I can see it now, thank you! ... View more

While unfortunately it's not using ISE, you could create a SmartPort automation that triggers on the AP LLDP description. If it's a Catalyst 91xx it uses a Trunk port, otherwise it's an Access Port with an Access Policy. ... View more

Hi,    To what extend did you increase the Radius Timeout?    Thanks! ... View more

There are multiple issues atm. For now I'd say use the old version. I've already logged several issues with PM. ... View more

Now I know we are talking about a higher acceptable price bracket ...   I have seen these passive Ethernet fail-over devices.  They have an Ethernet in, and two Ethernet's out.  The phone would plug into the "in".  The out's plug into separate switches.  As long as the device gets a link from out1, it uses that otherwise it passively fails over to out2.   I have never used such gear myself, but a quick Google found this option: 1+1 Ethernet Failover / Ethernet AB Fallback Equipment | Valiant   Personally if it was me, I think I would be tempted to look at something like a Cisco Catalyst C9404R. Cisco Catalyst 9400 Series Switch Data Sheet - Cisco It has dual supervisors, dual everything.  If you have a supervisor fail, the port automatically fails over to the standby supervisor.  It supports doing hitless upgrades. ... View more

During grad school I had an apartment located in the city centre, rather close to a street with a lot of bars adnd nighclubs. At one time, I was working on a university project where we'd measure cellular availability, and usage on a 4G LTE frequency of one of the major ISPs in Denmark.   We could clearly see an increase in unsage during during the weekend around between midnight and 2am. Around the time where all the drunk people probably were calling a cap or their ride home. 😉 ... View more

So you have to "ignore" the switch event logs and mostly rely on the Alert Hub :  https://community.meraki.com/t5/Feature-Announcements/Introducing-New-Smart-Alert-MAC-Address-Flap-Anomaly/ba-p/200017 ... View more

Thanks for the tag @DarrenOC! 🙂   @RaphaelL I'm happy to support a conversation here, no costs involved as it's just an area I'm passionate about and keen to support others to drive an environmental impact change. This is a topic ('sustainable networking') and R&D space that my dev team and I have been driving hard focus on for coming up to 4 years and developed productised Meraki API integrated solutions to make the process easy with a focus on four use cases, but also plugging gaps in the Meraki platform (and anomalies in usage data) to enable better support with automated energy management and reporting.   I agree with you both, from the analysis of nearly 400 customer network environments that one of our platforms reports on every 24 hours shows a clear trend regarding ports utilisation, nearly all have at least 1/3 to 2/3 of an underutilised Campus/Branch environment, some into the 10's thousands of switchports, but its great to see many starting to make changes by using the data we provide at no cost so they can make informed rationalisation/consolidation decisions, like the below from a popular global brand across thier offices over the past few months - removing 1,000+ unused ports...     On powering down PoE devices, I did an exciting post on this on Friday below, we are powering down over 10,000 PoE devices each night which is saving close to 200,000 kWh this year.    www.linkedin.com/feed/update/urn:li:activity:7273289385998012416/   Below is a collection of different content pieces from this past year that I’ve either done with Cisco Marketing or authored.   Cisco joint collaborations over the last 12 months in the Cisco ‘sustainable networking’ space:   Wrexham Council - Rethinking IT infrastructure to reduce cost and carbon emissions across 70 schools https://meraki.cisco.com/customers/wrexham-county-borough-council www.thisiscae.com/success-stories/a-partnership-for-the-future   Cambridgeshire County Council / ICT Service - Cisco partners with Cambridgeshire schools to make their classrooms more sustainable https://news-blogs.cisco.com/emea/2024/05/23/cisco-partners-with-cambridgeshire-schools-to-make-their-classrooms-more-sustainable www.thisiscae.com/blog/cisco-cae-partner-with-cambridgeshire-schools-to-make-their-classrooms-more-sustainable   Cisco ISG Schools Sustainability webinar with IT Leader from Wrexham Council: ‘Helping schools achieve their sustainability goals and save money, with Cisco Meraki’. https://vimeo.com/946669718/d12cc0acb8   My content:   WiserWatts solution overview www.thisiscae.com/intelligent-energy-saving-with-wiserwatts https://apps.meraki.io/en-US/apps/422678/dna-wiserwatts   WiserWatts FAQs www.thisiscae.com/blog/frequently-asked-questions-about-wiserwatts   Short Whitepaper for the Education Sector -  ‘Policy-driven energy management for sustainable schools: How to reduce energy waste in your school or college.’ www.thisiscae.com/how-to-reduce-energy-waste-in-your-school   5 carbon-reduction tips for a sustainable and efficient workplace www.thisiscae.com/blog/5-carbon-reduction-tips-for-a-sustainable-and-efficient-workplace   Smart strategies to cut business running costs and streamline your operations www.thisiscae.com/blog/smart-strategies-to-cut-business-running-costs-and-streamline-your-operations   Short Whitepaper: 'Moving away from an always on culture' https://www.thisiscae.com/blog/moving-away-from-an-always-on-culture-whitepaper   Achieving Digital Transformation and sustainability goals simultaneously www.thisiscae.com/blog/achieving-digital-transformation-and-sustainability-goals-simultaneously   A conversation with Simon Billington the ICT and Infrastructure Manager, Wrexham Council www.linkedin.com/posts/ali-mckeand-%F0%9F%9A%80-67b04245_innovation-caelabs-partnership-activity-7074483892090466304-sxfS https://www.youtube.com/watch?v=W_7Uok9lQDE   Greening ICT - Lets Go Zero Webinar – The ICT Service, Cisco and CAE https://youtu.be/BJD2AKzzvnM   Hope this helps! 🙂 ... View more

