Hybrid Campus LAN Design Guide (CVD)

Catalyst onboarding for Cloud Monitoring (C9200/9300/9500)

For ease of management, Customers onboard Cisco C9200/9300/9500 switches/stacks for Cloud Monitoring such that they can be available in the Meraki Dashboard in Monitor only mode. This process enables dashboard monitoring on these switches/stacks and selected configuration parameters will be visible in the Meraki Dashboard. 

Overview

This design option allows for flexibility in terms of VLAN and IP addressing across the Campus LAN such that the same VLAN can span across multiple access switches/stacks thanks to Spanning Tree that will ensure that you have a loop-free topology. However, this method of convergence is considered non-deterministic since the path of execution isn't fully determined (unlike Layer 3 routing protocols for example). As a result, convergence can be slow and STP must be tuned to provide best results. 

This design is based on consistent STP protocols running in this Hybrid Campus, as such Multiple Spanning Tree Protocol (MST, aka 802.1s) will be configured since it is supported on both the Meraki and Catalyst platforms. 

You should consider this option if you need a consistent VLAN assignment across all switching closets. Here are some things to consider about this design option: 

Pros:

• Flexibility in your VLAN design
• Facilitates Wireless Roaming across the whole campus
• Easier to deploy and consistent configuration across the entire Campus LAN

Cons: 

• Non-deterministic route failover
• Slow convergence
• STP can be tricky given that the Hybrid Campus LAN consists of different switching platforms

 Since MST will be used as a loop prevention mechanism, all SVIs will be created on the collapsed core layer.

Logical Architecture 

The following diagram shows the logical architecture for a STP based convergence Campus LAN Design with hybrid components:

Physical Architecture

The following diagram shows the physical architecture and port list for this design:

Assumptions

The following assumptions has been taken into account:

• It is assumed that Wireless roaming is required everywhere in the Campus 
• It is assumed that VLANs are spanning across multiple zones/closets  
• Corporate SSID (Broadcast in all zones/areas) users are assigned VLAN 10 on all APs. CoA VLAN is VLAN 30 (Via Cisco ISE) 
• BYOD SSID (Broadcast in all zones/areas) users are assigned VLAN 20 on all APs. CoA VLAN is VLAN 30 (Via Cisco ISE)
• Guest SSID (Broadcast in all zones/areas) users are assigned VLAN 30 on all APs
• IoT SSID (Broadcast in all zones/areas) users are assigned VLAN 40 on all APs
• Access Switches will be running in Layer 2 mode (No SVIs or DHCP)
• MS390 Access Switches physically stacked together
• Converted C9300 Access Switches physically stacked together
• C9500 Core Switches with Stackwise-virtual stacking using SVLs
• Access Switch uplinks are in trunk mode with native VLAN = VLAN 1 (Management VLAN*) 
• STP root is at Distribution/Collapsed-core
• Distribution/Collapsed-core uplinks are in Trunk mode with Native VLAN = VLAN 1 (Management VLAN) 
• All VLAN SVIs are hosted on the core layer 
• Network devices will be assigned fixed IPs from the management VLAN DHCP pool. Default Gateway is 10.0.1.1

Network Segments

Please check the following table for more information about the network segments (e.g. VLANs, SVIs, etc) for this design:

