Funny thing, that this stil persists across all the switching SW trails .. ... View more

Looks like it will happen 🙂 Products - Cloud Management for Catalyst FAQ - Cisco ... View more

We also need this "feature" for the same scenario, sadly I can't find any solution with Meraki MX. On Cisco ASA this is a basic NAT command and not such a special think, don't understand why MX is not able to do this. 😞 ... View more

Sorry to reopen this thread, but I want to see if I understand how UDLD and STP guard should be set up on my topology. Here's the high level image from the dashboard. Very simple hub-spoke. Single uplinks from IDFs (either a stack of two or just a single switch) run back to MS425. Do I enforce UDLD and loop guard both ends, or just the uplink port for the IDF?   ... View more

No Uptime in our MSP dashboard.   And we have a situation past few days for a client that is going offline every 2 hours.  Would be nice to confirm if it is indeed infrastructure power or ISP related. ... View more

I have a doubt for iOS devices that was co figured by SSP and after a period the certificate expired has an automatically way to update this without the user did the procedure manually again?   If I renew the certificate before the expired , Meraki will send to device the update of this certificate automatically?   Regards, JF. ... View more

I have endpoints yes but the handsets are not CIsco   ... View more

Hi @whistleblower, here’s my take on your questions based on experience. Happy for others to advise if they’ve had different outcomes.   1. Yes, local configuration overrides network-wide configuration, but I’ve never seen a warning message if the two don’t match. I’ve only seen warning messages if there is a communication issue with the Meraki cloud.   2. There is no automatic tagging for the management VLAN across the network. You have to get the traffic to/from the switch. Based on this I always find it easiest to have the management VLAN set as the native on all trunks that are uplinks.   3. Imagine the management address as an access port on the switch. It doesn’t care which VLAN it is, only if there in a path to a DHCP server on that VLAN. Since it’s an ‘access port’ it’s always untagged, whether it’s tagged or not on another port depends on that port’s configuration.   4. The definition of a safe configuration is a few paragraphs further up in that document, “Safe configuration means that ‘the device has connectivity to cloud and hasn't rebooted for 30 minutes following a configuration change.’ That is, the safe configuration is the last configuration the device received from the cloud that was not followed by a reboot within 30 minutes.” A ‘not safe configuration’ is just the reverse - I.e. one where no connectivity to the cloud has been achieved. ... View more

The concept of the Switch as layer 3 is that, you are converting your switch into a Router and the vlan interfaces as its route interfaces. All devices connected to each of the vlans configured must use the ip address of the vlan interface of the Switch connected to that vlan as their gateway. The vlan where you specified the default route 0.0.0.0/0 must be connected to the router which provides internet connection and there must be route configured on that router going to each of the subnets since subnets are now 1 hop away from the router. Also, NAT on the router must be configured to allow the translations of the ip address of each subnet.   When configured that way, all packets from any subnet destined to internet will be forwarded to the router that provides internet and the router forwards it to the destination. Now it is important to make sure that from the internet-router all devices in different subnets must be reachable or else the reply packet from the internet will not reach the host on the subnet. If you are using a modem router for internet connection, you can still configure it statistically and used the vlan interface ip of the switch where the route to 0.0.0.0/0 is configured. ... View more

I'm in a similar predicament. I currently have a stacked pair of 250's, but was curious if a warm spare was better or not. Since it's a small office I would think from a management point of view a stack would be better.  ... View more

I found this thread as I wanted to do similar. I have just bought two different types of 'cisco SFP-10G-T-S compatible' 10gbase-T copper GBICs and they both work fine in MS225-24P, 48 and 48LP switches. I am linking them back to an mGig port on an MS350-24X.   The MS225 end doesn't seem to always report the correct speed from the GUI but it seems to be working perfectly. Some of these are over longer than 30M cable runs and the MS350 end is reporting a 5gbit link on those runs but the Ms225 gbic always says 10gbit. ... View more

check first 8 ports settings, normally they should support 10M option. ... View more

We are working towards this solution today for a couple of reasons. 1) When a laptop gets patched and rebooted today it does not reconnect to the network (assuming it was only wifi connected) until a user interactively logs on.  With COVID keeping folks out of many offices for weeks or months on end this has been problematic 2) When an IT person attempts to logon to a laptop via wireless (currently using RADIUS with NPS to AD) that logon fails because there is no network connection until after successful login (exception being cached credentials).  This is a pain for IT and forces them to connect wired before then can even start their work. 3) If you have any sort of logon script or any other processing that should happen at logon this doesn't work properly either (cart before the horse)   To mitigate some of the concerns mentioned above our AD team uses LAPS to automate local admin account password changes every month and each one is stored in a secure server that requires multi factor auth to logon to. We also encrypt the drives of all mobile device making boot disks and other ways to reset the local accounts very difficult.   Lastly, we are using 2 AD groups one that we can add devices we want to deny (policy 1) and the other those we want to permit (unsure but could ultimately be domain computers with exceptions weeded out in policy 1) in policy 2.   Hope this helps.  Also, good luck with setting this up.  I have found MANY different articles and approaches on this.  Many focus on the user auth side.  The machine auth is more complicated and there isn't a single recipe for success I've found so far anyway. ... View more

Did you ever find a SFP to work on these?  I need some for cameras we have and didn't know if you found a solution or not.   ... View more

I have a /30 WAN connection network, and a /24 public IP space for use at my/our discretion.  The /24 sits behind the /30.  The upstream provider router is set such that the /24 is reachable through my side of the /30.    Is it possible Comcast is assuming this for your setup as well?   Caveat(s):  I don't have Comcast, and I don't know much about them.  We use AT&T ADE, which is a straight L2 point to point metro Ethernet circuit.  Our internet provider is the telecommunications department of our overall organization and not AT&T.   But anyway    (there are other trunks on my circuits, and a redundant circuit to a 2nd location, but that's beyond the scope of this discussion) ... View more

