Dashboard Alerts - Configuration Issues

Triggers

If the current number of routed clients exceeds the maximum routable client limit for the specific switch model. 

Troubleshooting Steps

Refer to MS Switch FAQ for details on the maximum routable clients limit per switch model.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

The device must have 4 unused consecutive VTY slots. These VTY lines will be provisioned and secured for only the dashboard to access the device on these lines.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

SISF-based device tracking is disabled by default. 

Troubleshooting Steps

You can enable it by defining a device tracking policy and attaching the policy to a specific target. Refer to Configure SISF-Based Device Tracking.

---

Triggers

When the “Enable Safe Mode” option is enabled on the local status page.

Troubleshooting Steps

This feature is used to help enable troubleshooting the device and should be turned off when finished.

---

Triggers

The system is currently blocking serving the bad config to this device. Missing required fields for a proper config.

Troubleshooting Steps

Check and validate all required port config fields. 

---

Triggers

Device is running a firmware version that is no longer supported.

Troubleshooting Steps

Update firmware to a supported level.

---

Triggers

When a device’s gateway does not match the majority of other devices on the network.

Troubleshooting Steps

Check and validate gateways settings.

---

Triggers

This is a DFS event and it has detected RADAR in the environment.

Troubleshooting Steps

DFS should hop off the channel and select a non radar sharing channel. You can also manually exclude those channels identified so as not to have an issue in the future.

---

Triggers

These errors will appear as an alert on the device (just like invalid config).

Troubleshooting Steps

The details of the error will indicate which fields were not in the config inventory.

---

Triggers

When Prefix Starvation occurs, which is when the MX detects it does not have enough prefixes from a given WAN or manual configuration to assign a /64 prefix to each IPv6 enabled VLAN.

Troubleshooting Steps

Check and validate IPv6 settings.

---

Triggers

More tunnels have been defined than is recommended for the model.

Troubleshooting Steps

See MX Sizing Guide & Principles to check recommendations.

---

Triggers

Apple MDM certificate needs attention.

Troubleshooting Steps

1. Download Meraki CSR file from Organization > MDM page.
2. Log in to Apple's Push Notification Portal with the same Apple ID used to create the current push certificate.
   Note: If the Apple ID is not known, review "I Forgot Which Apple ID was Originally Used." Not using the original Apple ID (and therefore the original Apple Push certificate) would result in losing management of the previously enrolled devices. 
3. Find the expiring certificate, and select Renew (do not revoke expiring certificate, nor create a new certificate).
4. Upload CSR downloaded as per Step 1.
5. Download renewed certificate from Apple, and upload into Dashboard.
6. Enter/Confirm Apple ID used to log-in to Apple's push notification portal (highly recommended).

---

Triggers

Apple MDM certificate needs attention.

Troubleshooting Steps

1. Download Meraki CSR file from Organization > MDM page.
2. Log in to Apple's Push Notification Portal with the same Apple ID used to create the current push certificate.
   Note: If the Apple ID is not known, review "I Forgot Which Apple ID was Originally Used." Not using the original Apple ID (and therefore the original Apple Push certificate) would result in losing management of the previously enrolled devices. 
3. Find the expiring certificate, and select Renew (do not revoke expiring certificate, nor create a new certificate).
4. Upload CSR downloaded as per Step 1.
5. Download renewed certificate from Apple, and upload into Dashboard.
6. Enter/Confirm Apple ID used to log-in to Apple's push notification portal (highly recommended).

---

Triggers

Apple MDM certificate needs attention.

Troubleshooting Steps

1. Download Meraki CSR file from Organization > MDM page.
2. Log in to Apple's Push Notification Portal with the same Apple ID used to create the current push certificate.
   Note: If the Apple ID is not known, review "I Forgot Which Apple ID was Originally Used." Not using the original Apple ID (and therefore the original Apple Push certificate) would result in losing management of the previously enrolled devices. 
3. Find the expiring certificate, and select Renew (do not revoke expiring certificate, nor create a new certificate).
4. Upload CSR downloaded as per Step 1.
5. Download renewed certificate from Apple, and upload into Dashboard.
6. Enter/Confirm Apple ID used to log-in to Apple's push notification portal (highly recommended).

