You need to raise a case with Meraki Support.   My guess is that the standby MX is trying and failing to upgrade its firmware - or something along those lines.   Support should be able to dig further.  Suggest calling on the phone - it'll likely save a bunch of time. ... View more

I suggest you talk with your preferred Cisco partner - they should be able to provide you quotes specific to your situation. ... View more

The markings on the MR76 AP are correct: 2 antenna posts are dedicated to 2.4 GHz only.  The other two posts; to 5 GHz only.  You need to ensure the same coverage cell for each radio, so if you have (for example) an ANT-25 and an ANT-27 then, because they are both dual-band antennas, you could use each antenna on either radio, but you must connect both pigtails of an antenna to the same radio.  Do not split them one to 2.4 & the other to 5. ... View more

That's what you asked for...    🙂 Did you follow the link? ... View more

Pretty sure this is referring to SAML login and is expected behaviour.   The listed accounts have been used historically to access the dashboard, so will still be visible there, even though they've been deleted at the IdP end.   While they are listed, they will not be able to login. I believe such associations can be removed by toggling the enable / disable on that SSO. ... View more

Did you raise a case with Meraki Support?   Pcaps are the way to go, as recommended above, but Support can help you along the way ... View more

You'll want to use DHCP Option 43, with the appropriate Hex Option: Custom, Code: 43, Type: Hex,  Value: 01:04:00:00:00:02   As per https://community.meraki.com/t5/Security-SD-WAN/DHCP-Option-43-and-Sub-option/m-p/47435 ... View more

Not really - it's being subbed for Subscription Licensing, which I think most customers will ultimately find to be a much better balance between the 'all or nothing' approach of Co-termination and the 'micro-manage everything' of PDL.    https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_Licensing_Overview Depending on your geo, it should be available to move to from Co-term at renewal time. ... View more

So...   chances are this is not a permitted 'conversion' from a Support perspective.  If you contact the Meraki account team, they may be able to reflect any residual value of the Z1 license in the pricing for the Z4 license. ... View more

Yes - it would have been like-for-like - unless there was no inventory left of Z1 (which I'd say is quite likely, given the age of Z1), in which case the nearest available equivalent model would be provided (probably Z3) and an appropriate license 'conversion' would be applied by Support.   If I could recommend;   you've made a few assumptions about how things might work - you'd have been better off checking;   initially with Support;   they have strict practices they have to follow.  They don't have any choice.   Secondly with the Meraki account team - if a new purchase was required.  As it's then a commercial discussion, they have a few more levers at their disposal. ... View more

For an all-Cisco solution incorporating MX, you might want to consider pairing it with Umbrella DNS protection but, as per your mention of cost;   Umbrella is an extra and Advanced Security licensing the same (though I can't imagine, in that environment, you'd really want the basic Enterprise MX license). https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Manually_Integrating_Cisco_Umbrella_with_Meraki_Networks https://docs.umbrella.com/deployment-umbrella/docs/the-activity-search-report   ... View more

Right now, this does require Support to enable, I'm afraid.   In many cases, the need to have these enabled is documented in the relevant KB article   https://meraki.cisco.com/meraki-support/open-a-support-case/     ...though not in this case, I notice;   I have just requested internally that this be added. When I get chance I will do some digging as to why this option isn't available in the UI too.   On the face of it, I can't see wht that's not been done already, TBH - but engineering tend to have visibility of all the potetntial complications.   What I'd recommend is speaking with your Meraki account team to make a formal request on your behalf;  the Community isn't really a forum for that.   Note you can raise a case via the Dashboard, rather than wait on the phone (though I'm surprised you've been waiting 30 mins - it's not usually that busy). If you can't access Dashboard, cases can also be raised online: https://meraki.cisco.com/meraki-support/open-a-support-case/  ... View more

