the Wi-Fi 7 AP's support Ultra Wide Band radio for even better location scanning. I would check up on that instead. ... View more

For the downstream direction it suffices to use the MS Teams Voice NBAR category to set the DSCP value to EF and of course put a custom limit or ignore limit option.  If your VLAN is tagged you can also set the PCP tag to 6. However for upstream traffic treatment you will need to make sure your clients tag their traffic with DSCP EF and L2 tag to 6 to give it the correct upstream scheduling. If you use the port matching you can add this using the Add-NetQoSPolicy commandlet in windows.  The default UDP source ports are 50000-50019 for voice traffic and you can use that for matching. ... View more

The only thing I personally don't like about the combined templates is that the MX template randomizes IP subnet generation and not groups them per site but only per local VLAN. The rest is all awesome. ... View more

There is a formal template method where you can create the SSID's and basic settings at the template and then bind the template to networks.  You can even bulk create networks using a CSV file with the AP's per network.  You still have some local control per network where you can override some behavior.   But as Mloradith already said: you can create a first network too and then clone it many times too.  But then you lose the ability to bulk change without using some automation script. ... View more

I had my first issues with this, which is a bit of an install problem. So imagine this: You want to use a switch management VLAN which is different than VLAN 1. However your switch first came online with all ports in trunk native VLAN 1 and it received an IP in that this switch thinks is VLAN 1, however the trunk leading to the upstream devices has the switch management VLAN as native (think the MX downlink).   So to fix this you want to change the uplink ports so it takes VLAN 2001 in my case as native VLAN and then apply a fixed IP address inside that range.   Now here comes the problem: The switch will deny the config since it now has to apply the IP from VLAN 2001 which is in the same subnet like the switch now has DHCP in VLAN 1.  This will cause the netconf call to fail and leave an error xml file on the flash of the switch. RPC Error occured during SET: /flash/meraki/config_updater/monitor/dwnld_running.config Info: <?xml version="1.0" encoding="UTF-8"?><error-info xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0"><severity xmlns="http://cisco.com/yang/cisco-ia">error_cli</severity> <detail xmlns="http://cisco.com/yang/cisco-ia"> <bad-cli> <bad-command> ip address 10.10.1.11 255.255.255.0</bad-command> <error-location>36</error-location> <parser-response>&#13; % 10.10.1.0 overlaps with Vlan1</parser-response> <parser-context> description Uplink_VLAN mac-address 0018.0a4f.0001 no shutdown ip access-group l3-v4-acl in ip address 10.10.1.11 255.255.255.0</parser-context> </bad-cli> </detail> So the switch gets stuck in the VLAN 1 config and does not allow any other configs for some reason.   I was able to console into the switch and manually remove VLAN 1 IP address and apply fixed to VLAN 2001.  The switch then came back online with the correct VLAN and now I can no longer access the CLI via console cable.  There are still some other issues like no longer being able to console from dashboard (internal error).  So it would seem we are having a bit of an issue with the configs. ... View more

Both ports must be negotiated at the same speed. You can't mix 1 and 10 Gig inside a port-channel. Since you have MS225, why not use 2 10 Gbps links? If the MS225 is in the same rack as one of the MS425's you are better off using a twinax cable to cut costs instead of trying your luck with copper ports. ... View more

I believe the true Meraki lingo has always been: Virtual stacking = just putting all the ports on one page (great feature, but nothing to do with the switches itself) Physical stacking = backplane stacking with two cables Flexible stacking = having switches transform regular ports into stacking ports which in Cisco classic is actually called virtual stacking 😜  Lovely confusion there. ... View more

You can also easily capture the traffic on port 1812 on the AP port to see how long the packets take for their roundtrip between the AP and NPS server.  If the server packets just don't come, then probably you have an issue in NPS.  (misconfigured radius client?) ... View more

On a classic MS switch you can choose any other port on the same switch as destination port (except stacking ports of course). On Catalyst based switch at the very least you will be able to send captures to different switches too. ... View more

