Meraki

RWelch

There is generally no advantage to manually specifying Umbrella DNS servers on the MX WAN uplink when you have already integrated Umbrella via API and are applying policies at the MX/MR level. With API integration, Meraki devices use their identity to enforce Umbrella policies, and DNS traffic is automatically routed and protected according to those policies. Manual DNS configuration is only necessary for non-Cisco devices or networks that cannot use API integration. For Meraki MX/MR with API integration, manual DNS configuration does not provide additional security or policy enforcement benefits, and the integration is designed to prevent users from bypassing Umbrella by changing their DNS settings locally.

RWelch

RWelch

Without manually updating the MX WAN uplink, Meraki intercepts the DNS query and attaches an identifier to identify which Umbrella policy this request should be checked against. Ensure that bi-directional UDP 443 traffic is allowed to the Umbrella endpoint of 208.67.220.220/32. Manually Integrating Cisco Umbrella with Meraki Networks

RWelch

Zscaler Internet Access (ZIA) Integration

RWelch

In the event of cloud connectivity loss (which is most commonly caused by a local ISP or connection failure), the Meraki hardware device will continue to run with its last known configuration until cloud connectivity is restored. Meraki Cloud Architecture If a device is offline, it will continue to attempt to connect to the Meraki cloud until it gains connectivity. Once the device comes online, it automatically receives the most recent configuration settings from the Meraki cloud. If changes are made to the device configuration while the device is online, the device receives and updates these changes automatically. These changes are generally available on the device in a matter of seconds. However, large quantities of changes may take noticeably longer to reach their devices. If no configuration changes are made by the user, the device continues to periodically check for updates to its configuration on its own. Short answer: Meraki switches will boot and operate using their last known good configuration even if they cannot immediately reach the Meraki cloud. They will continue retrying cloud connectivity indefinitely. There is no local configuration storage that you can manage manually, but the device automatically retains its most recent working config.

RWelch

What MX firmware version or versions are the MXs currently running? Are all MXs running the same MX firmware (or are they different versions)? Have you ran simultaneous packet captures on site A and site B and compared results? If this were my project, I'd be inclined to do a factory reset on both MX67s and force it to fetch a new dashboard config just to make sure it's previous settings/config aren't still lingering somehow.

RWelch

How has others' experience been? Still in learning mode....digesting/consuming. 😄

RWelch

The Hybrid Campus LAN Design Guide (CVD) has two design options for your consideration: Design and Configuration Guidelines Option 1 - STP Based Convergence with Native VLAN 1 Option 2 - STP Based Convergence without Native VLAN 1 I typically choose to use Option 2 when deploying L3 interfaces but both options are there for your consideration. I am running MS425s and keep the MTU at 9394 so your default MTU of 9198 should be ok.

RWelch

Here are a couple of other reference documents if interested with L3 setups. Layer 3 Switch Example Hybrid Campus LAN Design Guide (CVD)

RWelch

The transit VLAN. MS Layer 3 Switching and Routing

RWelch

Zscaler Internet Access (ZIA) Integration

RWelch

vMX Licenses are as follows: vMX-Enterprise: LIC-VMX-S/M/L-ENT-[X]Y vMX-Advanced-Security: LIC-VMX-S/M/L-SEC-[X]Y X= Number of Years According to the Meraki MX/Z Security and SD-WAN Licensing documentation dated Nov 5, 2025.

RWelch

I get it.....hopefully it'll be fixed (resolved) soon. Was merely sharing so folks know it is possible to change given the right conditions - without the dashboard pencil edit button.

RWelch

I do have the ability to make changes via the LSP - so I'm not completely unable to change WAN settings. Not sure if that helps you or others....but that is a WAY to change the WAN uplink settings.

RWelch

The pencil icon to edit the WAN 1 or 2 uplink is not visible on any of my networks either.😒

RWelch

Not 100% sure about the "different network" part of the question but the next slide that you referenced shows: Each AP establishes two QUIC tunnels to both Primary and Backup Campus Gateway

RWelch

The last day of support for cloud monitored Catalyst switches is January 31, 2026 and cloud monitoring features will no longer function for switches that have not transitioned to Cloud Management with IOS XE. These switches will show offline in the Meraki dashboard but there will be no impact to device operations. Cloud Monitoring End of Service - Transition to Cloud Management - Configuration Source: Device

RWelch

Site to Site VPN with Meraki Go Router Firewalls

RWelch

There was a similar post approx 1 month ago about port profile limitations using the mobile app, if interested. Mobile App cannot edit Port Profile?

RWelch

AP Zero Touch Deployment Simplify AP deployments with automated, one-click provisioning.

RWelch

Through testing, I’ve observed that the AI-RRM performs well in environments with significant RF interference, however at a remote location with a relatively clear RF spectrum and few competing SSIDs, its benefits appear to be minimal. IMO it's dependent upon your RF spectrum.

RWelch

Probably more along the lines of data retention limitations. Dashboard Data Availability

RWelch

Cisco 8000 Series Secure Routers Frequently Asked Questions (FAQ) if interested.

RWelch

Have you checked the MTU? Troubleshooting MTU Issues What MX firmware version are the MX68s currently running?

RWelch

Go to Organization → Inventory → Claim Enter the new device’s serial number (found on the box or back label) That should register it

About RWelch

RWelch

Community Record

Badges