It would be rather good if it did 😎   Hint, hint @Meraki  ... View more

My setup was similar when I didn't have our datacenter network behind the (non Meraki MX) firewall.  My MS425s were doing OSPF between themselves and Cisco ASRs, and whatever the datacenter vendor had on their end.  I used a transport network, as you mentioned, between the Meraki and ASR, and then another transport network between the ASR and the datacenter vendor's equipment.  I did not extend the internal VLANs beyond the MS425s, but I did advertise the subnets contained within the VLANs to OSPF so everything participating in the OSPF area had the information about which router had (for example) the 10.1.2.0/24 network.   It took a bit of fiddling the first time to get it to work, but the problems ended up being speed/duplex between the Meraki gear and the ASR.  The aforementioned MS425s replaced an old Catalyst 6509.   I have now moved the datacenter network behind the firewall, as we bought some larger firewall boxes, so now FW vendor P is handling OSPF.  But I would not hesitate to use OSPF on Meraki again if I had a need for it.   ... View more

Come on now, they're not that bad.  The 11.x firmware had issues.  But prior to that, my MS42Ps ran for 7+ years with zero problems. ... View more

I wish Meraki did have a VRF capable switch.  I could EOL our Cisco router fleet.  As it is, I am thinking of replacing them (ASR/ISR) with some Ruckus switches with advanced IP license which my firewall reseller likes and recommends.  We do not tax our Cisco routers at all and the ASR were extremely expensive, a switch that supported VRF and VRRP would work fine to replace them. ... View more

Well half a day has gone by and so far the results are looking good!  I appreciate all the suggestions and help.  If anything changes I'll be sure to update the post.   Shawn ... View more

One, looks to be quite important, fix and one ms390 tweak:   Switch firmware versions MS 12.9 changelog Alerts MS210/225/250 switches cannot forward IPv6 Router Advertisement and Neighbor Solicitation packets when flood unknown multicast is disabled (has always been true) Additions Support for MS390 Series Switches Loop Detection on MS210/225/250/350/355/410/420/425/450 series switches MAC Flap Detection on MS210/225/250/350/355/410/420/425/450 series switches MS390 Local Status Page identifies ports on other stack members by name instead of MAC address Bug fixes Routing to a next-hop can fail when the MAC of the next-hop gets evicted from the CAM table on MS210/225/250/350/355/410/420/425/450 series switches Known issues Port authentication can fail on non-stacked MS120/125/210/225/250/350/355/410/420/425/450 series switches MS390 series switches Max MTU is limited to 9198 bytes MS390 series switches will not display packet details in the DHCP Servers page MS390 series switches do not support the 'next-server' or 'bootfile' parameters in DHCP messages Rebooting a single switch in an MS390 stack will reboot the entire stack LLDP frames from MS390 series switches will use a single system name instead of the Dashboard given name MS390 series switches will not display the advertising router ID for OSPF MS390 series switches with OSPF enabled will default to an IP MTU of 1500 bytes on every OSPF enabled interface MS390 series switches do not support the multicast routing livetool Stacked MS390 series switches do not report traffic/client analytics correctly in all cases MS390 series switches do not support tagged traffic bypass for voice on ports with a Multi-Auth access policy Dynamic VLAN assignment from a RADIUS server on MS390 series switches must already be an allowed VLAN on the port for it to function MS390 series switches may not display link state on links at mGig speeds (2.5G, 5G) MS390 series switches do not currently support the following features: VRRP, SM Sentry, Syslog server, SNMP, Traceroute, IPv6 connectivity to dashboard, Meraki Auth, URL Redirection, MAC Whitelisting, RADIUS Testing, RADIUS Accounting, RADIUS CoA, QoS, Power Supply State, PoE power status/usage, Loop Detection, UDLD, MAC Flap Detection ARP entry on L3 switch can expire despite still being in use (predates MS 10.x) SM Sentry does not support Windows based clients (predates MS 10.x) MS425 series switches do not forward frames larger than 9416 bytes (predates MS 10.x) MS350-24X and MS355 series switches do not negotiate UPoE over LLDP correctly (predates MS 10.x) Other Various performance and stability improvements ... View more

Yes, the uplink from your 2 VLANs will be whatever the default route is, unless you put in some ACLs in preventing access to the default route, or if you have other routing protocols like OSPF that you configured to supersede the default route. ... View more

I have 22 HP MFPs in this building and I have no issues like the one you describe.  The printer models are the 67560 and the 87660   Running a mix of MS250s and MS42Ps, the printers would be plugged into one of those two models.   One thing I do when I set up the printers is turn off all services on the HP side that are not necessary in my environment, like multicast, Bonjour, AirPrint and IPv6.  These services are on by default.  I don't know how they interact with Meraki and I don't plan on finding out because I don't need them.   Also, there are fairly frequent firmware updates for the HP models I have.  I try to stay on top of those.     ... View more

Predates 10.x?  I never had the issue until going to 11.x.  I'm still holding at 10.45 and it's working great in my environment, including on the stack running L3.  However, I think at some point there will be a cost in staying on 10.45  in terms of losing access to new features.   One thing I've considered is moving L3 to the firewall - vendor P likes to tell their customers "we can do that".   Or just buying a core switch stack from another vendor, and not catalysts either.   I don't understand why they can't get it together on this issue.  It's been at least 5 months since this thread started.  This issue should have been fixed in days or even hours. ... View more

I don't think anything in the Meraki arsenal can block the port 53 VPN solutions at the moment. ... View more