Correct. For the moment only those two features you mentioned are dependent on the advanced tier. In the future I believe major features like VRF, and fabric technologies will most probably be part of the advanced tier. ... View more

That's a pretty safe bet. ... View more

By default all ports are configured as switch mode trunk, switchport trunk native vlan 1, switch trunk vlan allowed all. Since every possible VLAN ID is always available if you really want to prune VLANs on the trunks you can either create the VLANs in the VLAN profiles page (network wide -> VLAN profiles) if this feature has been enabled en add them to a VLAN group.  Then you can easily add that group to each trunk ports you want to configure. Also, very important bit.  Use the switching -> switchports page to control all the Meraki ports in your network and make sure they all have descriptive tags so you can always select multiple ports from multiple switches and configure them in 1 go and consistently. ... View more

I also just noticed that there is not Licensing section in that document unlike the MS130. ... View more

Yes this port is an alternate port. This means you will be having inbound BPDU's. If you want to check where the BPDU's are coming from you can do a packet capture on the port filtering for: ether host 01:80:c2:00:00:00 and let it run for 30 seconds so you can gather all BPDU's. The bridge ID of the incoming BPDU should give you a clue from what the device the frame is coming from. ... View more

I like to chime in with regards to the first point. My first experience with C300L-M switches is that the dashboard network does not fully see them as switches in two regards: - The icon on the maps and floorplans section does not show the switch symbol for these switches. - The license count in a co-term org does not add the used C9300L switches even when they are added to a network. ... View more

Just try to claim the switch by using order number or cloud ID. Then just see if it shows online in dashboard. Not sure console will still output anything after complete bootup. ... View more

An IPsec or client VPN will always terminate on your primary WAN port. AutoVPN's can be made simultaneously on WAN1 and WAN2. However you don't have the ability to add another port to terminate VPN's separately. ... View more

Please check the documentation.  You will see that the MR license does not cover the Wifi7 AP's and the CW license only covers the Wifi7 AP's. https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_MR_Licensing https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_Unified_Licensing_WI-FI7_APs ... View more

I have another issue. So our office still has a bunch of MR33's and MR36's. Somewhere next year we were going to replace them with newer AP's. However our license is already at it's end and we were going to go with subscription licensing. I believe the order has already been placed.  This means we will end up with licenses that we can only use on the current AP's... I'm  hoping there is a way we can replace those licenses with the CW versions once we upgrade to WiFi 7 AP's?  Or will we be stuck in having to replace with WiFi6E?  On it's own it's not THAT big of a deal but lifecycle management is one important thing for me so it would be a shame that we would be stuck like this. ... View more

This! ... View more

Most importantly: If you have 2 DC's in active active where you have overlapping IP address space. You know in cases your VM's must be able to migrate between DC's and are probably using something like VXLAN between your DC's then you only have the option to use Concentrator mode because in routed mode you cannot have overlapping IP space. ... View more

The default switchport configuration is trunk native vlan 1, allow all. Endpoints don't usually tag their traffic which means all your endpoints will be communicating in the same VLAN. However because of the behavior of spanning tree it would be better if you change all the ports leading to endpoints from trunk native vlan 1 to access vlan 1. ... View more

First make sure your radius server is correctly sending back all three AV pairs: Tunnel-Medium-Type: Choose 802 for the Attribute value Commonly used for 802.1X. Tunnel-Private-Group-ID: Choose String and enter the VLAN desired (ex. "500"). This string will specify the VLAN ID 500. Tunnel-Type: Choose Attribute value Commonly used for 802.1X and select Virtual LANs (VLANs) If so and changing VLAN after authentication there is a slight possibility your client is a bit stuck by not doing dhcp after authentication.  Depends on the software on the client. If for some reason you allow for traffic on a guest VLAN before authentication then you do have a change in VLAN and your client should not be able to communicate on the old VLAN after having the port change to another VLAN. So using packet capture please check if your authentication server is sending all 3 necessary AV pairs. ... View more