Quality of Service

Device List

Access Policies

Port List

Wireless SSID List

Group Policies

Configuration and Implementation Guidelines

1. Login to your dashboard account (or create an account if you don't have one)
2. Navigate to Organization > Configure > Inventory
3. For Co-term license model, click on Claim. And for PDL, please click on Add
4. Enter the order and/or serial number(s) to claim the devices into your account. For PDL, click Next then please choose to add them to Inventory (Do not add them to a network)
5. Create a Dashboard Network; Navigate to Organization > Configure > Create network to create a network for your Campus LAN (Or use an existing network if you already have one). If you are creating a new network, please choose "Combined" as this will facilitate a single topology diagram for your Campus LAN. Choose a name (e.g. Campus) and then click Create network
   • 
6. Dashboard Network Settings; Navigate to Network-wide > Configure > General and choose the settings for your network (e.g. Timezone, Traffic Analytics, firmware upgrade day/time, etc)
   • 
7. Schedule Firmware Upgrade; Navigate to Organization > Monitor > Firmware upgrades to select the firmware settings for your devices such that devices upgrade once they connect to dashboard. Select the device type then click on Schedule upgrade
8. Add Devices to a Dashboard Network; Navigate to Organization > Configure > Inventory:
   • For Co-term licensing model, select the MS390 and C9300 switches and the Primary WAN Edge then click on Add then choose the Network Campus
   • For PDL licensing model, select the MS390 and C9300 switches and the Primary WAN Edge then click on Change network assignment and then choose the Network Campus
   • Please DO NOT add the Secondary WAN Edge device at this stage
9. Rename MX Security Appliance; Navigate to Security & SD-WAN > Monitor > Appliance status then click on the edit button to rename the MX to Primary WAN Edge then click on Save
   • 
10. MX Connectivity; Plug in your WAN uplink(s) on the Primary WAN Edge MX then power it on and wait for it to come online on dashboard. This might take a few minutes as the MX will download its firmware and configuration. Navigate to Security & SD-WAN > Monitor > Appliance status and verify that the MX has come online and that its firmware and configuration is up to date.
11. Rename Access Switches; Navigate to Switching > Monitor > Switches then click on each MS390 and C9300 switch and then click on the edit button on top of the page to rename it per the above table then click on Save such that all your switches have their designated names
    • 
12. Rename MR APs; Navigate to Wireless > Monitor > Access points then click on each AP and then click on the edit button on top of the page to rename it per the above table then click on Save such that all your APs have their designated names
13. MR AP Tags; Navigate to Wireless > Monitor >Access points then click on each AP and then click on the edit button next to TAGS to add Tags to your AP per the above table then click on Save such that all your APs have their designated tags
    • 
14. MX Addressing & VLANs; Navigate to Security & SD-WAN > Configure > Addressing & VLANs, and in the Deployment Settings menu select Routed mode. Further down the page on the Routing menu, click on VLANs then click on Add VLAN to add your management VLAN then click on Create. Then for the per-port VLAN settings, select your downlink ports (19 and 20) and click on Edit and configure them as access with VLAN 1 and click on Update. Finally, click on Save at the bottom of the page.
    • 
15. Campus LAN Static Routes; Create Static Routes for your Campus network by navigating further down the page to Static routes then click on Add Static Route. Start by adding your Corporate LAN subnet then click on Update and then add static routes to all other subnets (e.g. BYOD, Guest and IoT). Finally, click on Save at the bottom of the page. (The Next hop IP that you have used here will be used to create a fixed assignment for the Core Stack later in DHCP settings)
    • 
16. Optional - If you are accessing any resources over Meraki SD-WAN, please navigate to Security & SD-WAN > Configure > Site-to-site VPN and enable VPN based on your topology and traffic flow requirements. (In this case we will configure this Campus as Spoke with Split Tunneling) 
    • Choose Type: Spoke then click on Add a hub and select your hub site where you need access to resources via VPN. You can also add multiple hubs for resiliency. To choose Split Tunneling, please leave the box next to the Hub unticked as shown below. 
    • Under VPN Settings, choose which subnet to be Enabled in VPN (e.g. Management VLAN will be required for Radius authentication purposes as the MR/MS390/C9300 devices will reach out to Cisco ISE using their management IP). Any Subnet that needs to access resources via VPN must be Enabled otherwise keep it as Disabled.
    • 
    • Finally, click on Save at the bottom of the page
    • On the Hub site, please make sure to advertise the subnets that are required to be reachable via VPN. Navigate to Security & SD-WAN > Configure > Site-to-site VPN then add a local network then click Save at the bottom of the page (Please make sure that you are configuring this on the Hub's dashboard network) 
17. Optional - Verify that your VPN has come up by selecting your Campus LAN dashboard network from the Top-Left Network drop down list and then navigate to Security & SD-WAN > Monitor >VPN status then check the status of your VPN peers. Next, navigate to Security & SD-WAN > Monitor > Route table and check the status of your remote subnets that are reachable via VPN. You can also verify connectivity by pinging a remote subnet (e.g. 172.31.16.32 which is Cisco ISE) by navigating to Security & SD-WAN > Monitor > Appliance status then click on Tools and ping the specified IP address (Please note that the MX will choose the highest IP participating in VPN by default as the source)

