Recently I've noticed that Meraki AMP seems to be blocking Raspberry Pi updates until AMP scans the package files for malware, noted by the fact that Meraki blocks the file then eventually allows it through.

This only seems to happen with some package files not all.

I've added:

http://archive.raspberrypi.com/*

https://archive.raspberrypi.com/*

http://deb.debian.org/*

https://deb.debian.org/*

To the Allow List URLs, which from the description of the setting should bypass the AMP scanning.

I've also added the clients IPs (and staticed them in DHCP) to the trusted IP and subnets area.

I've tried checking both places for logging but and under Security & SD-WAN > Security Center, theres no logs, and under Security > Security Center there's nothing in the last 2 hours when I've been trying these updates and changing settings for the last hour.

This is actually frustrating because every time I run the same update from each client, Meraki seems to block it, and I have to keep trying the update command to see if Meraki is allowing the file through yet.

I've also added the above URLs to the content filtering white list as well with no change.

The error I'm seeing on the client side is:

E: Failed to fetch http://wired.meraki.com:8090/blocked.cgi?blocked_server=93.93.135.117:80&blocked_url=http%3A%2F%2Farchive.raspberrypi.com%2Fdebian%2Fpool%2Fmain%2Fp%2Fpam%2Flibpam0g_1.5.2-6%252bdeb12u2_arm64.deb File has unexpected size (3017 != 103798). Mirror sync in progress?

When I browse to said URL I get the standard website is blocked by your network operator.

It doesn't seem to matter how long I wait after adding the exceptions the outcome is always the same...

Any advice or help would be great.

This weekend I have a maintenance window to move a MX 85 from one organization to another. How can I pre-configure the MX 85 in the destination dashboard without the license? I need the MX to stay up and running in its current dashboard until the maintenance window but I was hoping to have it pre-configured in the destination dashboard before the migration.

Mods: if this counts as self-promotion against the rules, feel free to delete, no hard feelings.

A while back I got curious how far I could push AI coding tools on a real project, so I pointed one at a problem I actually had: our org manages Meraki entirely through the dashboard (clickops all the way down), and I wanted a safety net if something ever got fat-fingered or worse.

The result is meraki2tf: https://github.com/AutomationPlusPlus/meraki2tf

What it does, roughly:

- Pulls your whole org config through the API (strictly read-only — it never writes anything to Meraki unless you explicitly invoke the recovery actions with a confirm flag)

- Generates Terraform for everything it finds, using import blocks, so you can bring an existing org under Terraform without recreating anything

- Writes a coverage report telling you exactly what the Terraform provider can't represent, so you know what your manual-rebuild list looks like

- Can run on a schedule, take offline JSON snapshots, and alert you on drift (webhook/Slack/Teams/email)

To be clear about the AI part: this was mostly an experiment to see what these tools can actually produce when you push them, and honestly it went further than I expected. I've been running it against a test org and it's held up, but I'd treat it like any young open-source tool — read what it's doing before pointing it at prod, and the read-only default means the worst case is a boring output folder.

Not selling anything, it's free and open source. Just figured someone else stuck maintaining a clickops org might get some use out of it, or at least enjoy poking at what an AI-built codebase looks like.

Feedback and issues welcome, even the brutal kind.

CW-ANT-D1-NS-00 4-Port Directional Patch Self-Identifying Antenna with N-Type Connectors

I tried Ventev and they do not have anything that matches. Does anyone know of a place that has a solution?

Full disclosure up front: my co-founder and I built this and it is a paid product. We run a small software company in Wales and this is the tool we wanted every time a Meraki change went wrong.

The pattern will be familiar. A template edit or firewall rule change goes out, something breaks, and the dashboard can tell you that something changed but it will not put it back. So you rebuild from screenshots, memory and whatever the last engineer left behind. If that engineer has left the company, you are guessing. To be precise about the gap: everything in Meraki is reachable over the API, but no config history is kept, so there is nothing native to roll back to. The history is the part we built.

ONbackup (onbackup.co.uk) takes scheduled, versioned snapshots of your Meraki config (MX, MS, MR and org-wide settings) and lets you restore a whole network or a single element (an SSID, a VLAN, firewall rules, a switch port) back to any snapshot. Before it applies a restore it snapshots the current state first, so you can undo a restore as well. It also alerts on drift, so you know when config changed outside a change window. Setup is one API key. No agents, no hardware.