---

Triggers

During enrollments or re-enrollments, Systems Manager uses a variety of uniquely identifying values from clients to attempt to determine a device's hardware identity for pairing against it's Systems Manager identity. On mobile devices, this is usually the IMEI (International Mobile station Equipment Identity). This alert triggers when a device’s IMEI cannot be detected.

Troubleshooting Steps

It's recommended to contact the manufacturer or reseller of the device, as a missing IMEI will impact the device's ability to connect to the cellular grid. 

---

Triggers

If Dashboard detects a collision of these values for enrolled or enrolling devices, an alert may be displayed with a link to filter the clients list down to those devices which are suspected. These values are important for both SM and other software; on mobile devices, these values can affect the device's ability to connect to the cellular grid. 

Troubleshooting Steps

Refer to Duplicate UUID or IMEI Detected Warnings on Dashboard.

---

Triggers

During enrollments or re-enrollments, Systems Manager uses a variety of uniquely identifying values from clients to attempt to determine a device's hardware identity for pairing against it's Systems Manager identity. On desktop machines, this is usually the BIOS UUID (Universally Unique Identifier). On mobile devices, this is usually the IMEI (International Mobile station Equipment Identity). This alert triggers when a device’s UUID or IMEI cannot be detected.

Troubleshooting Steps

It's recommended to contact the manufacturer or reseller of the device, as a missing IMEI or UUID will impact the device's ability to connect to the cellular grid.  

---

Triggers

If Dashboard detects a collision of these values for enrolled or enrolling devices, an alert may be displayed with a link to filter the clients list down to those devices which are suspected. These values are important for both SM and other software; on mobile devices, these values can affect the device's ability to connect to the cellular grid. 

Troubleshooting Steps

Refer to Duplicate UUID or IMEI Detected Warnings on Dashboard.

---

Triggers

Enrollment authentication is disabled.

Troubleshooting Steps

Refer to SM Enrollment Authentication.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

If dashboard is unable to access the device's cloud console during the initial onboarding process, this may be due to the username, password or enable password provided during onboarding cannot authenticate to the device.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

The device must have 4 unused consecutive VTY slots. These VTY lines will be provisioned and secured for only the dashboard to access the device on these lines.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

The configuration for the device is out of date. 

Troubleshooting Steps

Contact Meraki support for further troubleshooting.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

If dashboard is unable to access the device's cloud console during the initial onboarding process, this may be due to the username, password or enable password provided during onboarding cannot authenticate to the device.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

If dashboard is unable to access the device's cloud console during the initial onboarding process, this may be due to the username, password or enable password provided during onboarding cannot authenticate to the device.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard is unable authenticate SSH with the device using the dashboard provisioned device local meraki-user account.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard is unable to connect to the device's cloud console through the Meraki tunnel, and the Meraki tunnel interfaces are UP.

Troubleshooting Steps

Contact Meraki support for further troubleshooting.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard is unable to access the device via SSH through the Meraki tunnel, and the Meraki tunnel interfaces are UP.

Troubleshooting Steps

Contact Meraki support for further troubleshooting.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard is unable to perform NETCONF operations on the device through the Meraki tunnel, and the Meraki tunnel interfaces are UP.

Troubleshooting Steps

Contact Meraki support for further troubleshooting.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

To complete the onboarding configuration with the cloud console, the username provided during onboarding must have authorization for all the required onboarding configuration commands.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard is unable authorize commands via SSH with the device using the dashboard provisioned device local meraki-user account. AAA settings on the device must permit the meraki-user account to authorize the commands used for onboarding.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

The device must use AAA new-model for device access control. This mode allows the dashboard to securely access the device.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

The following SSH encryption algorithms are supported by the dashboard:

• aes128-gcm@openssh.com
• aes256-gcm@openssh.com
• aes128-ctr
• aes192-ctr
• aes256-ctr 

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard utilizes the HTTP secure server interface to read telemetry data from device. If your HTTP services are restricted by an IPv6 access control list, you must update the ACL to permit access from the Meraki tunnel interface subnet FD0A:9B09:1F7:1::/64.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard must provision the following command on the device in order to set the 4 configured VTY lines to be access able on port 2222.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

During onboarding, dashboard will check the device AAA default authorization method list begins with 'local.'

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

If you have previously added and then removed your device from dashboard and the dashboard provisioned usernames were not removed from the configuration, dashboard will fail to configure these usernames if they already exist in the configuration.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

If you have previously added and then removed your device from dashboard and the dashboard provisioned usernames were not removed from the configuration, dashboard will fail to configure these usernames if they already exist in the configuration.

