Hi @extopo41 , The Local Status Page(LSP) is used to connect to Meraki devices. It is accessible securely via the local web browser on a host computer with credentials. The LSP uses secure connection between the host computer and the Meraki device to protect these sensitive settings.   For further details refer to the below section; Controlling Remote Access to the Local Status Page of the guide below https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#Configuring_the_Local_Status_Page     ... View more

Hi All, I Just wanted to clarify some points to clear any possible confusion. You can disbale the Local Status Page in the Dashabord yes. However, If your device has a physical management port, it will always remain active regardless of the value of this setting.   It is recommended to change the Local Status Page password for devices with management ports. Navigate to Network-wide > Configure > General > Device configuration and provide a strong password.    Refer to the section Disabling the Local Status Page in the guide below.   https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#Disabling_the_Local_Status_Page     ... View more

Hi @agionet , "Microsoft Surface docks - could the flapping be happening when users disconnect or connect their laptops to the docks? "  I would say would be the likley culprit of the logs. However, given you have mentioned the End users complaining about slow speed. I'd propose you give @DarrenOC 's suggestion a go. Ensure RSTP Root is set correctly.  https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS ... View more

Hi @TyShawn , Even though you have your answer. "problems like the random reboot issue that the MX75 is seeing." I suggest you raise a case with Meraki Support, so they can run thorough checks.         ... View more

Hi @Ab79 , Looking at the screenshot, the signal strength is excellent! So that doesn't look like the issue here. What is the user actually reporting? or was this just simply 'noticed' in the Dashboard?     ... View more

Hi @RANT , As with any monitoring platform out there. We need to be sure we are monitoring the appropriate Interface, Module, Socket etc. Then ensure we have the right reporting mechaismim in place. Sound like icmp ping timeouts, perhaps? 1.) Is Solarwinds telemetry polling within the VPN Domain or "Outside"? 2.) What protocol is used to poll this MX info?   ... View more

Hi @AndreHCEA , There's an App(Guide) for that!!. Jokes aside, VLANs are one of the best ways to implement security. Then Tag those SSIDs with said VLANs.  e.g.      SSID tag https://documentation.meraki.com/MX/Wireless/Creating_a_Wireless_Guest_VLAN_on_a_Z-series_Teleworker_Gateway_or_Wireless_Security_Appliance#Create_Firewall_Rules_to_Block_Inter-VLAN_Traffic ... View more

Good stuff man!!! ... View more

No problem at all @Sweemz.  Given the devices have already been purchased you could increase efficiency and redundancy. My preference would be to clean up the design, rather than chasing errors and warnings.  Judging by that Topology Screenshot. It Seems like, RSTP Priority is set to the default of 32768, and SW00 happens to be the Root Bridge. However, without actually looking into the Network, I can't verify. Also, it looks like SW01 could be a Backup Root or potentially used as one. If so you could have;    A) SW00 & SW01 connected together as a Core/Distribution. With uplinks to the MX-HA Pair. B) SW00 as Root Priority 0 C) SW01 backup Priority 4096 D) SW02,3,4 leave Priority as is. Then only have 2 uplinks, 1 each to SW00 & SW01. E) All other Devices connected to only SW02,3,4     ... View more

Hi @Sweemz ,   Not sure I follow the Topology Diagram either. Port 52 is directly connected to the Root switch. So that would be the Root port. Port 49 & 50 would be alternate ports. I agree with @RWelch. The Topology map in the Dashbaord is 'live". So if the Tree changes so will the map. I use it daily. Best tool to use for these kind of queries.   https://documentation.meraki.com/MS/Monitoring_and_Reporting/Network_Topology If you can share a screenshot, that'll be helpful. ... View more

Possibly a faulty controller? Let us know how you go. ... View more

Hey @cabricharme, Re: the pcap. 1.) Just run a raw capture, no filters at all. 60-second duration is fine. 2.) Enter "STP" in the filter of WireShark. 3.) Check the STP frames for the Server/Host Mac Addresses. If so, it is running Spanning-Tree.  4.) Log into the KVM or Web UI etc for the Server/Host to turn off Spanning-Tree. See example below;   STP Pcap Example   Re: The similar issues you've come across in the past. This comes from my Personal experience. Not sure if customers have posted here or not. I've also run into this during deployment.  ... View more

BPDUs are never sent untagged. It must have a VLAN-ID. So then yes, you must tag on the non-meraki switch Trunk ports. Which is more manual work to do and get working, and a pain to tshoot..  You don't have to use Option a. You mention the non-meraki switches can run MST. If you run the same Spanning Tree Protocol across all switches. Then it's very easy to design and tshoot.  Here is the rest of the quote: "MS series switches to participate in spanning tree a spanning tree instance must be running on VLAN 1 of all switches and VLAN 1 is allowed on all trunk ports running PVST+ so that BPDUs are seen by the Meraki switches in the topology." ... View more

