To me it seem like a connection problem between the management IP of the switch to the radius server. Is the management IP of the switch defined as a network device and authorized as a radius source on the raduis server? Is the appropriate firewall and routing in place between the switch and radius? I currently have a working dot1.x/mab deployment using radius (ISE) with IOS-XE on the switches, seems to be working as intended 🙂 ... View more

I think this topics deserves an update, at least a confirmation if this feature is a roadmap item or not. ... View more

He is asking how to combine both uplinks on both primary and secondary firewall, how I understood it - that means an active-active mode of operation in addition to loadbalance the WAN1 and WAN2 port of the MX. Active-active mode of operation is not supported by MX. The bullets provided is sourced by the "internet" yes, more a list of arguments to why active-active mode of operations not always preferable and should be considered carefully, unfortunately chat-gpt was not involved in that process. ... View more

Active-active and active-passive are two high-availability (HA) configurations for firewalls, each with its own advantages and disadvantages, however Meraki MX85 does not support active-active operation.   Active-Active operation does however have a few "caveats"...   Complexity: Active-active configurations are more complex to design and manage. Both firewalls are actively processing traffic, which requires advanced design concepts and additional configuration, such as activating networking protocols on both firewalls and replicating NAT pools. Troubleshooting: It is significantly easier to troubleshoot routing and traffic flow issues in an active-passive setup. In active-active mode, both firewalls maintain their own session and routing tables, which can complicate troubleshooting efforts. Layer 2 Deployment: Active-passive mode supports Layer 2 deployments, whereas active-active mode does not. This can limit the applicability of active-active configurations in certain network environments.   DHCP Support: In active-active mode, only the active-primary firewall can function as a DHCP Relay. If the active-secondary firewall receives DHCP broadcast packets, it drops them. This limitation does not exist in active-passive mode. Load Balancing: Active-active configurations do not inherently load-balance traffic. While you can load-share by sending traffic to the peer, no true load balancing occurs. This can lead to inefficiencies in traffic management. Cost and Resource Utilization: Active-active configurations can be more resource-intensive and costly, as both firewalls are actively processing traffic. In contrast, active-passive setups have one firewall in standby mode, which can be more cost-effective and simpler to manage. Overall, active-passive configurations are often preferred for their simplicity, ease of troubleshooting, and lower resource requirements, making them suitable for many network environments. ... View more

With a level 3 reset you mean "hold mode button for more than 21 sec" ?   Under "Factory Reset Button" https://documentation.meraki.com/MS/MS_Installation_Guides/Catalyst_9300-M_Series_Installation_Guide ... View more

Yes my switch is totally offline, there is no link seen from the upstream core switch. ... View more

I was told by support that the local status page needs to be accessed using capital A in Admin as username and then the serial as password. Also case sensitive and normally is in all caps. Meraki documentation says otherwise.  ... View more

hahaha found it 🤣 ... View more

It seems to me that the console port stops working after the local management page becomes available. ... View more

Yes, I'm using the "old" switch page and the names return using new switch page (thanks for tip), however i find the new page a bit lacking currently such as the stacking indicators don't work and the power tab is missing. The LLDP/CDP column in the ports page doesn't work either. So I'm going to stay in the "old switch page" for now 😉 ... View more

No, it seems bricked, stuck in rommon or thereabouts, to bad the CLI port is disabled. The local management page is available but not able to log on using "known" credentials (factory default and dashboard ones). Factory reset has been performed with no result.  ... View more

No, all ports had their names overwritten with the default catalyst naming scheme "GigabitEthernet1/0/xyz, TwentyFiveGigE1/0/xyz" etc. My network is currently running C9300L-24P and C9300X-24Y models. ... View more

Nothing fancy... named vlans / vlan groups vlan profiles mostly to counter the default "allowed vlan 1-1000 range" multi chassis etherchannel using LACP/Aggr uplink ports That's pretty much it, very default as its just a distribution switch. No AGP just make that clear 😉  ... View more

Had a similar experience with a c9300x-24 stack. Firmware upgrade went smooth for this stack along with 20'ish other c9300's however I had one stack "die" aprox one hour after IOS_XE boot for the first time. See timeline in the attached image. Is support/RMA the only solution to this? 🙂      ... View more

CS 17.1.2.1 came out a couple of hours ago 🙂 ... View more

Yes, this is starting to become a limitation for us in Norway as public sector is required to support IPv6 on their edges and bring IPv6 connectivity to inside client networks as of 01.01.25.  If HA is not supported Meraki will be disqualified in some public sector tenders. ... View more

According to my SE CS 17.1.1 has caused some migration issues, for those using CS17.1.1 already, who stay in cloud management, there should be no problem. Fix expected this week. ... View more

Yeah, was wondering that myself. Running the software on several 9300X's, would be nice to know if it's going to "explode on me" any time soon 😉  ... View more

I've recently deployed a fair ammount of MG21E's along with the MX68.   Thankfully the MX68 comes with two built-in PoE ports, however the MG's naturally would like to be connected to the WAN1/2 ports. Hence their mode of operation 😉 But at the current state of things - thats not so easy.   So I came up with the following workaround/solution: MG port1 - MX port 11 (for PoE) MG port2 - MX port wan1 (for uplink)   MX port 11 is configured as a trunk, under native VLAN "drop untagged traffic", allowed vlan: you need to add something. With this port11 provides PoE power to the MG, but the MG linknet comes nowhere. The actual wan connection is done over  MX wan1 and MG port2. Works for now, but I've issued a "feature request" for moving wan1 and wan2 to the PoE ports on the MX68 (and similar models).   I've also deployed two MGs (multiple carriers) on one MX using the same method and that also works. Using MX wan2 and port 12. ... View more