Troubleshooting Steps

Refer to Troubleshooting Dashboard Connectivity to Catalyst 9800 Wireless Controllers to learn how to remediate this error.

---

Triggers

This is a Cloud Management - Hybrid Mode error.

Dashboard is unable to authorize NETCONF with the device using the dashboard provisioned device local meraki-user account. AAA settings on the device must permit the meraki-user account to authorize. Additional information may be available in the device log (show log). Verify there are no NETCONF aaa authorization conflicts.

Troubleshooting Steps

Contact Meraki support for further troubleshooting.

---

Triggers

The certificate is no longer valid.

Troubleshooting Steps

To renew your Self Signed SCEP CA Certificate, you will simply need to download the CSR file available on the dashboard under Organization > MDM > SCEP CA Certificate Configuration. Once downloaded, you can sign the certificate with your Certificate Authority and re-upload it to the Dashboard. You will see an alert on Dashboard to renew your custom Third Party Signed SCEP cert if it is set to expire soon. 

Refer to MDM Settings.

---

Triggers

The certificate will expire soon.

Troubleshooting Steps

To renew your Self Signed SCEP CA Certificate, you will simply need to download the CSR file available on the dashboard under Organization > MDM > SCEP CA Certificate Configuration. Once downloaded, you can sign the certificate with your Certificate Authority and re-upload it to the Dashboard. 

Refer to MDM Settings.

Triggers

One or more dashboard required IOS XE configurations are missing. Dashboard will provision these configurations when IOS XE hybrid mode switch is added to a network. These configurations are required to allow the dashboard to enable Cloud-Managed Catalyst hybrid mode switches and will need to be re-applied for dashboard management.

Troubleshooting Steps

Update IOS XE with the following configurations based on the missing configuration alert.

• Access Control Lists (ACLs) for Meraki Cloud Access

ip access-list standard MERAKI_MGMT_IP_IN
    20 deny any
ip access-list extended MERAKI_MGMT_IP_OUT
    20 deny tcp any any
ipv6 access-list MERAKI_MGMT_IPV6_IN
    sequence 10 permit tcp FD0A:9B09:1F7:1::/64 FD0A:9B09:1F7:1::/64 eq 2222
    sequence 20 deny tcp any any
ipv6 access-list MERAKI_MGMT_IPV6_OUT
    sequence 20 deny tcp any any

• Configuration change notification and logging for Cloud CLI

archive
 log config
  logging enable
  notify syslog contenttype xml

• Device tracking policy on ports for client tracking

device-tracking policy MERAKI_ACCESS_TRACK
 limit address-count 1000
 security-level glean
 tracking enable
device-tracking policy MERAKI_NO_TRACK
 trusted-port
 security-level glean
 no protocol ndp
 no protocol dhcp6
 no protocol arp
 no protocol dhcp4
device-tracking policy MERAKI_TRUNK_TRACK
 limit address-count 32000
 security-level glean

• EEM policy for Cloud CLI

event manager applet MERAKI_SHOW_RUN_EXEC
 event cli pattern "show running-config" sync yes
 action 1.0 if $_cli_username eq meraki-cli-ro
 action 1.1 cli command enable
 action 1.2 cli command $_cli_msg
 action 1.3 puts $_cli_result
 action 1.4 set _exit_status 0
 action 2.0 else
 action 2.1 set _exit_status 1
 action 3.0 end

• ip flow exporter for client tracking

flow file-export default
 file max-create-interval 5
 file max-count 2
 
flow exporter MERAKI_TA1
 destination local file-export default
 export-protocol ipfix
 option interface-table timeout 300

• ip flow exporter for traffic analysis

flow file-export default
 file max-create-interval 5
 file max-count 2

flow exporter MERAKI_TA2
 destination local file-export default
 export-protocol ipfix
 option interface-table timeout 300

• ip flow monitor for client tracking

flow monitor MERAKI_TA1_V4_IN
 exporter MERAKI_TA1
 cache timeout inactive 300
 cache timeout active 300
 record MERAKI_TA1_V4_IN
                
flow monitor MERAKI_TA1_V4_OUT
 exporter MERAKI_TA1
 cache timeout inactive 300
 cache timeout active 300
 record MERAKI_TA1_V4_OUT

