I believe the true Meraki lingo has always been: Virtual stacking = just putting all the ports on one page (great feature, but nothing to do with the switches itself) Physical stacking = backplane stacking with two cables Flexible stacking = having switches transform regular ports into stacking ports which in Cisco classic is actually called virtual stacking 😜  Lovely confusion there. ... View more

You can also easily capture the traffic on port 1812 on the AP port to see how long the packets take for their roundtrip between the AP and NPS server.  If the server packets just don't come, then probably you have an issue in NPS.  (misconfigured radius client?) ... View more

On a classic MS switch you can choose any other port on the same switch as destination port (except stacking ports of course). On Catalyst based switch at the very least you will be able to send captures to different switches too. ... View more

Correct. For the moment only those two features you mentioned are dependent on the advanced tier. In the future I believe major features like VRF, and fabric technologies will most probably be part of the advanced tier. ... View more

That's a pretty safe bet. ... View more

By default all ports are configured as switch mode trunk, switchport trunk native vlan 1, switch trunk vlan allowed all. Since every possible VLAN ID is always available if you really want to prune VLANs on the trunks you can either create the VLANs in the VLAN profiles page (network wide -> VLAN profiles) if this feature has been enabled en add them to a VLAN group.  Then you can easily add that group to each trunk ports you want to configure. Also, very important bit.  Use the switching -> switchports page to control all the Meraki ports in your network and make sure they all have descriptive tags so you can always select multiple ports from multiple switches and configure them in 1 go and consistently. ... View more

I also just noticed that there is not Licensing section in that document unlike the MS130. ... View more

Yes this port is an alternate port. This means you will be having inbound BPDU's. If you want to check where the BPDU's are coming from you can do a packet capture on the port filtering for: ether host 01:80:c2:00:00:00 and let it run for 30 seconds so you can gather all BPDU's. The bridge ID of the incoming BPDU should give you a clue from what the device the frame is coming from. ... View more

I like to chime in with regards to the first point. My first experience with C300L-M switches is that the dashboard network does not fully see them as switches in two regards: - The icon on the maps and floorplans section does not show the switch symbol for these switches. - The license count in a co-term org does not add the used C9300L switches even when they are added to a network. ... View more

Just try to claim the switch by using order number or cloud ID. Then just see if it shows online in dashboard. Not sure console will still output anything after complete bootup. ... View more

An IPsec or client VPN will always terminate on your primary WAN port. AutoVPN's can be made simultaneously on WAN1 and WAN2. However you don't have the ability to add another port to terminate VPN's separately. ... View more

Please check the documentation.  You will see that the MR license does not cover the Wifi7 AP's and the CW license only covers the Wifi7 AP's. https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_MR_Licensing https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_Unified_Licensing_WI-FI7_APs ... View more

I have another issue. So our office still has a bunch of MR33's and MR36's. Somewhere next year we were going to replace them with newer AP's. However our license is already at it's end and we were going to go with subscription licensing. I believe the order has already been placed.  This means we will end up with licenses that we can only use on the current AP's... I'm  hoping there is a way we can replace those licenses with the CW versions once we upgrade to WiFi 7 AP's?  Or will we be stuck in having to replace with WiFi6E?  On it's own it's not THAT big of a deal but lifecycle management is one important thing for me so it would be a shame that we would be stuck like this. ... View more

This! ... View more

Most importantly: If you have 2 DC's in active active where you have overlapping IP address space. You know in cases your VM's must be able to migrate between DC's and are probably using something like VXLAN between your DC's then you only have the option to use Concentrator mode because in routed mode you cannot have overlapping IP space. ... View more

The default switchport configuration is trunk native vlan 1, allow all. Endpoints don't usually tag their traffic which means all your endpoints will be communicating in the same VLAN. However because of the behavior of spanning tree it would be better if you change all the ports leading to endpoints from trunk native vlan 1 to access vlan 1. ... View more

First make sure your radius server is correctly sending back all three AV pairs: Tunnel-Medium-Type: Choose 802 for the Attribute value Commonly used for 802.1X. Tunnel-Private-Group-ID: Choose String and enter the VLAN desired (ex. "500"). This string will specify the VLAN ID 500. Tunnel-Type: Choose Attribute value Commonly used for 802.1X and select Virtual LANs (VLANs) If so and changing VLAN after authentication there is a slight possibility your client is a bit stuck by not doing dhcp after authentication.  Depends on the software on the client. If for some reason you allow for traffic on a guest VLAN before authentication then you do have a change in VLAN and your client should not be able to communicate on the old VLAN after having the port change to another VLAN. So using packet capture please check if your authentication server is sending all 3 necessary AV pairs. ... View more

For native MS switches like the MS130 you DO get a power cord if you order from the US but you do NOT get one if you order outside of the US. For Catalyst switches it is not as clear. I found that native Catalyst switches and secondary PSU's in Cisco DNA mode do come with localized power cords but the -M (Meraki managed variants) don't come with them.  But I am based in the EU so I'm not sure for the US. ... View more

If you can pay for the license fee, go with the Secure client (Anyconnect).  This client doesn't break like the windows L2TP VPN client can do after any windows update. But if you really want to troubleshoot the classic client VPN. If all clients fail, maybe run a packet capture on the internet side of the MX and use the capture filter "port 500 or port 4500".  That way you can see if the IPsec part comes up or not. If it does but it closes immediately after then you probably are having an authentication issue. The registry settings (AssumeUDP...) only is necessary if your MX itself is behind a NAT and it the regkey has to be set to 2 since that is the only setting that will instruct windows to allow connecting when the peer device IP is being NAT'ed. ... View more

