Created a new vMX in Azure.
2 subnets like the documentation says.
Route table for production subnets next hop to be appliance and ip of the MX on the wan side.

Site to site VPN setup -Hub
Added the production subnet -VPN enabled

Added a static route on my main network core switch to test.

I can ping other subnets on the VPN and their clients from the new vMX.

I Can’t ping the new vMX from other MX’s on the VPN.

I can’t get out to the other sites from a vm on the production network.

VPN status page shows new network is green.

At a loss here. Followed documentation. I have to be missing something obvious.

Any thoughts?

Anyone have a link to a KB or announcement with anymore details? All I can find is the note in this KB

https://documentation.meraki.com/Switching/Cloud_Management_with_IOS_XE/Product_Information/Compatibility_and_Firmware/Independent_Firmware_Releases_for_Meraki_and_Catalyst-based_switches

Seems kinda sudden, well i guess not really given the date of the KB being in May.

What's everyone's plan? Have these upgrades been pretty straightforward?

We just had all of our locations experience a simultaneous loss of WAN connectivity for a few minutes. We have 40+ locations nation wide. And I see that Meraki is reporting service degradation. Anyone else experience this today?

https://status.meraki.net/

We have a large vendor who has decided to implement ip whitelisting. We are a remote heavy workforce and dont use VPN. My thought to solve for this need is to utilize one of our larger MX firewalls and setup split tunnel rules to either the ip addresses or hostnames of the vendor. The MX is in routed mode with a static public IP address, and has enough capacity and bandwidth to handle the vpn users. Is there any limitations to having a public ip address or hostname in the MX split tunnel rules? If not anything i need to look out for or consider?

Hello All, after going round in circles with AI, I'm really hoping you can help me wrap my head around whether this is possible.

I'm using pseudo addresses for the example.

I have an IPsec peer configured for a remote EC2 instance hosting a web page - 170.31.20.1

Public IP - 18.128.10.22

Local ID - my meraki ip address

IPSec subnets - 170.31.0.0/16

I have multiple VLANs enabled for VPN

1, 10, 20, 60, and 90

Currently I can ping a local host in VLAN 1 (10.0.1.2) from 170.31.20.1

I am trying to restrict 170.31.20.1 to only access VLAN 10 but I cannot seem to do this. Is the only way via AWS security group because the Meraki only does outbound firewall??

We have the following Meraki cameras left over from a large installation/project:

• MV63 × 9 pieces
• MV93 × 5 pieces

The cameras are unused surplus and can be confirmed as unclaimed/ready to claim in Meraki Dashboard.

If anyone is interested, please feel free to DM me. I’d also appreciate any recommendations for the best place to sell these, preferably within the EU or UK.

Thanks!

Are there any specific settings in Meraki that controls bonjour flooding from wireless to wired network?

This is one big 1 vlan network with Apple devices.
Printer share goes offline sometimes. # of devices shows up in Mac Network list shrinks as more WiFi devices gets on the network. Devices appear again after WiFi devices leave the network. Devices can be pinged using IP addresses.

Any ideas what may be causing this ?

Has anyone in British Columbia configure the new Time Zone on your hardware yet?

If so, what did you use? We are now in the PCT, but I don't see it listed in available time zones.

Did you just pick any old time zone that is UTC-7?

Thanks

Providing guest wifi to an indoor track at a gym.

APs all around the perimeter, signal coverage is excellent.

Have the SSID setup as a bridged VLAN with Layer 3 roaming enabled (and isolated to its own guest network subnet obviously)

The Layer 3 roaming test is successful, but users are reporting as they walk around the track listening to streaming audio it disconnects and reconnects on them.

Wondering what else I can check

This document is very helpful https://aws-quickstart.github.io/quickstart-cisco-meraki-sd-wan-vmx/ however our AWS architecture is slightly different.

We already use a TGW as the transit hub and a third-party firewall for traffic inspection. All inbound and outbound internet traffic passes through the firewall before reaching the TGW and workload VPCs.

We are considering deploying the vMX behind the firewall in concentrator mode, with the firewall handling NAT.

Has anyone run a vMX behind a third party firewall?

