About RomanMD

RomanMD · ‎07-01-2022

Any static routes configured on the switch which might send the traffic to other destination instead to the ISP? Maybe the traffic is going via your internal network where you have an inline proxy/fw that decrypts the traffic? On the other hand, I can confirm that there was a problem with MX250 which could not connect to the dashboard. This could be solved only after updating the MX to the latest version using copper SFP instead of 1GB FO SFP.

RomanMD · ‎07-01-2022

Meraki switches are meant to be managed from the cloud. What you are referring to, most probably is the meraki-cli python module that is emulated kind of CLI interface. But that module is making use of Meraki API - and there is no api endpoint for your request. However, your request is easily done with a script and you will not have to copy/paste anything.

RomanMD · ‎06-30-2022

Hi @DarrenOC. Of course I have, but wanted to cross-check him! 🤣

RomanMD · ‎06-30-2022

Hi, we all know about the new AP models released by Cisco/Meraki which supports dual persona, so we can choose to have them WLC managed or Meraki Cloud managed. But those are new models and more expensive. Does somebody have any information - is there any plan to support Meraki Cloud Management on old Cisco 9k APs? C9115, C9120, C9130? Thanks

RomanMD · ‎06-30-2022

Well, support did not give me any commands.. but just put me on the right path. 1. your switch should already have aaa new-model in the config, otherwise it will not work. Then inspect your AAA commands and the AAA commands that the application will configure on the switch. The application will configure new VTY Lines and add the authentication group MERAKI: line vty 32 33 access-class MERAKI_VTY_IN in access-class MERAKI_VTY_OUT out authorization exec MERAKI login authentication MERAKI rotary 50 transport input ssh Then it will add some aaa to authenticate locally: aaa authentication login MERAKI local aaa authorization exec default local aaa authorization exec MERAKI local And if you have the aaa authorization config-commands then this config does not allow meraki-user to authorize, and therefore you must have a special rule to allow "meraki-user" to get privilege level 15. aaa authorization commands 0 default group tacacs+ local aaa authorization commands 1 default group tacacs+ local aaa authorization commands 15 default group tacacs+ local In my case, it was an authorisation problem. In your case it seems the authentication is not working. Do you have the aaa new-model enabled already?

RomanMD · ‎06-27-2022

I'll second Brandon's opinion. One more thing that I've observed over the time - the old Cisco phones did not like to be plugged into PoE and have also the external power adapter. Other than that, the wiring guys may buy a PoE tester, they're absolutely not cheap... but may identify problems without killing just another phone...

RomanMD · ‎06-27-2022

wondering if this issue has been solved and how as I do experience the same issue on some switches...

RomanMD · ‎06-24-2022

Mystery solved! The problem was related to tacacs authentication. The standalone app creates a local user: meraki-user which is used to authenticate via the tls-tunnel, and a bunch of aaa commands. But my switches already were configured for tacacs+ in a way we are using for authentication and it seems did not take every possible configuration in the account. Now it is fixed after I've spent some time with support.

RomanMD · ‎06-22-2022

It is reporting as Repeater because it cannot obtain a lease, not vice-versa. According to documentation: The AP only converts to a repeater when one of the following is true: The AP cannot receive an ARP reply packet from the default gateway on the LAN which is usually a local firewall or router The AP is unable to obtain a valid IP address via DHCP The most common problem: check the cabling.

RomanMD · ‎06-22-2022

The device doesn't rely on the snmp information. Snmp is another way to expose some information from the switch. So the OID's may or may not be implemented.

RomanMD · ‎06-22-2022

To be honest, I did not get the question but if you refer to cloud control as "What Cisco devices can you add in Meraki dashboard for monitoring" then they clearly said - Catalyst 9k switches - 9200, 9300 and 9500.

RomanMD · ‎06-22-2022

Yes! It works the same it just requires more steps. You need to de-attach the license from the broken switch and assign it to the other switch which will be replaced. You can do this even after replacement since you have 30days grace period. So, you don't require to assign the license before replacing it.