    Please note that in order to ping a remote subnet, you must either have BGP enabled or have static routes at the far-end pointing back to the Campus LAN local subnets.

    In this example, the VPC in AWS has been configured with a Route Entry to route 10.0.1.0/24 via the vMX deployed in AWS that has a VPN tunnel back to the Campus LAN site.

    

    If the remote VPN peer (e.g. AWS) is configured in Routed mode, the static route is not required since traffic will always be NAT'd to a local reachable IP address. 

18. SD-WAN & Traffic Shaping Configuration; To configure Traffic Shaping settings for your Campus LAN site. Navigate to Security & SD-WAN > Configure > SD-WAN & Traffic Shaping to configure your preferred settings. For the purpose of this CVD, the default traffic shaping rules will be used to mark traffic with a DSCP tag without policing egress traffic (except for traffic marked with DSCP 46) or applying any traffic limits. (Please adjust these settings based on your requirements such as traffic limits or priority queue values. For more information about traffic shaping settings on the MX devices, please refer to the following article)
    • 
19. Optional - Configure Threat Protection (Requires Advanced License or above) for your Campus LAN site. Navigate to Security & SD-WAN > Configure > Threat Protection and choose the settings that meet your site requirements. Please see the following configuration example: 
20. Click on Save at the bottom of the page
21. Optional - Configure Content Filtering Settings (Requires Advanced License or above) for your Campus LAN site. Navigate to Security & SD-WAN > Configure > Content filtering and choose the settings that meet your site requirements. Please see the following configuration example: 
22. Click on Save at the bottom of the page
23. Core Switch Uplinks; On the Catalyst 9500 core switches, Connect their uplinks to the Primary WAN Edge MX and power them both on.
24. Core Switch Network Access; Connect to first C9500 switch via console and configure it with the following commands:

    • Switch>en
      Switch#conf t
      Enter configuration commands, one per line.  End with CNTL/Z.
      Switch(config)#hostname 9500-01
      9500-01(config)#ip domain name meraki-cvd.local
      9500-01(config)#cdp run
      9500-01(config)#lldp run
      9500-01(config)#stackwise 
      Please reload the switch for Stackwise Virtual configuration to take effect
      Upon reboot, the config will be part of running config but not part of start up config.
      9500-01(config-stackwise-virtual)#domain 1
      9500-01(config)#exit
      9500-01(config)#interface Twe1/0/1
      9500-01(config-if)#switchport mode access
      9500-01(config-if)#switchport access vlan 1
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface Twe1/0/2
      9500-01(config-if)#switchport mode access
      9500-01(config-if)#switchport access vlan 1
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 1
      9500-01(config-if)#ip address dhcp 
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#
      9500-01#sh ip int brief
      Interface              IP-Address      OK? Method Status                Protocol
      Vlan1                  10.0.1.110      YES DHCP   up                    up      
      GigabitEthernet0/0     unassigned      YES NVRAM  down                  down    
      TwentyFiveGigE1/0/1    unassigned      YES unset  up                    up      
      TwentyFiveGigE1/0/2    unassigned      YES unset  up                    up 
      9500-01#ping 8.8.8.8
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/5 ms
      9500-01#ping cisco.com
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 72.163.4.185, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 109/109/109 ms
      9500-01#switch 1 renumber 1
      9500-01#switch priority 5
      9500-01#wr mem
      Building configuration...
      [OK]
      

