Hi Gabriel_Costa, A warm welcome to Meraki Community 🙂   To summarize all great posts mentioned above 🙂   It depends on the AP model, in most cases the colors meaning are as follows -  https://documentation.meraki.com/MR/MR_Installation_Guides:   Rainbow - AP is initializing/scanning - in other words trying to connect to Meraki Cloud Blinking Blue - AP is upgrading Green - AP in Gateway mode with no clients Blue - AP in Gateway mode with clients Blinking Orange - AP can't find uplink   Next best troubleshooting steps: STEP 1 - Connect a PC to a known working switchport with a brand new cable with Wireshark installed: Start the Wireshark packet capture on the PC Is the switchport LED color light green? Did the PC receive an IP address successfully? Can the PC ping it's own Gateway? Can the PC ping 8.8.8.8 and browse to the Internet?   If the answers are "Yes" on all questions above, continue with the next steps. If any of the answers is "No", please check the switchport configurations (trunk/access mode, VLANs etc.), or why the PC can't receive an IP address or ping 8.8.8.8 upstream etc.   STEP 2 - Please, connect to the Device Local Status Page - https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page   1) What does the "Connection" tab shows under the rows:   Ethernet - It should show "The access point is directly connected to a local network. IP address XXX.XXX.XXX.XXX" Internet -  It should show "The access point is connected to the Internet" Cisco Meraki Cloud - It should show "The access point is successfully connected to the Cisco Meraki cloud. 2) Download the Support Data Bundle (SDB) and send it if necessary 3) Perform a factory reset on the AP by inserting a paper clip for at least 35 seconds. 4) If the issue continue, please create a case with Meraki Support Team for further investigation with the above information ^   Please, find the documentation of how to download the Support Bundle File- https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Out-of-Band_Log_Fetching   If you have any questions, please don't hesitate to contact us. ... View more

Hi dstrejo,   This seems to be very common issue.   For future reference I would like to highlight the following documentations - https://documentation.meraki.com/MR/Monitoring_and_Reporting/Understanding_and_Configuring_Management_VLANs_on_Cisco_Meraki_Access_Points   More detail explanation with examples - https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/VLAN_Tagging_on_MR_Access_Points In  general, Meraki APs have two types of traffic:   Their own management traffic (Management VLAN) - any Cisco Meraki device will send upstream to the cloud controller - that's the IP address of the AP's Summary page (under Wireless > Monitor > Access Points > (AP's name)). It is important to ensure that the MR's traffic will be put on the appropriate VLAN, typically a dedicated management VLAN for cloud-bound traffic. Client traffic - When client devices connect to the SSID(s) either when you have a network with multiple VLANs or one VLAN different than the Management VLAN.   Point 1 - If a native VLAN is configured on an upstream 802.1Q trunk port, then ensure the access point's VLAN tag is not the same VLAN ID as the Native VLAN. Specifying the same VLAN ID would tell the access point to tag its management traffic with that VLAN ID, which would likely cause it to be dropped by the upstream trunk port.   Point 2 -  If a VLAN ID is specified, management traffic from the AP will be sent out with an 802.1q tag for that VLAN ID. In this case it is expected that return Management traffic should also be tagged appropriately. VLAN IDs can be configured so that the management interface of a MR gets an IP on a specific VLAN.   Point 3 - If a VLAN ID is NOT specified, management traffic from the AP will be sent out without an 802.1q tag for that VLAN ID. When the VLAN field it's empty, that DOES NOT mean that the AP won't receive an IP address, it means that the switchport native VLAN control what the Management VLAN is. Point 4 - If SSIDs are not tagging specific VLANs, then the Management VLAN will also be used for client traffic.   This error message is for APs - This device is using a DHCP IP address from VLAN instead of using configured VLAN", which is similar for MS switches - https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network_Alerts_and_Notifications/Dashboard_Alerts_-_Configuration_Issues#Device(s)_VLAN_Mismatch   If you have more questions, please don't hesitate to contact us.   ... View more

Hi Aysha,   As the warning/alert is stating "the switch is limited to 1000 VLANs" while you seem to have VLANs 1, 10, 16, 1213, and a range between 1-1000 in your network --> The Catalyst 9300 switches ships with VLANs 1-1000 active. Therefore using VLAN=1213 would not work since it's not in the active VLANs range between 1 - 1000.   There is a new feature called "VLAN Database" which provides a simple way to remove, or prune any VLANs that are not needed from the switch's VLAN database and allows for a single place to configure the entire VLAN range needed in the topology and/or the switches attached to a VLAN Profile. This has historically required additional effort on a switch by switch basis to modify.   This has historically required additional effort on a switch by switch basis to modify. The error that could be observed by this condition is: "Combined count of Allowed VLANs and Native VLAN cannot exceed 1000 VLANs".   This feature is limited to Cloud Managed Catalyst switches only. This feature does NOT effect how MS Classic series switches function.   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/VLAN_Profiles   If you have any further questions, please don't hesitate to contact us. ... View more

Hi @ksumann, Point 1 - As per Meraki documentation  - WAN appliances running MX 16.X+ firmware will use UDP Traceroutes over UDP port  33447 instead of ICMP Traceroutes, when users initiate traceroutes via the traceroute tool. While the Ping Live Tool is initiating a series of ICMP Echo requests to the designated IP.   https://documentation.meraki.com/MX/Monitoring_and_Reporting/Using_the_MX_Live_tools   Therefore, please make sure to check that the firewall rules are allowing ICMP upstream.   Point 2 - These fields control what services are available on the outside interface. When a service is set to "None", the appliance will not respond to requests of that type from the WAN. When it is set to "Any", it will respond to requests of that type from any source on the WAN. To specify certain IPs or IP subnets that the appliance should respond to, enter the IPs and/or CIDR subnets in a comma separated list. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Denying_Inbound_ICMP_on_the_MX   Other useful documentation - https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Ping_Live_Tool   If you have any questions, please don't hesitate to contact us.       ... View more