RomanMD · ‎06-21-2022

You should start on the documentation page. The switches should be configured in the traditional way and operational. So you should be familiar on how to configure them. Few pre-requisite must be met before being able to enable the switches for Meraki monitoring. Don't go with Meraki management yet, since this is not yet publicly supported. The process to add the switches to dashboard is straight forward without the need to execute CLI on the catalyst, the app will do everything, however if it will not work - the troubleshooting requires you again to interact with the CLI. Good thing about catalyst is that they have console - so the client can connect them to console in case you need to access them remotely. https://documentation.meraki.com/Cloud_Monitoring_for_Catalyst/Onboarding/Cloud_Monitoring_for_Catalyst_Overview_and_FAQ

RomanMD · ‎06-17-2022

the sunglasses are nice but I think smaller fonts and darker colors would be a better reward...

RomanMD · ‎06-17-2022

Do you think they teach Meraki now in the college?! 🤪

RomanMD · ‎06-17-2022

Unfortunately, there are many more in the same boat, but this can't be done with Meraki MX. So, the only way to do it is with a layer3 device in front of the MX which will do some routing and NAT.

RomanMD · ‎06-17-2022

New day has arrive but no lights in the end of the tunnel. The job from yesterday, todays return this beautiful information.... https://api.meraki.com/api/v1/networks/L_690XXXXXXXXXX097/devices/importStatus?jobId=6XXXXXX4 {'error': 'timed out', 'results': {'capabilitiesState': 'DIRECT_STARTED', 'configState': 'UNKNOWN', 'connectionState': 'CONNECTED', 'status': False}}

RomanMD · ‎06-16-2022

Still not working to add the device for monitoring. By checking the logs, everything seems to be correct and the application queries for an device import job id which does not seem to be promising. { "results": { "connectionState": "NOT_CONNECTED", "capabilitiesState": "PENDING", "configState": "UNKNOWN" } } Minutes later, I have queried the same endpoint and got this status, but the device still does not show in dashboard. {'results': {'capabilitiesState': 'DIRECT_STARTED', 'configState': 'UNKNOWN', 'connectionState': 'CONNECTED'}} Giving up for today.

RomanMD · ‎06-16-2022

Yes, I've seen your comments in the other thread and I went ahead and added an MS390 to the network to set the Unique Client Identifier, however, now I am stuck at the pre-check with "Device is not eligible for onboarding. Reason: Device SUDI was not found" on both switches, and I can't get out of it...

RomanMD · ‎06-16-2022

docs are saying 17.3.x - 17.7.x

RomanMD · ‎06-16-2022

This is what I have done, but I don't have very good experience with support on new features and now I have the same feeling. From very few posts here on community, I can see that each try is a "special" case that has to be troubleshooted individually, which is suggesting that the process is not even beta, but in alfa stage. It is clearly a feature that many of us are interested in, so would be nice if we can see some fast fixes.

RomanMD · ‎06-16-2022

I do see the need of a complete troubleshooting section where everyone will describe their problems of using this apparently nice feature but not sure if ready enough. So, let's start. Trying to add to the dashboard two stacks: 9500 (stackwise-virtual) and 9300 (backplane). Switches running 17.3.4 and 17.3.2a. Using the MacOS standalone app. Both switches have internet connectivity and onboarding checklist verified. Both switches have dna-advantage licenses. Intermittently one switch is failing complaining about the certificate. Mostly the 9300 but not always. Going further with the one that passed pre-check and reaching the last step with the message bellow, but the switch doesn't join the dashboard. On the upstream firewall do see UDP/33xxx traffic towards compute.amazonaws.com. Really interested if anyone tried the feature already and if it worked for them.

RomanMD · ‎06-15-2022

The Identified and Reply URL needs to point to the DNS name of the appliance, therefore I don't see it possible to use the same Enterprise application for multiple networks. I wish I am wrong...

RomanMD · ‎05-28-2022

Yes, of course. Check the developer hub, on the right side you have the examples for Python using the Meraki library or python requests library. https://developer.cisco.com/meraki/api-v1/#!update-network-wireless-ssid

RomanMD · ‎05-28-2022

I experience the same behaviour with MR56 running 28.6. Two AP's connected to different switch models, the same behaviour, however, it does not happen too often. It could be once per week or more rare. Did not dig further what exactly happens, but looking at the other thread, makes me want to dig dipper next time when it happens.

RomanMD

Community Record

Badges