Automated Logins and Users on Cloud-Managed Switches Running Cloud-Native IOS XE

Customers may observe automated logins in the event logs of their Cloud-Managed Catalyst switches running cloud-native IOS XE 17.15.1 firmware or later, found in both the switch logs accessible via the Show CLI and the dashboard event logs. 

These logins are part of automated processes, namely executing Netconf (Network Configuration Protocol) operations and retrieving telemetry or monitoring data from the switch. Understanding these users and their functions can help in differentiating between legitimate automated activity and potential security concerns.

• Meraki_user is used to execute automated operations on the switch and may appear in the logs when operations such as ping tests, cable tests, or other such tasks are executed.

• Meraki_tdl is another account used to collect telemetry or monitoring data such as PoE, uplink, or port status, and port traffic data.

The presence of Meraki_user and Meraki_tdl logins is normal operation and expected. These logins facilitate secure network management and monitoring.

If you have further questions or concerns, please contact Meraki support for additional information.