Meraki

KarstenI

With a redundant setup, the most important part is the enabled native VLAN on the MX: https://cyber-fi.net/index.php/2022/03/13/how-to-connect-the-meraki-mx-to-ms-switches/ If you have the same VLANs on all switches, you will face some extra challenges with unusual BPDUs as each Switch will see multiple other switches on each uplink: https://documentation.meraki.com/MX/Networks_and_Routing/MX_Layer_2_Functionality#Spanning_Tree_Protocol_(STP)

KarstenI

There are multiple ways of interpreting what you write. Is the "point to point connectivity" between core and distribution just the link? Then you can trunk the same VLAN to that switch and use the same subnet behind that switch. The rest of your network influences whether that is a good idea. But if "point to point connectivity" means that you have a routed link between core and distribution, then you can't use the same subnet on the other side of this link, at least not without additional struggle. Why do you want to use the same subnet? Do you have a roaming path at all between these areas? Perhaps one of the other operating modes are more useful where you don't need the same subnet.

KarstenI

Inspired by @Bon_clay, a heart in Hamina Network Planner with three Meraki CW9176D1:

KarstenI

That is perfectly fine and very common!

KarstenI

PDL is an abandoned license model; I don't think you can move to that any longer.

KarstenI

This would be an administrative nightmare. But for switches, it would at least technically work. You would lose the end-to-end troubleshooting, and I wouldn't see real benefits. Which advanced feature are you most interested in? When you say "Core with advanced features", I could only think of Netflow. For that, a 9300 in only Meraki monitoring mode could be a solution. I didn't test it that way but I assume that you could configure NetFlow the manual way, export it to an external collector, and keep Enterprise licensing.

KarstenI

I can't take your disappointment, but at least I can give some clarification. Some time ago, there were two individual trainings, ECMS1 and ECMS2, which were the official preparations for the certification (CMSS). These two trainings were combined into one training ECMS (without 1 or 2). The CiscoU training contains exactly the official curriculum, which is the combination of ECMS1 and ECMS2 with some minor updates to make it more relevant. Although this is the official preparation course, I believe it is far from enough to pass the exam. However, this applies to nearly every Cisco training and the corresponding exam. You still need lots of hands-on experience and spend many hours in the Meraki documentation.

KarstenI

You could always have multiple networks. But no different licensing tiers for Co-Term organisations. And even for Subscription licensing, IMO not for individual switches.

KarstenI

https://community.meraki.com/t5/Switching/Can-switches-with-MS-Advanced-licenses-and-MS-Enterprise/m-p/198224

KarstenI

The MX is highly restricted when it comes to extranet IPSec-VPNs, and many other features are just a little bit "different" from those of other vendors. Make yourself very comfortable with the MX before making this purchase.

KarstenI

If Meraki replaces the device with a Z4 because there is no more Z3 in stock, they will replace the license for you. If you replace the device on your own, you have to buy a new license for the Z4.

KarstenI

I just counted a couple of networks (Mist has easy statistics for that, but it seems to be a manual count on Meraki): About half of the clients use 6GHz on the networks that have already been upgraded to 6E (most 9162I). I will definitely use the 9172I for all the networks that will be upgraded next. I also hope they will be supported longer than the previous generation.

KarstenI

It was ratified end of last year.

KarstenI

Hopefully, there will be more in the upcoming recording of TFD: https://techfieldday.com/appearance/cisco-presents-day-2-at-tech-field-day-extra-at-cisco-live-emea-2025/

KarstenI

Whoa, that looks good! I see my beloved ISE being replaced here and there.

KarstenI

Sadly, up to now, this device is only a VPN-Concentrator and not a regular firewall.

KarstenI

The thing with affordability is the "kind of" ... However, with the 9176 having the same list price as the 9166, I hope for the same for the 9172. And with that, there is no reason to buy any older MRs (for indoor operation). Interesting for people who don't need 6 GHz is the 2-radio operation mode with 2*2 on 2,4 and 4*4 on 5 GHz. Ok, I had preferred 2*2 on 6 and 4*4 on 5; but this is a different story. This mode is compatible with PoE+. But I still have to find out if it is operating as a Wi-Fi 7 AP with only PoE+. My 9178 doesn't announce any Wi-Fi 7 with only having PoE+.

KarstenI

This!!! It should be announced here at least at the same time.

KarstenI

Well, kind of ... 😉 https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/wireless-9172-series-access-points-ds.html For general use, I still hope for a 9174I.

KarstenI

IMO, it only makes sense if you have separated VLANs for Wireless. If not, you need the Firewall controls on the MR and MX sides, which can be an administrative burden.

KarstenI

The SSID in NAT mode is by designed not allowed to reach the internal network. If you want internal communication, you likely want to use bridge mode. But that doesn't explain that it's not working from the switch and MX. There are some packet captures needed to see how far the packets go.

KarstenI

I admire you for still having hope for extranet VPNs.

KarstenI

As already mentioned, yes, it is possible and also quite common. Having all VLANs on the MX is the best from a security standpoint. But if you already have an MS425, I assume the MX105 won't be able to handle the load. In this case, I would move all VLANs with sensitive systems onto the MX and keep all others on the switch. Then, you can monitor the load and decide to move even more systems to the MX.

KarstenI

Are you referring to the Firmware-Upgrade page? That is only the destination firmware for the network. You see the real running firmware on the Access Points -> List view or on the AP details view:

KarstenI

MR 31.1.5.1 Support would send me a link to the document that I quoted and ask me if I still need help ... Or do you say that no one from Meraki who is responsible for documentation is reading this sub-forum? I really expected that this is the right place to address this.

About KarstenI

KarstenI

Karsten Iwen

Community Record

Badges