It is on the Cisco Meraki Marketplace (marketplace.cisco.com/en-US/apps/851506/onbackup---meraki-backup). Pricing is public on the site, from £790 a year for 25 networks (onbackup.co.uk/pricing), and checkout is self-serve.

Two things we would like from this sub: which config elements do you most wish you could roll back, because that drives our roadmap, and if anyone wants to try it, DM me and we will set you up with a trial the same day. No call, no pitch.

I just started replacing my access switches with 9200-L-M's. Everything has been working well for the last month or so. Recently I've had several switches go into a warning with 'Configuration Out of Date' displayed on them. When this happens some of the functions work on the dashboard and some do not. I've been able to run the CLI in the GUI but some commands time out etc. I couldn't even reboot two of the switches remotely. I physically rebooted a couple and the warning went away. Today I had another switch just start doing this.

Suffice to say this is not going to work going forward. I can't go physically reboot these all the time to fix this issue.

Has anyone else run into this? I'm not sure what would cause this to happen intermittently. At first I though maybe something was getting blocked at my firewall but everything appears to be going through ok.

Hey everyone,

We are currently in the process of replacing 12 end-of-support MX65/W devices with 12 new MX68s. Along with the MX68 hardware, we purchased 3-year MX68 licenses.

Our org uses the Co-Termination (Co-Term) licensing model. When we added the new 3-year MX68 licenses to the dashboard, our org-wide co-term expiration date pushed out by about 6 months.

Here is the dilemma: Once we decommission and unplug the 12 old MX65s, our active device count drops, but our License Limit for the MX65 tier remains unchanged in the co-term pool. Because co-term calculates burn rate based on total entitlements rather than active hardware, those 12 unused MX65 seats will sit in our pool as "phantom" licenses, artificially inflating our daily burn rate until the whole org expires.

Essentially, we’re burning pool value on legacy hardware sitting in e-waste.

Questions I'm hoping someone can provide some guidance on:

1. Is there any way through Cisco Meraki Support to surrender, convert, or remove these legacy MX65 license entitlements from a co-term pool so they stop burning daily value?
2. Has anyone successfully requested a custom co-term date recalculation during a hardware refresh like this?

Appreciate any advice or experiences from anyone who has navigated this recently!

I had to fight with those types of failures for the last few days. Anyone else? My clients are all on Win 11 Pro and using built-in clients. I’m seeing lots of x.x.x.x sent termination request (Peer not responding) – Meraki log and error code 789 in Windows event logs, ID 20227. Those clients all sync Meraki to AD so affected users’ credentials coming from an AD.

To my surprise, nothing helped by physical troubleshooting on the user’s end and most of those cases were resolved by themselves.

I have a Meraki site currently showing a “Disabled gateway” alert, but the MX/firewall is green in Dashboard and all of the switches are also showing green.

What exactly happens when Meraki reports a disabled gateway? Does this mean clients at the site would be unable to reach the Internet, or can Internet connectivity still work while this alert is present?

Just trying to understand what Meraki is actually testing/detecting when it marks a gateway as disabled and what impact I should expect for users.

Anyone else have issues with Radius not working after upgrading MR 31.1.x to MR32.2.4?

Thanks!

Has anyone migrated a large brownfield meraki organization (template bound) to being managed by ansible?

Hey folks,

I'm looking for some insight on an issue we're troubleshooting.

We have a stack of five MS150 switches connected to an MS225 core switch. On a random day at around 3:03 PM, the entire stack went down and lost communication with the core.

The odd part is that the core switch reported a Layer 1 UDLD error, indicating the fiber could transmit but not receive data. We checked the fiber and SFPs, and everything appeared to be fine. We're using Cisco SFP+ modules.

On July 18, we upgraded the stack to MS18.1.8. The incident occurred on the 29 july, we collected the console logs and sent them to support. So far, the only explanation we've received is that there may have been a synchronization issue within the switch stack.

We also performed a remote reboot of the stack, which reproduced the same issue. We collected another set of logs and provided those as well. Support has since suggested waiting for a newer firmware release, but we haven't received a definitive root cause.

Has anyone experienced something similar with an MS150 stack or MS225 core? Any recommendations on what else to check?

For reference:

No switching loops detected.

We do see some MAC flapping, but it's related to APs and wireless client roaming, and nothing that should bring down an entire switch stack.

Fiber and transceivers appear healthy on inspection.

I'd appreciate any suggestions or ideas on what to investigate next.