Any port going up and down will trigger an STP event, not an election that could be disruptive, but a notification. ... View more

In the beginning I actually thought it was more things that caused this, like changing / adding / removing an ACL and so on. But it seems to only be when I change a DHCP setting. It happens when I change DNS settings, when i reserve an IP in a scope, and so on. I created a case, just to check my sanity 🙂   And I only discovered it because I was setting up this new network for a customer, and of course, in that process, where changing "a lot" of settings. And my network connection was , ehhh, wonky. Initially I thought sure, I was connected to a switch or AP that was just connected and needed a firmware upgrade, but I have now narrowed it down to this. ... View more

Hi Adrian4,   My team actually ran into a similar need for this while testing eBGP in routed mode (you can't filter based on source routes learned via eBGP either).   The workaround we found was to create a static route for the source network you are trying to create a firewall rule for, we chose to use 0.0.0.0 as the next hop (assuming route recursion, this should send it towards wherever you learn your default route from). You can then disable this route so it has no effect, but the firewall rule will be allowed to be entered.   Here's an example:   You want to enter a firewall rule defining source as 192.0.2.0/24, destination any, deny Enter a static route 192.0.2.0/24 next-hop 0.0.0.0, save, disable that route, save. Enter the firewall rule you desire, save.     Our team assumption is based on the reading here that Sources need to be from the "configured subnets" on the "MX Addressing & VLANs page" and thankfully static routes are included in that validation. We agree with you that the validation makes no sense honestly, why should any firewall care if you have an extra firewall rule disallowing source addresses that you may or may not own? What does that actually prevent? Hope this helps anyway   Also the group policy option is objectively terrible if you use it to override L3 firewall rules, as any device(s) governed by that firewall ruleset become independent flows when it comes to state tracking of the main L3 firewall rules, effectively making your firewall rules become stateless (useless) ... View more

Meraki Licensing FAQs as of 8/7/24 (documentation doesn't reflect any changes).  Perhaps it's forthcoming? ... View more

I have a site that has a combination of MR42 and MR86 AP's. Per the release documentation MR42's are on the list of SKUs that will be restricted to MR 30.x and will only be upgraded to their latest support version of MR 30.x.  Post upgrade the MR42's are showing a firmware version of MR 31.1.5.1?  Should I expect issues with these devices? ... View more

why is there no option to configure a virtual ip on the backup wan? ... View more

Thanks for your time in responding to this post. Sorry for the typos I was working on a small fire when I saw you replied and I wanted to respond quickly :). I don't want to turn this into the me show, so if any of the other forum members would want to share their thoughts please do :). ... View more

Hey there,    +1 to Raphael Meraki devices use Meraki/public NTP servers, this is not configurable. If you can confirm this traffic is indeed being sent by the MVs to your private server then I would suggest opening a ticket with support. ... View more

Hi @RahulPrasadh,   As @RaphaelL mentioned, pings should not be used to test whether a content filtering rule is working as intended as content filtering does not apply to ICMP traffic.   That being said, if an allow-listed URL is still being blocked, then there are three likely possibilities: The content filtering configuration is incorrect or insufficient. Something else on the MX is blocking the traffic. The traffic is blocked/dropped somewhere else before or after the traffic is processed by the MX.   To determine which possibility is occurring, I would first recommend checking whether the traffic is in fact being blocked by content filtering, which can be done by navigating to Network-wide > Event log and filtering for the affected client, setting the appropriate time, and including the Event type Content filtering blocked URL. If you see entries for a URL that are related to the resource the client is attempting to reach, then ensure they have been properly added to the Content filtering Allow list.   https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering/Content_Filtering_Troubleshooting#Allow_URL_list_patterns_are_not_being_allowed   If the traffic is not being blocked by content filtering, I would recommend checking any layer 3 and layer 7 firewall rules. If your MX is running version 18.2+, you can use the firewall logging tool to see in real time if any configured rules are traffic.   https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Firewall_Logging ... View more