"47.2W for each APs." 40Watts is the Maximum for the MR57. Did you mean 47.2 Volts? https://documentation.meraki.com/MR/MR_Overview_and_Specifications/MR57_Datasheet#Specifications Judging from that Screenshot; perhaps Spanning Tree could be shutting ports??? That would make sense if configured in 'Power Sharing' mode'.  As you have an Agg/Port Channel configured. Make sure it is configured correctly and matching on both the switch and MR57. See below details. https://documentation.meraki.com/MR/MR_Overview_and_Specifications/MR57_Dual_Uplink_High_Availability#Prerequisites ... View more

Agree with the native part. But here you would Tag VLAN 1 and not leave it native anywhere. It would need to be pruned from Access Ports to end devices, PC, Printers, etc. So you're after Option b.)  MST is completely compatible with STP/RSTP. It is just an expansion to the protocol. It adds a per-VLAN Spanning Tree to better use the paths on each VLAN. Which is why it is recommended.   ... View more

Hi @Sakul , The BPDU's are exchanged on ALL VLANs; per the RSTP standard. That said, you can set up VLAN 1 like a Transit for PVST/PVST+. But it can get messy. It is recommended to use MST. https://documentation.meraki.com/MS/Deployment_Guides/Advanced_MS_Setup_Guide#Protocol_interoperability   ... View more

Hi @cabricharme , I've come across similar issues like this in the past, where the host/server has Spanning Tree and or mismatched VLAN set to default. Run a packet capture from the MS120 Port to the Host to confirm. You can set up Port Mirror if needed. https://documentation.meraki.com/MS/Monitoring_and_Reporting/Packet_Captures_and_Port_Mirroring_on_the_MS_Switch ... View more

Hi @allywenzel , I do see this type of situation often. Usally something changes to cause this.  That log "stp_tcn_error" 'Topology Change Notification". Meaning the Layer 2 path or Spanning Tree is changing where all traffic should go. Most of the time, someone plugged in something. Or in your case, most likley a cable or device is misbehaving. As @RaphaelL reccomended, check you RSTP Root and make sure it is it is in fact the Root. Use the following guides to assist in the investigating and mitigation.    https://documentation.meraki.com/MS/Monitoring_and_Reporting/Loop_and_MAC_Flap_Detection_on_MS   https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MS_Switching/General_MS_Best_Practices       ... View more

Hi @GIdenJoe , Those are some valid points you make. And there are certain business and use cases where an Airgap soultion is better suited than Cloud based. However, I would argue that;   - "CLI you immediately now at what command you just fumbled". This is not always the case. In the Configuration Shell the problem might not error or be seen in Syslog at all. E.g. if there is a certain traffic flow conditions being hit and the configuration is 'correct' you won't be able to see it from that Shell. i.e. Logs will need to be pulled from the controllers on the Line Card or Module directly. This can be very tedious & time consuming to discover this condition at all.    - Regarding the disconnects to Magagement and or the devices. I have certaily worked on cases where, sites are out in the sticks, only have Sateliete (RTT of 300ms) and perfrom very well all things condisered. That customer had the the proper design considerations in place to achieve this. i.e. VLAN Pruning, STP following best practice, traffic shaping policy in place. etc.   Yes, things can go wrong sometimes. Which is why i love the Dashabord, because you can very quickly discover these then spend the time drilling into root cause. Just my Two Cents.     ... View more

"Would have been 15 seconds at CLI.  I am not a fan of GUI, give me terminal any day." That's what I said when I started at Meraki... Now?... I won't go back to CLI ever. The Meraki Dashboard wins hands down. 'Want to enable a new VLAN across multiple sites?'. Can be done in less than 15 seconds.  'Want to see why all of a sudden end users are complaining about slow speeds?. The Meraki Dashboard gives you a nice live toplogy view of the network and you can see if a device is misbehaving or it's just a subset of clients only' "Firmware upgrades for remote sites with only a Satelite link?' Dashboard does all the work. Honestly. Go through our Documentation site. Very easy to read, images of configs examaples. We even have videos showing you how to set things up. https://documentation.meraki.com/Getting_Started_with_Meraki Anyway, hope you enjoy the journey.  ... View more

Hi @carlto , This might interest you 😉 "BGP peering over IPsec VPN tunnels can be enabled on the Meraki Security Appliance. This unlocks new dynamic routing use cases for customers in addition to enabling resiliency and redundancy over IPsec VPN peers. "   https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN         ... View more

Hi @SysOP , Do you perhaps have RADIUS VLAN Override configured on that SSID? if so, what does ISE see when this issue occurs? https://documentation.meraki.com/MR/Access_Control/MR_Meraki_RADIUS_2.0#RADIUS_VLAN_Override ... View more

Hi @thomasthomsen , Correct. The Chain of Trust is a must.  😉  See the below excerpt from the AnyConnect Authentication Methods guide.   "AnyConnect server will use the uploaded trusted CA certificate to validate authenticating clients before requesting for the users' credentials. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#Certificate-based_authentication_with_Username_.26_password     ... View more

Hi @AVL , If the AP was connected to another device, sounds like could be IP Address issue and or VLAN towards the Meraki Cloud. Check the LED status of the AP and follow the suggestions in the tshoot guide below. https://documentation.meraki.com/MR/Other_Topics/Troubleshooting_and_Replacing_a_Faulty_MR_Access_Point#If_there_is_one_solid_orange_power_LED_and_no_other_LEDs_are_lit ... View more