As requested:  Here are some beginner tips (especially aimed at CLI pro's) to succesfully get an MS switch or Catalyst Meraki managed switch online into dashboard.   Default switchport configuration: On a factory default MS switch every port has the following configuration: switchport mode trunk switchport trunk native vlan 1 switchport trunk allowed vlan all All VLANs are created by default so the ports can receive any traffic from any port. On a factory default Catalyst switch that has been placed into Meraki management mode the ports have the same configuration but since the TCAM space is configured differently all VLANs cannot be created.  So all ports get VLANs 1-995.  This part is important if you like to have your management VLAN above 995. When you connect your brand new or factory defaulted switch to an upstream device keep this default configuration in mind so you can manipulate the downstream port on your existing device to easily get the switch online.  You don't even have to worry about a temporary native VLAN mismatch.  The tip I usually give here is to set the desired switch management VLAN as native on the downstream port on the existing device. It is recommended to have your switch configuration already in place in dashboard before even connecting the new switch.  The configuration of the upstream switchport and the management IP are of importance here.  This way the moment the switch grabs it's configuration it will already be in the final state to keep being connected to dashboard. You can set the default switch management VLAN on the Switching -> Switch Settings page. If you like to use fixed IP addresses on your switches then it is also recommended to set this on the individual switch configuration page. And of course reflect the desired config on your uplink port   Even if you will eventually have a fixed IP address on your switch it is highly recommended to have a small DHCP pool in the switch management VLAN where your switch can automatically grab an IP address, connect to dashboard and then move over to it's fixed IP address configured in dashboard. In below screenshot you will see that the largest part of the VLAN is reserved for fixed IP addresses but the DHCP server will assign IP addresses from .201 to .254.   Final tip:  This has more to do with the day-1 and beyond configuration of the switch. On the Switching -> Switchports page you see every individual switchport for the entire network independent of the switch they are on.  This feature is imho the most powerful feature of the switching side in dashboard and has been my personal favorite since first working with dashboard in 2017. At the top you have the ability to adjust visible colums and slide those colums in the order you like. Click on the wrench and make sure you enable the tags column And then make sure you give meaningful tags to each switchport because the you can easily select ports based on their tag.  Tags can also be used for other functions like alerting but in this example the tags are important for selecting and having a consistent configuration over your entire network. In my personal preference I place an ACCESS tag on access ports and a TRUNK tag on trunk ports.  But I also add the VLAN descriptor in case of access ports or a function in case of a trunk port like AP, FW, SRV etc.  You can add multiple tags and each tag can be used for selection. In the search field at the top of the page you can type tag:yourtag and it will then only show the ports with that tag. Note: partial matches also work so avoid using the same letter sequence in another tag.  For example: if you had a tag INTUNE-PC and ADMIN-PC then you could erroneously select both if you type tag:PC. By clicking the checkbox left and above the entire list you select all the switchports visible on the screen at once and you can edit them all at once.  This does not work on multiple pages so you need to go to each page and click the top tickbox again to also select the ports on that page. You can track your selection at the top. I hope this was informative of you and like to that you for reading 🙂 ... View more

I'll try to add some screenshots while I create the reply.  But you are welcome to create some professional looking mini-course if you want 😉 ... View more

To clarify, I work both solutions and love both. - What I exactly mean with the fumble is that when you accidentally lockout your access to a switch on CLI you are immediately aware since the terminal no longer responds.  On dashboard it would take a few page refreshes to see the status of your switch change. - About the devices taking long to enroll into dashboard:  I work in the Flanders region of Belgium.  This region is densely populated and there aren't many sites that are 'in the sticks' 😉  We do have decent internet practically everywhere.  Sometimes the behavior of a Meraki device or even a Catalyst device set in Meraki management mode take a really long long time before fully connecting to dashboard.  On an MS or MR this can be resolved by a quick factory default.  However on a catalyst device you're in for a long long while.  The LSP usually says the device still has to reach dashboard op TCP/443 while there is no firewall blocking anywhere.  And when you capture the traffic you don't see the device actively trying to establish the connection but only some pings to 8.8.8.8 and ARP's between gateway and the device.  It would be awesome if we could get a live debug on the LSP that actually tells what the device is doing and where some errors are occuring. The main gripe I have with Meraki gear is that alot of the 'magic' is hidden from us so we cannot learn what the device is actually doing.  A catalyst style debug would be greatly appreciated, so magic becomes science once again :). ... View more

Few beginner tips: - All Meraki switchports start with switchport mode trunk, switchport trunk native VLAN 1, switchport trunk allowed all or 1-996 and all VLANs are already made. - If possible configure your switch before connecting to the cloud - Have a small DHCP pool in your desired switch management VLAN so a new switch or factory defaulted VLAN can automatically grab an IP to fetch it's config. - Have the downstream port where you bootstrap your switch trunk native VLAN, your switch mgmt vlan so the switch can get it's config natively.  It will then move it's mgmt VLAN to the configured VLAN while having it's uplink port on the desired trunk configuration too. - On the switch -> switchports page, always have the column tags visible.  And apply several tags to your ports for easy bulk selection.  I personally tag all my access ports with "ACCESS" and then another tag with the VLAN name.  My trunk ports towards AP's usually have the tags "TRUNK" and "AP".  This makes configuring ports over multiple switches a breeze since you can select all ports based on your tags over all switches inside a single network at once and apply changes at once. ... View more