25. Core Switch Network Access; Connect to the second C9500 switch via console and configure it with the following commands:

    • Switch>en
      Switch#conf t
      Enter configuration commands, one per line.  End with CNTL/Z.
      Switch(config)#hostname 9500-02
      9500-02(config)#ip domain name meraki-cvd.local
      9500-01(config)#cdp run
      9500-01(config)#lldp run
      9500-02(config)#stackwise 
      Please reload the switch for Stackwise Virtual configuration to take effect
      Upon reboot, the config will be part of running config but not part of start up config.
      9500-02(config-stackwise-virtual)#domain 1
      9500-02(config)#exit
      9500-02(config)#interface Twe1/0/1
      9500-01(config-if)#switchport mode access
      9500-02(config-if)#switchport access vlan 1
      9500-02(config-if)#no shut
      9500-02(config-if)#exit
      9500-02(config)#interface Twe1/0/2
      9500-01(config-if)#switchport mode access
      9500-02(config-if)#switchport access vlan 1
      9500-02(config-if)#no shut
      9500-02(config-if)#exit
      9500-02(config)#interface vlan 1
      9500-02(config-if)#ip address dhcp 
      9500-02(config-if)#no shut
      9500-02(config-if)#end
      9500-02#
      9500-02#sh ip int brief
      Interface              IP-Address      OK? Method Status                Protocol
      Vlan1                  10.0.1.111      YES DHCP   up                    up      
      GigabitEthernet0/0     unassigned      YES NVRAM  down                  down    
      TwentyFiveGigE1/0/1    unassigned      YES unset  up                    up      
      TwentyFiveGigE1/0/2    unassigned      YES unset  up                    up
      9500-02#ping 8.8.8.8
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/5 ms
      9500-02#ping cisco.com
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 72.163.4.185, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 109/109/109 ms
      9500-02#switch 1 renumber 2
      9500-02#switch priority 1
      9500-02#wr mem
      Building configuration...
      [OK]

26. SVL Configuration; Now that both C9500 switches have access to the network, proceed to configure the Stackwise Virtual Links per the port list provided above (In this case with using two ports as part of the SVL providing a total stacking bandwidth of 80 Gbps) 

    • 9500-01(config)#interface HundredGigE1/0/25
      9500-01(config-if)#stackwise-virtual link 1
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface HundredGigE1/0/26
      9500-01(config-if)#stackwise-virtual link 1
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#reload
      Proceed with reload? [confirm]
      

    • 9500-02(config)#interface HundredGigE1/0/25
      9500-02(config-if)#stackwise-virtual link 1
      9500-02(config-if)#no shut
      9500-02(config-if)#exit
      9500-02(config)#interface HundredGigE1/0/26
      9500-02(config-if)#stackwise-virtual link 1
      9500-02(config-if)#no shut
      9500-02(config-if)#end
      9500-02#wr mem
      Building configuration...
      [OK]
      9500-02#reload
      Proceed with reload? [confirm]
      

27. Connect Stacking Cables; Whilst the C9500 switches are reloading, connect the stacking cables on both switches
28. Verify Stackwise Configuration; Please wait for about 10 minutes for the switches to come back up and initialize the stack. Then, connect to the 9500-01 (Primary Stack ) via console to verify that the stack is operational. The stackwise-virtual link should be U (Up) and R (Ready).  