• ip flow monitor for traffic analysis

flow monitor MERAKI_TA2_IPV4
 exporter MERAKI_TA2
 cache timeout inactive 300
 cache timeout active 300
 cache entries 65536
 record MERAKI_TA2_HTTP_SSL_IPV4

• ip flow record for client tracking

flow record MERAKI_TA1_V4_IN
 description meraki_ta1_ingress
 match application name
 match interface input
 match ipv4 source address
 collect counter bytes long
 collect counter packets long
 collect datalink dot1q vlan input
 collect datalink mac source address input
 collect flow direction
        
flow record MERAKI_TA1_V4_OUT
 description meraki_ta1_egress
 match application name
 match interface output
 match ipv4 destination address
 collect counter bytes long
 collect counter packets long
 collect datalink dot1q vlan output
 collect datalink mac destination address output
 collect flow direction

• ip flow record for traffic analysis

flow record MERAKI_TA2_HTTP_SSL_IPV4
 match application name
 match connection client ipv4 address
 match connection server ipv4 address
 match connection server transport port
 match flow observation point
 match ipv4 protocol
 match ipv4 version
 collect connection client counter bytes network long
 collect connection client counter packets long
 collect connection initiator
 collect connection new-connections
 collect connection server counter bytes network long
 collect connection server counter packets long
 collect flow direction
 collect interface input
 collect interface output
 collect timestamp absolute first
 collect timestamp absolute last

• HTTP server configuration

ip http secure-server
 
! Only apply the config when there is not any authentication config for http server
ip http authentication local
 
! Only apply the config when there is HTTP ACL rule for IPV4(The IPV4 rule blocks IPV6 traffic. It is a device bug.)
ip http access-class ipv6 MERAKI_MGMT_IPV6_IN

• device tracking policy on interfaces [xxx, xxx]

interface xxx
 device-tracking attach-policy MERAKI_ACCESS_TRACK

• ip flow monitor on interfaces [xxx, xxx]

interface xxx
 ip flow monitor MERAKI_TA1_V4_IN input
 ip flow monitor MERAKI_TA1_V4_OUT input

• default IPv6 route with distance 2 for Meraki tunnel

ipv6 unicast-routing

• Global LLDP configuration for neighbor information

lldp run

• Telemetry subscription and receiver configurations for event logs

telemetry ietf subscription 10000
 encoding encode-tdl
 filter tdl-uri /services;serviceName=stkm_oper/stack_info
 receiver-type pullmode
 source-vrf Mgmt-vrf
 stream native
 update-policy periodic 6000
 receiver name meraki_stack_info
telemetry ietf subscription 10002
 encoding encode-tdl
 filter tdl-uri /services;serviceName=iosevent/syslog_msg
 receiver-type pullmode
 stream native
 update-policy on-change
 receiver name meraki_syslog_msg
 
telemetry receiver pullmode meraki_stack_info
 size 1000000
telemetry receiver pullmode meraki_syslog_msg
 size 50000000

• Local users (meraki-cli-ro or merakicli-rw) for Cloud CLI

username meraki-cli-ro view MERAKI-MONITOR secret 9 xxx
username meraki-cli-rw privilege 15 view MERAKI-CONFIG secret 9 xxx

ip ssh pubkey-chain
  username meraki-cli-ro
    key-hash {KEY_HASH}
  username meraki-cli-rw
    key-hash {KEY_HASH}

Contact Meraki support if the IP SSH key configuration needs to be configured on your IOS XE device.

parser view MERAKI-CONFIG inclusive
 secret 9 xxx
 commands configure exclude all parser
 commands configure exclude all archive
 commands configure exclude all ntp
 commands configure exclude all timezone
 commands configure exclude all clock
 commands exec exclude all clock
 commands exec exclude all show memory
 commands exec exclude all show tech-support
parser view MERAKI-MONITOR
 secret 9 xxx
 commands exec include traceroute
 commands exec include ping
 commands exec include terminal width
 commands exec include terminal length
 commands exec include terminal
 commands exec exclude all show memory
 commands exec exclude all show tech-support
 commands exec include all show

• Syslog SNMP traps for event logs

logging snmp-trap 0 4
logging history informational
snmp-server enable traps syslog

• SNMP traps for config change notification

Contact Meraki support for this configuration to be re-applied.

• Log level configuration for syslog-events

logging syslog-events informational

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

vMX Incompatible Firmware