I have the same issue with Meraki/ISE setup. when a windows client tries connect to wifi after reboot automatically the hostname gets "host/xxxx" attached to it but when you connect manually that doesn't happen. I made the above adjustment in advanced setting for ISE but that did not resolve the issue for me and I still see a lot of authentication failure when windows machines are trying to connect automatically when they come up on the network. User must click on SSID to connect and when they do that the host/ is not there anymore   ... View more

First of all: The new UI looks modern, thats nice. But there are some points which I think could be better and it's primary about the Information at the first view:   There is a lot of blank area and I have to scroll much more than the old design. If I enter the AP Summary page I want to see all important Information with one view. The Information on the left (SSIDs, Serial Number, Firmware, IP,...) are in the "wrong" order. I don't need to see the Firmware or Regulatory Info with the first view. The important Info for me and I think many others are: IP Information thats I want to see with the first view. And also here.. the blank gaps between the Infos. Move RADIUS and VLAN request status above Current Clients. The really first thing I want to see is, if all services are working on the Access-Point and if there are like 10 Current Clients I have again to scroll the RADIUS and VLAN request status.   Have a nice weekend 🙂    ... View more

Let's start off the with obvious this is a great add and I am thankful to see the additional information. That being said I feel like with the additional information we are able to see this could be combined with the current summary page and this would save admins the time of clicking back and forth.   New Tile   Device Summary Combine the following categories into one Block CPU Memory Power - Make smaller Power Mode - Make smaller AP Reboot  - Merge with Historical Connectivity Historical Connectivity - Tweak this bar to combine the alerts with AP Reboots, but use the same colors Radius and VLAN Status - Make smaller Uplink Traffic   Radio Summary  Utilization on current channel  Add Client count on each radio   Current Client Keep the same   Historical Device Data Keep the same   These are just my thoughts.   @RaphaelL - Thanks for posting about this release I missed it.   ... View more

>MX can 'monitor' eachother if they are up and still have route to Internet.   They don't monitor each other when active/active.  They are simply two standalone units.  They need to be in seperate Meraki networks, and you need to use some kind of layer 3 device (such as a layer 3 switch) to manage the failover between each other. ... View more

I had a similar-ish issue a few months back. I know the fix doesn’t make the most sense, so please bear with me.   The short version is we discovered legacy SFPs on the network. As soon as we replaced them with the usual model, then it all went back to normal.    The longer version is a power outage lasted longer than our backup generators could support. When it all came back online, our speeds were different - good upload speeds but poor download speeds.   My full-stack Meraki setup let me reproduce the issue on various MX and MS firmware versions. Also, I mostly skipped checking the individual links, because I had identical SM fiber SFPs all around with no CRC errors (or similar).   However, after extensive searching, my team located only one pair of outdated MM fiber SFPs on a single link connecting our MXs and a core switch. The issue vanished the moment we replaced it with identical SM SFPs.   The reason I say this doesn’t make the most sense is two-fold. First, the problem was observed while I was directly plugged into the MX - and not a switch using the MM fiber link. Second, the problem only appeared after a power outage caused a complete power cycle of the network appliances. (I see it as a problem that was lying in wait, then appear after a reboot.) ... View more

There's a few ways I can think of (potentially license dependent).   1. You can configure the clients to point to the MX for DNS resolution. You can then point your MX to the Umbrella Virtual Appliance as its resolver. The downside of this is the VA will log that all requests come from your MX rather than individual clients   2. You can integrate the Meraki MX directly with Umbrella. This allows the MX to send internal domain lookups to your internal resolver, and public domain lookups to Umbrella. Manually Integrating Cisco Umbrella with Meraki Networks - Cisco Meraki Documentation   3. More of a hack job method, but if there's specific domains you want the MX to have resolution for to allow your rules to work, you can setup one computer to periodically send DNS requests for those domains out to an Internet based resolver so the MX can observe those lookups. ... View more

I guess it's possible the switch generates more traffic on VLAN1.  ANyway - I'm pretty sure the MX and Dashboard is performing as expected ... View more

Hi @allywenzel , I do see this type of situation often. Usally something changes to cause this.  That log "stp_tcn_error" 'Topology Change Notification". Meaning the Layer 2 path or Spanning Tree is changing where all traffic should go. Most of the time, someone plugged in something. Or in your case, most likley a cable or device is misbehaving. As @RaphaelL reccomended, check you RSTP Root and make sure it is it is in fact the Root. Use the following guides to assist in the investigating and mitigation.    https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS   https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MS_Switching/General_MS_Best_Practices       ... View more