional action required. From what Meraki support has told me, you need to basically do onboarding of each individual stack member to Meraki which to me sounds insane.
... View more
I noticed the documentation page was updated very recently to include the `ip routing` command. Edit: Linked specific documentation.
... View more
@Brash and @cmr - responding to both of you at once. >Hybrid mode is still new. It is replacing the old "Cloud monitoring" mode. It has only been released around a month ago and is still in the process of rolling out to all regions/dashboards. According to support case 13057290 this is incorrect, quote "Hybrid mode is already available for our entire customer base. The current documentation is outdated and needs to be updated accordingly." This makes sense as after all, new organizations can't even onboard the previous cloud monitoring method as of May 1st, so it stands to reason they would enable it for all customers. >In my experience, having off boarded and then on boarded several Catalyst switches, the Meraki cloud ID is derived rather than random, so does remain consistent for each device. I can confirm (sample size of one) that this does appear to be the case - toggling the `service meraki connect` off/on does not change the Meraki serial/claim id. >For now, I suggest engaging Meraki support to confirm the procedure. It's likely something that is internally documented but yet to make its way to external documentation. I mean idk about you guys but lately I've found Meraki is pretty slow to respond to my cases and even if I call in, I have to get triaged to someone on the Catalyst team and almost every time that's been quite difficult to do. It would be far more efficient for all customers if Meraki just published the documentation now, even if it's incomplete. I will resist a full rant, but it's really telling that Meraki has this available to all customers but hasn't even completed publishing documentation.
... View more
Just to put this up-front : I have been playing around with the new Cloud-Native IOS-XE and to say I'm unimpressed would be an understatement. So I'm biased and I may not be thinking entirely straight. Meraki has documentation here on how to offboard switches from Cloud Monitoring for Catalyst. I think the documentation leaves something to be desired, but it exists. Meraki does not appear to have documentation for how to offboard switches from Cloud-Native (Hybrid Operating Mode). My focus is on hybrid, not cloud operating mode so I have blinders on in that respect. The problem and reason for this post is - unless I'm missing it - there isn't documentation on how to offboard a switch from Cloud-Native mode. Is it as simple as deleting the device from the network? But then should I remove it from my organization? Is there a benefit in doing so? What about on the switch itself, should I run `no service meraki connect`? Are the cloud IDs deterministic for each switch or randomly assigned if I choose to run `service meraki connect` again in the future?
... View more
I'm still in rapid testing mode and in hindsight I may have exaggerated just how much luxury I have with regard to timeline. I will skip over the case for now but my original post should give anyone in Meraki the ability to try and reproduce the problem. It's as simple as onboard a switch, offboard a switch, then observe the config post-offboard.
... View more
I'm not in a hurry on this one yet. I made this as a post vs a support case mainly to create awareness and I figured it might get more visibility/treated as a bug rather than the support approach (which I've noted is slower than I've been used to with Meraki in previous years). Plus by sharing broadly, maybe people will try to reproduce it to see if they see the same thing. I'm still working out my process for deployment of new 9200L switches so I have the luxury of time to test the new cloud-native hybrid mode to see if it will work for us (and ultimately save me time later/post-deployment).
... View more
Not really the point though. If Meraki installs a config during onboarding it should (subject to reasonable exceptions) remove it during offboarding.
... View more
I've made a new post over at https://community.meraki.com/t5/Switching/Catalyst-Cloud-Monitoring-Offboarding-Feedback/m-p/271271#M20341 with one result from my initial testing of offboarding from cloud monitoring specifically. I have a lot more testing to do but generally over the last few work days I can only say that Meraki is really not impressing me with their Catalyst monitoring - very sluggish to respond to changes that I make to the switch stacks. Fingers crossed Cloud-Native/hybrid operating mode is a lot better.
... View more
May 6 2025
1:36 PM
2 Kudos
I'm investigating the transition from "Cloud Monitoring" to "Cloud-Native IOS XE" (Hybrid Operating Mode). I took one of my stacks running in cloud monitoring and went through the removal steps in the dashboard. Easy enough by itself but on further investigation, I think Meraki is failing to completely clean up the configurations it makes as part of onboarding. Below are what I found which are configurations Meraki applies to switches/stacks but DOES NOT remove as part of offboarding. In no particular order: aaa authentication login MERAKI local
aaa authorization exec MERAKI local
!
lldp run
!
ip ssh server algorithm authentication publickey password keyboard
!
line vty 16 17
transport input ssh
line vty 18 19
access-class MERAKI_VTY_IN in
access-class MERAKI_VTY_OUT out
authorization exec MERAKI
login authentication MERAKI
rotary 50
transport input ssh
!