    • 9500-01#show stackwise-virtual
      Stackwise Virtual Configuration:
      --------------------------------
      Stackwise Virtual : Enabled
      Domain Number : 1  
      
      
      Switch Stackwise Virtual Link Ports
      ------ ---------------------- ------
      1      1                      HundredGigE1/0/25           
                                    HundredGigE1/0/26           
      2      1                      HundredGigE2/0/25           
                                    HundredGigE2/0/26           
      
      
      9500-01#
      9500-01#show stackwise-virtual link
      Stackwise Virtual Link(SVL) Information:
      ----------------------------------------
      Flags:
      ------
      Link Status
      -----------
      U-Up D-Down
      Protocol Status
      ---------------
      S-Suspended P-Pending E-Error T-Timeout R-Ready
      -----------------------------------------------
      Switch SVL Ports                    Link-Status Protocol-Status
      ------ --- -----                    ----------- ---------------
      1      1   HundredGigE1/0/25        U           R              
                 HundredGigE1/0/26        U           R              
      2      1   HundredGigE2/0/25        U           R              
                 HundredGigE2/0/26        U           R              
      
      
      9500-01#
      9500-01#show stackwise-virtual bandwidth
      Switch Bandwidth
      ------ ---------
      1       80G
      2       80G
      
      
      9500-01#
      9500-01#sh switch
      Switch/Stack Mac Address : b0c5.3c60.fba0 - Local Mac Address
      Mac persistency wait time: Indefinite
                                                   H/W   Current
      Switch#   Role    Mac Address     Priority Version  State
      -------------------------------------------------------------------------------------
      *1       Active   b0c5.3c60.fba0     5      V02     Ready                               
      2        Standby  40b5.c111.01e0     1      V02     Ready                               
      
      
      
      
      
      
      9500-01#
      

29. Optional - Attach and configure stackwise-virtual dual-active-detection; DAD is a feature used to avoid a dual-active situation within a stack of switches. It will rely on a direct attachment link between the two switches to send hello packets and determine if the active switch is responding or not. Please note that DAD cannot be applied to any SVL links and has to be a dedicated interface. For the purpose of this CVD, interface HundredGigE1/0/27 and HundredGigE2/0/27 will be used for enabling DAD between the two C9500 switches. 

    • 9500-01#configure terminal
      9500-01(config)#interface HundredGigE1/0/27
      9500-01(config-if)#stackwise-virtual dual-active-detection
      WARNING: All the extraneous configurations will be removed for HundredGigE1/0/27 on reboot.
      INFO: Upon reboot, the config will be part of running config but not part of start up config.
      9500-01(config-if)#interface HundredGigE2/0/27
      9500-01(config-if)#stackwise-virtual dual-active-detection
      WARNING: All the extraneous configurations will be removed for HundredGigE1/0/27 on reboot.
      INFO: Upon reboot, the config will be part of running config but not part of start up config.
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#reload
      Reload command is being issued on Active unit, this will reload the whole stack
      Proceed with reload? [confirm]Connection to 10.0.1.2 closed by remote host.
      Connection to 10.0.1.2 closed.
      >>
      9500-01#sh stackwise-virtual dual-active-detection
      In dual-active recovery mode: No
      Recovery Reload: Enabled
      
      
      Dual-Active-Detection Configuration:
      -------------------------------------
      Switch Dad port Status
      ------ ------------ ---------
      1 HundredGigE1/0/27         up     
      2 HundredGigE2/0/27         up     
      
      
      9500-01#
      

30. Configure Multiple Spanning Tree Protocol (802.1s). Connect to the 9500-01 (Primary Stack) via console and use the following commands:

    • 9500-01(config)#spanning-tree mst configuration
      9500-01(config-mst)#instance 0 vlan 1
      9500-01(config-mst)#name region1
      9500-01(config-mst)#revision 1
      9500-01(config-mst)#exit
      9500-01(config)#spanning-tree mode mst
      9500-01(config)#spanning-tree mst 0 priority 4096
      9500-01(config)#exit
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

31. Verify Spanning Tree Configuration (Please note that interface Twe2/0/1 will be in STP blocking state due to the fact that both uplinks are connected to the same MX edge device at this stage)