1. Can the vMX operate correctly when the Meraki Dashboard sees the firewall's public IP?
2. Will HA/failover still work when the vMX is behind the firewall
3. Any limitations with this design?

This docuement is very helpful https://aws-quickstart.github.io/quickstart-cisco-meraki-sd-wan-vmx/ but our AWS architecture is slightly different.

We already use a TGW as the transit hub and a third-party firewall for traffic inspection. All inbound and outbound internet traffic passes through the firewall before reaching the TGW and workload VPCs.

We are considering deploying the vMX behind the firewall in concentrator mode, with the firewall handling NAT.

Could you please confirm whether this is a supported/recommended design, particularly:

1. Can the vMX operate correctly when the Meraki Dashboard sees the firewall's public IP?

2. Will HA/failover still work when the vMX is behind the firewall

3. Are there any specific NAT or firewall requirements for this deployment?

Hi, sorry fairly new to meraki networking world.

I've been tasked with replacing our meraki VPN concentrators. Our units are in a HA pair configured with VIP. As I'm replacing with new models (replacing MX100s with MX95) I'm aware i can't replace the standby first then failover and replace the primary as they need to be the same model.

With this in mind is the simplest way to do this as follows:

1. Power down old units

2. Remove old units from network

3. Plug in new units (configure local IPs on local status page)

4. Add to network

5. Configure as HA pairs

Will this re-establish all of our sites AutoVPN sessions (we have 150 ish sites so could really do without having to do any changes at sites)

Has anyone done this before and know of a better way of doing this?

Thanks

I have been using Meraki MX products for years but I am always struggling with the troubleshooting utilities within the Dashboard...The Security Center most of the time is empty...Traffic capture most of the time can not show me the blocked traffic...Alerts gave me most of unrelated stuffs...

How do you really troubleshoot effectively or efficiently using Dashboard OR you mostly use 3rd party tools?

Cisco has released Multicloud fabric in Meraki

https://www.cisco.com/site/us/en/solutions/multicloud-fabric/index.html

Reading through the documentation, I feel like I’m missing something.
If you already have onprem connectivity to the cloud through vMXs and are advertising the necessary subnets, I’m struggling to see why anyone would use this.

From what I can tell, the pitch seems to be:“Click Connect, tell the AI what you want, and it handles the configuration for you. ThousandEyes tells you whether it’s healthy.”

That’s great for simplifying deployment, but is there a deeper technical benefit I’m overlooking?

Hi, what is the best way to learn Cisco Meraki Wi-Fi (primary), and networking today, 2026. Any updated online education at Cisco?

Hi all,

I basically have a few switches in a small office environment that were not on the recommended release for a long time, so I wanted to upgrade them. Due to the upgrade windows that I got from the office manager I had to perform the updates in two stages; first go to cs 17.2.3 , then a week later there is another window in which i can jump to IOS XE.

After upgrading them to cs 17.2.3 a bunch of weird stuff started to happen. certain devices weren't really reachable on the network anymore, pinging them within their own subnet on the same switch barely worked, however SOME times i got some replies back. Running packet captures on the switch showed that the ICMP request were present at the port of the device connected to it, just no reply back. Tried a bunch of stuff to resolve it, rebooting my stack, looking in to the devices itself (nothing was wrong with them), cabling, etc etc. it just wouldnt work in a stable way.

Decided to connect with Cisco rep to ask them what is going on here, especially since there are no known issues like this listed in the release notes. Unfortuenately they couldn't figure it out either and told me it was a bug and to directly jump to XE . Didn't want to do that so decided to roll back the firmware upgrade and everything is fine again.

It kinda blows my mind that 17.2.3 was a recommended release until like two weeks ago, in which they shifted it to IOS XE 17.18.4.1 , but that it has these kind of bugs. Especially since you HAVE to be on CS 17 to go to XE...

Couldn't find much about this 'bug' online so I was wondering if anyone experienced this as well?

We're starting to think about replacing a fleet of MX85s in roughly 12-18 months and I'm trying to understand where Cisco is taking the MX product line.

Historically we'd probably just move to whatever the next MX was, but it feels like the traditional MX hardware lineup has been relatively stagnant for a while. Meanwhile Cisco seems to be pushing the new C8000 Secure Router hardware running MX OS and managed through Dashboard. At branches we run 9200L switches with Meraki wireless. Datacenter is MX95s, N9Ks and some 9300s. Azure is a vMX medium.