netconf-yang
! Now in fairness, there could be a few of those which might make sense to leave behind as they could hurt an admin's ability to troubleshoot/manage the switch/stack if it's already functioning (ip ssh and lldp) but as for aaa/netconf/the line configs? Those don't need to persist post-offboard. Below is some show log output if it helps show what *was* removed/done. switch#show logg | include HA_EM-6
May 6 20:08:19.107: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Start running
May 6 20:08:19.109: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: config terminal lock
May 6 20:08:19.223: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing brownfield device config
May 6 20:08:19.223: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps smart-license
May 6 20:08:19.550: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps config-copy
May 6 20:08:19.661: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps config-ctid
May 6 20:08:19.774: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server enable traps config
May 6 20:08:19.886: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1024
May 6 20:08:20.097: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1030
May 6 20:08:20.209: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1031
May 6 20:08:20.322: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1001
May 6 20:08:20.433: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1002
May 6 20:08:20.546: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1003
May 6 20:08:20.656: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1004
May 6 20:08:20.770: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1007
May 6 20:08:20.882: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 2002
May 6 20:08:20.993: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1011
May 6 20:08:21.106: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1012
May 6 20:08:21.218: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1013
May 6 20:08:21.329: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1014
May 6 20:08:21.441: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1015
May 6 20:08:21.555: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1016
May 6 20:08:21.665: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1017
May 6 20:08:21.778: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1018
May 6 20:08:21.894: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1020
May 6 20:08:22.006: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry ietf subscription 1021
May 6 20:08:22.118: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry transform MERAKI_INTF_STATS_DELTA
May 6 20:08:22.330: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no telemetry transform MERAKI_PORTCHANNEL_STATS_DELTA
May 6 20:08:22.645: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no device-tracking policy MERAKI_POLICY
May 6 20:08:23.086: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no snmp-server host 18.232.244.158 traps version 2c public
May 6 20:08:23.297: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no logging host 18.232.244.158
May 6 20:08:23.416: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip route 18.232.244.158 255.255.255.255 Null0
May 6 20:08:23.629: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing tls config
May 6 20:08:23.630: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no crypto tls-tunnel MERAKI-PRIMARY
May 6 20:08:24.093: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no crypto pki trustpoint MERAKI_TLSGW_CA
May 6 20:08:24.206: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:24.425: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: % Be sure to ask the CA administrator to revoke your certificates.
May 6 20:08:24.425: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing user config
May 6 20:08:24.426: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no username meraki-user
May 6 20:08:24.539: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:24.758: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: ip ssh pubkey-chain
May 6 20:08:24.869: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no username meraki-user
May 6 20:08:24.982: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: exit
May 6 20:08:25.094: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip ssh port 2222 rotary 50
May 6 20:08:25.206: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip access-list extended MERAKI_VTY_IN
May 6 20:08:25.654: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no ip access-list extended MERAKI_VTY_OUT
May 6 20:08:25.767: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no interface Loopback1000
May 6 20:08:26.333: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Clearing VTY lines
May 6 20:08:26.333: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: do-exec clear line 16
May 6 20:08:26.445: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:26.556: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: do-exec clear line 17
May 6 20:08:26.670: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: y
May 6 20:08:26.780: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Removing VTY config
May 6 20:08:26.781: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: line vty 16 17
May 6 20:08:26.894: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no rotary 50
May 6 20:08:27.005: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no access-class MERAKI_VTY_IN in
May 6 20:08:27.117: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no access-class MERAKI_VTY_OUT out
May 6 20:08:27.229: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no authorization exec MERAKI
May 6 20:08:27.342: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no login authentication MERAKI
May 6 20:08:27.454: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: exit
May 6 20:08:27.565: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: no event manager applet MERAKI-DASHBOARD-CLEANUP
May 6 20:08:27.776: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: end
May 6 20:08:27.789: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: write memory
May 6 20:08:32.812: %HA_EM-6-LOG: MERAKI-DASHBOARD-CLEANUP: !Finish running
switch#
... View more
Thanks for doing some testing. That doesn't inspire me with a lot of confidence that it's not a clean offboard experience. From your report it seems hybrid operating mode needs some more time in the oven. I hope to complete some of my own testing today - no guarantees if I'll be able to do that testing let alone report back.
... View more
Separating my reply by rough topic. I'll add the disclaimer here I'm still extremely new to catalyst management/monitoring via Meraki so I operate from ignorance here. Firmware: That makes some sense. I guess I'm not clear on the connection of what Meraki considers stable vs what the IOS-XE Cisco devs consider stable/GD. I think I'm going to test/try it out and see how it goes. Local Status Page/HTTP(S) server: Don't think that article applies here, quote: Catalyst switches onboarded for Cloud Monitoring will continue to run IOS firmware, which does not support access to the local status page. However, Catalyst switches operating in Meraki-managed mode will run CS firmware, which does support access to the local status page. In this case we're not talking about CS firmware so I doubt that applies here. Yes, SVI will help but not truly minimize exposure. Again, some indication from Meraki why this is required/justified would be nice. Onboarding/Migrating : Without any other info to go on, I'll just leave `ip routing` untouched but all the same, would be nice to have clarity as currently neither of the following articles reference it. https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Upgrading_Cloud-Monitored_Switches_to_Hybrid_Operating_Mode https://documentation.meraki.com/MS/Cloud-Native_IOS_XE/Hybrid_Operating_Mode_Switches_Configuration
... View more
I just learned about this change yesterday and have reviewed the available documentation. I have several questions around this seeing as Cisco looks to be wanting to move very quickly on this (terminating existing cloud monitoring end of Jan/2026). 17.15.3 is noted as the minimum required version but this version is still marked as Early Deployment. What is Cisco's timeline for this version (or a future interoperable version) to be GD/MD? The configuration documentation notes that the HTTP server is going to be enabled. Is this absolutely required for Meraki to manage the switch? From a purely "don't enable services you don't require" perspective I really don't like this configuration without strong justification. That webUI is bound to be exposed long-term to security vulnerabilities. If the HTTP server is required, can Meraki at least consider adding an access-class similar to the vty lines? One of the prerequisite configurations for cloud monitoring for Catalyst switch onboarding to Meraki is `ip routing` but this is not listed as a prereq in the configuration documentation. Can customers migrating to hybrid operating mode remove ip routing as a configuration, or is it recommended to maintain that configuration? Thanks.
... View more
Labels:
- Labels:
-
Other
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 289 | |
| 2 | 3052 | |
| 2 | 3061 | |
| 1 | 158 | |
| 1 | 1821 |
© 2026 Cisco Systems, Inc.