As Mloraditch mentioned;   yes, but take care with Spanning Tree: "C9300 (and MS390) runs single instance (0), single region (region1), and single revision (revision 1) MSTP. This is essentially Rapid Spanning-Tree. Please make sure for interoperability with any other non-Meraki platforms, to either run Rapid Spanning-tree or MSTP (not PVST or any iteration, nor any other vendor specific STP implementation). This will ensure that there are no issues with compatibility and functionality."   https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_Spanning_Tree_on_Meraki_Switches_(MS) ... View more

Is / are the source(s) for the inbound sessions known or could they be from anywhere?   ... View more

You don't get told eplicitly in the Dashboard that you are in the Grace Period, but you will know you are in it, if your Dashboard is non-compliant, but everything is still working.   If you are non-compliant because your co-termination date was reached without renewing, the 30 day count will start from there. If you are non-compliant because you exceeded your device count for a specific product license, the 30 day count will have started from when you went over the limit (when you added the device(s) to the Network they're in). More detail is available around this, here:  https://documentation.meraki.com/General_Administration/Licensing/Co-Term_License_Problem_-_Out_of_Compliance ... View more

Just one thought;   You could maybe try linking your MX to your FTD via one WAN port and to it's own Internet link via the other WAN port - then use SD-WAN flow preferences to route Internet traffic from different sources via the appopriate WAN uplink.   Bear in mind that should an uplink fail then traffic would fail over to using the other link. Note that you could still have your (non-wireless) local LAN traffic hit the FTD directly, by defining it as the Default Gateway for those VLANs (this would likely avoid asymmetric routing too) - but using an SVI on the MX as the gateway for your wireless users. ... View more

Actually - referring back now to your first point; your Organization does include more Meraki gear (you mentioned switches as well as APs, which I'd missed).   Any time you apply a renewal, the key needs to include licensing for all the devices you need to keep working.   So in my example above, you could still do two separate orders, 3 years and 1 year, but both of those orders would also need to also include the switches and all the APs (and any other Meraki devices you want to keep working). In co-termination, everything is encompassed by one date - you can't part-renew.   Remember too that an Organization is either compliant or not.   If it's non-compliant, it will enter a 30 day grace period (where admins get lots of warnings to fix it).   If you let that expire, without fixing, ALL the devices will stop carrying traffic.   This is clearly not what anyone wants.   Maybe look to catch up with your Meraki account team to go through the detail?    As mentioned briefly above, a shift to Subscription licensing might be a good option. ... View more

cmr is right;   you can't trade quantity of devices for time, nor vice versa. If you want 4 years, you could create two orders - one for 3 years and one for 1 year, but both would need to be for the full 140 APs - if you have 140 working APs.   You would then use both keys, one after the other, using the 'Renew my Dashboard license' operation.   This would leave you with 140 APs licensed and stack the 1 year and the 3 year on top of each other, to make the co-termination date 4 years in the future. This assumes that you only have Meraki access points in that Organization (?)   https://documentation.meraki.com/General_Administration/Licensing/Meraki_Licensing_-_License_More_Devices_vs_Renewal#Renew_my_Dashboard_license_(Renewal) ... View more

Why do you need the route for the inbound AutoVPN traffic to be a default one, to an a LAN-side destination? I assume your MX is in routed mode and is also providing local firewall services for the site in question? ... View more

Why remove two cables in a failover test?   I don't know of anyone who designs for two simultaneous and separate failures.   I wouldn't worry about the active : active status of both MXs if the (usual) primary is entirely disconnected from the LAN - it can't confuse the clients, in that scenario.   But you said the (usual) spare MX is not carrying user traffic, even though it's now active and communicating over the WAN...? ... View more

How do you have the setup cabled? ... View more

BGP - as a dynamic routing protocol - may also help in redundancy / resilience scenarios;  finding an alternative route around a failed component automatically, without manual intervention.  It's not necessarily clear to me that it would be needed in your environment, but that's usually a key reason for using dynamic routing generally. ... View more