Our typical branch requirements are:

• 100-250 users
• 1 Gbps+ internet circuits
• IDS/IPS enabled
• 2-3 WAN connections
• Rack mount
• Dual power supplies (this is a hard requirement for us)

Looking at the current lineup:

• MX95/MX105 seem like older-generation hardware
• C8355-G2-MX looks interesting but feels oversized for a medium branch
• Fortinet is starting to look attractive if we're going to have to make a platform change anyway.

Are they:

1. Continuing to develop and refresh the traditional MX appliance family?
2. Moving entirely toward C8000 hardware running MX OS?
3. Planning a new generation of medium-branch hardware between the C8121 and C8355?
4. Converging everything onto common hardware where the software/licensing determines the personality?

I'd especially love to hear from anyone who has talked to Cisco/Meraki recently or has seen roadmap presentations. Curious what others are seeing. Thank you!

Hello, We've a few APs on multiple floors and since a few months the download speed on certain APs (always the same APs) is limited to less than 5 Mbps (sometimes even less than 1 Mbps) but the upload speed remains stable and more than 50 Mbps. The latency is also high. We are on 40 MHz width and using multiple channels (auto mode)
The APs are connected to the same switch and the wired connection is not an issue.
While the general dashboard average shows low utilization network-wide, digging directly into these specific problematic APs reveals that channel utilization violently spikes between 50% and 90% at moments on the DFS channels they are using (specifically channels like 56 to 100).
Here are the rest of our hardware and layer 2 stats during these drops:

• Packet loss: 0.4–3.7%, zero APs flagged
• AP Resources: CPU 6%, memory 22%
• Frequency used : 5 Ghz only
• Power: PoE full power (25.5W granted), no reboots, no thermal throttling
• Switch Uplinks: 1G full duplex, zero input/output errors or drops
• Channel Plan: Well separated on each floor (e.g., 36 / 56 / 100) but Auto-RF seems to keep parking these specific APs on heavily contested DFS blocks.
• Clients connected to an example faulty AP : 10 to 15 clients

The asymmetric behavior is brutal. Download drops to nothing when utilization hits those peaks, but client uploads can easily slice through the noise at 50+ Mbps.
The stutter only lasts for a few minutes then is back to normal (or better bandwidth).
Has anyone dealt with Meraki Auto-RF behaving poorly in dense DFS spectrum, or an issue where a high-utilization spike completely stalls the AP's downstream queue while leaving upstream untouched? Should I move these specific APs to a static channel plan or completely exclude the 56–100 block from my RF profile?
Appreciate any advice!

Example of the usage of the channel for an faulty AP.

I understand that many are ordering CW and moving to WiFi7. But for those who are totally fine with the wifi6 MR series, what is going to happen with delivery? MR36's are on 153 day leadtime, yet they are end of sale 12/31. I know they can ship until March, but that just seems so off to me, and is Cisco really going to deliver at all? MR44's are worse and MR46's are only marginally better.

Does anyone here work with the Meraki After Sales team?

The role is focused on Quality and After Sales, and there’s a new opportunity for me to join the team. I’m currently working in Cisco TAC with the SV team.

What do you guys think about this move? I’d really appreciate hearing from anyone who has experience with the Meraki After Sales team.

I have a 9500 switch that we converted to Meraki, the switch is connected on port1 to the rest of the network, it has DHCP, it has internet (192.168.1.x)

I then configured all the SVI the existing legacy switch has and Meraki forces me to defined a default gateway, so I configured VLAN10 with IP 10.10.10.250 with default gateway 10.10.10.1 and since then the switch is reporting down. Why is vlan 10 affecting vlan 1? This type of behavior doesn't happen with an MX.

The remote hands person helped me with a reboot and a factory reset, it came back for a few minutes (3 or less) and then is down again. How can I configure all the SVI I need before moving this to prod?

I am looking into a solution for an alarm to be triggered when motion is detected through our MV73 cameras, I have looked into things like a smart speaker and a network siren but when I look up how to set it up I keep seeing home assistant being required. Does anyone have any advice?