That's the suggestion yes. Replace the MX84 before its End of Support date (Oct 31st 2026) Renew all of your licenses at your co-termed end date (2027)   Depending on when in 2027 your licenses expire, you could potentially look at bundling both of the above actions into one. ... View more

We've got C9500's in the core. That said, they're currently in the old Meraki monitor mode pending the transition to the new Meraki Managed Device Configuration mode.  Reading the docs, it looks like ISSU is only available from version 17.8.1 (the stable release candidate version). I haven't tested but I hope you can still manually issue an ISSU via the CLI in prior versions... ... View more

I'm certainly no expert but from some reading, it seems that some devices can have incompatibilities with negotiating UPOE.   UPOE 60W and 90W require LLDP to negotiate (potentially what @Mloraditch was referring to). Without LLDP it should fail back to standard PoE+ (30W) but perhaps that's not working for you. This thread was also an interesting read specifically relating to UPOE and an IP Camera. In the end they needed to statically set the power on the port: Cisco C9300 802.3BT mode - Works.. but running into oddities with specific Camera Model : r/networking   Assuming the switch isn't in device config mode, and thus you have limited configuration options, you might need support to add/change some config to get it working. ... View more

As long as your network is connected/configured correctly, enabling high availability in the dashboard is relatively trivial. The guide @jbright provided should have everything you need to get started. ... View more

You're correct and the distributor is wrong.   Co-Term means exactly that - all licenses added to the organisation will expire together. So, all devices in your organisation will remain licensed until the co-term expiry.   If you add licenses for new devices, your expiry will be pushed further back. When you approach your co-term expiry date, you can purchase a renewal of licenses for the existing devices. ... View more

Nice writeup! I've never liked the NPS Azure MFA integration. We tried getting it integrated with MS AOVPN and had all sorts of issues. Looks like NPS + Azure MFA + Meraki native client is even more difficult. One of the issues we hit was that the MFA prompt would appear behind all of the user's other applications on the client PC. Not super helpful for staff with limited computer literacy 😆 ... View more

That's weird that they're using an RFC 1918 IP Range for CG-NAT instead of the 100.64.0.0/10 range. But as @PhilipDAth advised, if you're behind CG-NAT you cannot port forward. ... View more

Personally I stick to scanning only things in my network. While there's no harm in scanning the ISP equipment, it's quite possible the Nessus scan finds false positives (which seems likely in your scenario detailed here). ... View more

Congratulations to the employee all-star team! Your contributions are key parts of this thriving community ... View more

Congratulations everyone! And welcome @JamesT91 ! Great to see both old and new faces in the group. ... View more

I agree with @RWelch at this point. It's difficult to know exactly how you have it configured and there are multiple possibilities as to what could be the issue. Your best bet is to jump on a call with Meraki support and walk them through your configuration. Don't forget to circle back here once you do. It's always good to have closure and a resolution for people who come across the post in the future. ... View more

I've got some C9500-48Y4C in Meraki, but they were onboarded back in the original Meraki monitor mode. I haven't yet switched them to the new onboarding method. The main caveat I can recall was that client stats required DNA advantage licensing.   Looking at the new guide for Cloud Management with Device Configuration, there is a note that implies that device tracking configuration is not modified.   During onboarding of a C9500 to Device Configuration mode, device tracking will not be modified. Users can choose to modify it via CLI after onboarding.  Enable Cloud Management for Catalyst Switches with Device Configuration - Cisco Meraki Documentation I do vaguely recall having to attach device tracking policies to some interfaces but I don't remember which ones or why. I certainly didn't have to build it out from scratch. ... View more

Can you use the Cloud CLI (as shown in the page you linked) to validate whether it has correctly applied? You should be able to check both the configuration and the VRRP state.   That should indicate whether it's not actually working, or whether it's a GUI issue ... View more

Take a look at the following thread. Draytek VPN is an alternative some have used - https://www.draytek.com/products/smart-vpn-client/  - I have never personally used it nor can I vouch for the creator There's also a good tool for generating the configuration (for Windows 10 but may be applicable Windows 11) - IFM - Configure Meraki Client VPN on Windows   Solved: Re: Alternative to VPN client built-in on Windows - The Meraki Community ... View more

The minimum supported IOS-XE version for Meraki Cloud Management with Device Configuration (previously known as monitor mode) is 17.15.3   Enable Cloud Management for Catalyst Switches with Device Configuration - Cisco Meraki Documentation ... View more

What you've said for the WAN side bandwidth is correct For the uplink priority to work correctly, you need to set a bandwidth under "SD-WAN & Traffic Shaping -> Uplink Configuration". This is the value that is used for the calculations. When a higher priority queue is not in use, its tokens are dynamically reallocated to lower priority queues   See the following document for reference: https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Firewall_and_Traffic_Shaping/SD-WAN_and_Traffic_Shaping#Rule_Actions   For downstream bandwidth reservations and queuing (for traffic between the client and the MX), you would want to use QoS and CoS tagging. ... View more

I can't think of anything easy. The only way to confirm would be to know the destination IP address of an app you're validating and confirm via packet capture that packets with that destination are broken out correctly ... View more

Congratulations @JeroenVercoulen @AxL1971 @MarcP  ... View more

As @alemabrahao check whether full tunnel or split tunnel is enabled.   With split tunnel is enabled, Internet connectivity should exit out the client's local connection. If you're using full tunnel, all traffic (including Internet bound traffic) will traverse the VPN. ... View more

As has been said, the only thing I can think of is that the graph on the performance tab is historical.   The client count on the summary tab is live. The client graph on the performance tab is 2 hours or more historical. ... View more

The native Windows client is pretty limited in its support for additional security features. As said above, if you use Microsoft Entra, you can enable MFA via the MFA extension and conditional access. ... View more

Looking back at my 2025 resolutions, I only (half) achieved one of them - cleaning up my homelab.  It's not perfect but it's far better than it was. The others got put aside as both work and family pressures picked up.   For this year I'd like to: Setup (and keep) healthier routines Get CompTIA Security+ certified ... View more