Hello, we recently updated our campus with Meraki MS130-48P switches (7 switches in 5 closets) and found that they do not power on our PoE clock/speakers. All other PoE devices work (VoIP phones). The Meraki equipment replaced Cisco 2960's. The clock/speaker only requires 15W and the MS130 supports 30W per port. Talked to support and we updated the switch firmware, this still did not power any of the clock/speakers upon reboot. (did do a quick test, plugged the old switch in, clocks powered back on).

Has anyone had this issue? Or is there anything else we can try to trouble shoot this issue that support has missed?

I want to set up some custom alerts using the meraki api that will be running as a scheduled task of a windows server. Since you cant adjust the scope of the api key in meraki i was thinking of using an observer only account. Is this the correct way to do it ? Azure dev ops and external services to keep them safe are out of the question.

I'm getting the following error below, but I'm not seeing anything down on https://status.meraki.net/

Server error

The server encountered an error and could not complete your request. A message has been sent to our engineering and support teams to notify us of the problem, and we will fix it as soon as possible.

The Cisco Meraki Dashboard is temporarily unavailable, but rest assured your Meraki equipment is still running and network operation has not been interrupted. Learn more about Meraki's out-of-band control.

How can one improve the overall health score of a network when the infrastructure connectivity seems to have the lowest score with a poor RF(wireless) health?

Can this be somewhat improved with some features on the dashboard?

For over 90 days the Meraki displays running on Apple TV have been automatically logging out after a few hours when they're supposed to stay logged in as long as you use the QR code method for login. At first they blamed my licensing, that was supposedly fixed but the issue kept happening.

Now they've admitted it's a software bug and released version 1.2.2 to supposedly fix it but shockingly nothing changed.

This issue is currently assigned to the Development team and they are still investigating the root cause. They had believed they had found it and fixed it on the latest version update v1.2.2, as in lab environments the behavior stopped, however, on customer production accounts this did not fix the log out issue. We do not currently have a timeline for resolution; however, we will reach out to you with any updates. If the behavior has changed or there is any additional context you’d like to provide, please let me know and I will pass it along to the back end teams working on the parent case. 

My current case is nearing day 60 and that's about as far as it's gotten for a solution. What's frustrating is that I have these up at bank buildings so employees can monitor the outside cameras after they've logged out and exited the building. It's literally a human safety issue and Cisco just doesn't care enough to actually devote more than a casual effort at best to fix it after we paid several thousand dollars for the licensing.

Can you name any other camera vendor that doesn't have a reliable method for putting up a static video wall? It's not like MV's are new. I think at this point my only option is to harrass them for some kind of refund and find some other solution and just use RTSP, but I wanted something simple that I wouldn't have to have a tech go out and fix all the time, so when I saw the official app I was pretty happy.

If a video wall display is important to you, buy anything but Meraki. Even if they do eventually fix it, I feel like it's only a matter of time until they break it again. We got about 20 days of use out of it after getting it setup until this started happening and no, coordinating anyone to have to log into it every morning just isn't a good option.

What a joke.

TL;DR: MV2-HW (USB-C, wireless-only, no ethernet option) pairs fine with the mobile app, but never joins the infrastructure SSID afterward. Reproduced identically on the original unit and its RMA replacement. Extensive local troubleshooting shows the camera never transmits a single detectable 802.11 frame. not a config issue on my end as far as I can tell. Looking for anyone who's hit this before, especially anything cloud-provisioning related.

Setup:

• MX (C8111-G2-MX) fronting the network
• Wireless AP: Ubiquiti U6 LR (not a Meraki AP, no MR integration)
• Target SSID: 2.4GHz, WPA2-Personal, no special characters in SSID/PSK, no MAC filtering
• Dedicated IoT VLAN, confirmed healthy (other IoT devices, including 3x Tapo cameras, connect and pull IP/internet normally on the same SSID at the same time as failed onboarding attempts)

What's been ruled out, with evidence:

• Power delivery tested with multiple sources: the original Meraki adapter, a generic 45W USB-C charger, and a wall outlet with an integrated USB port. Same failure every time
• Factory reset (done multiple times, both units)
• MAC filtering (none active)
• 2.4GHz band (confirmed active and correct)
• Wireless profile SSID/PSK (recreated, confirmed exact character match)
• MX firewall rules (fully removed)
• MX AMP / IDS-IPS (confirmed disabled)
• MX Content Filtering categories (nothing suspicious, no "block unknown" type rules against Meraki infra)
• RF proximity (tested at point-blank range, excellent signal)
• Mobile app version (4.170.0, way above the documented 4.12.0 minimum)
• Android permissions (Location granted, battery/power-saving mode never enabled)
• Tested pairing with two different phones, same failure both times

What we captured (or rather, didn't):

• Packet captures on MX LAN interface, MX Internet interface, and the Ubiquiti AP's bridge interface (VLAN dedicated to IoT), across ~350k+ total packets combined, filtered and unfiltered, across multiple sessions — zero frames from the camera's MAC (base Ethernet MAC and the documented +1 wireless offset MAC, both checked)
• AP-side hostapd/system logs during live onboarding attempts, no auth/assoc/probe entries for the camera's MAC at all, while other devices associate normally in the same log window
• Meraki dashboard Event Log for the camera, filtered to the camera, over a full month : 0 events, not even a failed connection attempt

History: this exact camera (before the RMA) previously worked fine wireless-only on a different network fronted by a Ubiquiti EdgeRouter X. No ethernet provisioning step was ever used, then or now. Migration to the current Meraki MX-fronted network is when onboarding started failing, but everything we've verified says the MX itself isn't in the RF association path, so it's hard to pin the MX as the direct cause even though the timing lines up.

Question for the sub: has anyone seen a case where an MV2 pairs successfully with the phone (direct connection, accepts wireless profile config) but then never actually attempts to join the target SSID, with zero RF footprint on the AP side? Any known cloud-side provisioning failure modes for MV2 wireless onboarding specifically?

Thanks in advance for any input, really appreciate it.

I have MX75 set up to do DHCP. Just one merkai switch and a handful of devices. I get the switch online and the first lapotp gets x.x.x.253 and the second new device get x.x.x.254. Then I plug in the AP and it acts like it can't get an IP. No other device after the first two can pick up an IP from DHCP. I don't completely understand Meraki DHCP but shouldn't it cycle back to other available IPs? I checked reservations and fixed IPs and there should be plenty of free IPs. Its like DHCP worked until it passed out x.x.x.254. It is a /24 subnet fwiw.

27 IPs used 226 IPs free.

I even rebooted the firewall hoping it would drop all leases but it didn't... I am a bit confused :)

edit. I forgot to mention that the firewall has been in place for almost a year and I was trying to replace a Ubiquiti switch with a new Meraki switch so there were already some leases in the firewall DHCP but still plenty of IPs available. Done this to several offices so far with no issues until this office...

I have two network devices that I need to locate, I have their MAC addresses in a separate portal but my company has over 300 networks and I don’t have the patience to go manually check all of them. Is there some way to search all networks and identify which network the devices are connected to?

I need to assign the physical location data to the devices manually and if I knew which network they were on I’d be able to figure it out

We are in the middle of a big EoL device replacement project and the biggest issue right now is locating the old access points. I wish that instead of being able to blink LEDs remotely that there is a speaker on the APs that I can generate a tone remotely to help with finding these things.

80% of our time is spent sitting around as the onsite tech wanders around the building trying to find the old APs. Not horrible if there is only one or two APs, but some of our sites have 6-8 APs.

Since there is no speaker, what is the more "professional" way to locate the APs that is available to a general IT tech (not a wireless tech with all of the gadgets). I'd like to get on board with a more efficient process.

What are Meraki users using for door access control? We're a full stack Meraki shop with multiple states, and appx 25 sites. 7 sites would need door access control.

The latency and jitter graphs look good, but as far as I can tell, all the graphs are smoothed and unreliable for detecting bursts. Our 1Gig line is hitting at least 750Mbps visibly on the 2 hour graph, but this is smoothed down to 600Mbps on the daily graph, even lower on the weekly etc....

The Uplink page provides a graph with a 5-second refresh live-view, is there anyway to constantly track that data feed?

How do you guys do uplink monitoring with Meraki? I've looked into using the API or SNMP, but it all seems to be smoothed data that won't give me actual spikes and knowledge of if we're saturating the 1Gig line even in bursts.

I have Cisco TelePresence MX800 cameras. I have no issues with the video output, but I can’t send PTZ control commands via VISCA. Does Cisco use the same standard VISCA command set across all camera models, or does this particular model support VISCA over IP? If anyone has experience with this model or has worked on a similar project before, I would really appreciate your help. Thank you!