    • 9500-01#show spanning-tree
      
      
      MST0
        Spanning tree enabled protocol mstp
        Root ID    Priority    4096
                   Address     b0c5.3c60.fba0
                   This bridge is the root
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
        Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
                   Address     b0c5.3c60.fba0
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
      Interface           Role Sts Cost      Prio.Nbr Type
      ------------------- ---- --- --------- -------- --------------------------------
      Twe1/0/1            Desg FWD 2000      128.193  P2p
      Twe2/0/1            Back BLK 2000      128.385  P2p
      
      
      
      9500-01#

32. Configure STP Root Guard and UDLD on the Core Stack Downlinks:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#int Twe1/0/23
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#int Twe1/0/24
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#int Twe2/0/23            
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#int Twe2/0/24            
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

33. Optional - STP Hygiene; It is recommended to configure STP Root Guard on all C9500 Core Stack downlinks to avoid any new introduced downstream switches from claiming root bridge status:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#define interface-range stp-protect TwentyFiveGigE1/0/3 - 22
      9500-01(config)#interface range macro stp-protect
      9500-01(config-if-range)#spanning-tree guard root
      9500-01(config-if-range)#exit
      9500-01(config)#define interface-range stp-protect2 TwentyFiveGigE2/0/3 - 22
      9500-01(config)#interface range macro stp-protect2
      9500-01(config-if-range)#spanning-tree guard root
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#

34. Optional - STP Hygiene; It is recommended to configure STP Loop Guard on all C9500 Core Stack un-used stacking links:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#interface HundredGigE1/0/27
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if-range)#exit
      9500-01(config)#interface HundredGigE1/0/28
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if)#exit
      9500-01(config)#interface HundredGigE2/0/27
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if-range)#exit
      9500-01(config)#interface HundredGigE2/0/28
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#

35. Configure SVIs for your Campus LAN on the Core Stack:

    • 9500-01(config)#interface vlan 10
      9500-01(config-if)#ip address 10.0.10.1 255.255.255.0
      9500-01(config-if)#no shut
      9500-01(config-if)#interface vlan 20                  
      9500-01(config-if)#ip address 10.0.20.1 255.255.255.0
      9500-01(config-if)#no shut                            
      9500-01(config-if)#interface vlan 30                  
      9500-01(config-if)#ip address 10.0.30.1 255.255.255.0
      9500-01(config-if)#no shut                            
      9500-01(config-if)#interface vlan 40                  
      9500-01(config-if)#ip address 10.0.40.1 255.255.255.0
      9500-01(config-if)#no shut                            
      9500-01(config-if)#exit
      9500-01(config)#ip dhcp pool vlan10 
      9500-01(dhcp-config)#network 10.0.10.0 /24
      9500-01(dhcp-config)#default-router 10.0.10.1
      9500-01(dhcp-config)#dns-server 208.67.222.222 208.67.220.220
      9500-01(dhcp-config)#ip dhcp pool vlan20
      9500-01(dhcp-config)#network 10.0.20.0 /24
      9500-01(dhcp-config)#default-router 10.0.20.1                
      9500-01(dhcp-config)#dns-server 208.67.222.222 208.67.220.220
      9500-01(dhcp-config)#ip dhcp pool vlan30                     
      9500-01(dhcp-config)#network 10.0.30.0 /24
      9500-01(dhcp-config)#default-router 10.0.30.1                
      9500-01(dhcp-config)#dns-server 208.67.222.222 208.67.220.220
      9500-01(dhcp-config)#ip dhcp pool vlan40                     
      9500-01(dhcp-config)#network 10.0.40.0 /24
      9500-01(dhcp-config)#default-router 10.0.40.1                
      9500-01(dhcp-config)#dns-server 208.67.222.222 208.67.220.220
      9500-01(dhcp-config)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

36. Verify your DHCP pool configuration

    • 9500-01#sh ip dhcp pool
      
      
      Pool vlan10 :
      Utilization mark (high/low)    : 100 / 0
      Subnet size (first/next)       : 0 / 0
      Total addresses                : 254
      Leased addresses               : 0
      Excluded addresses             : 0
      Pending event                  : none
      1 subnet is currently in the pool :
      Current index        IP address range                    Leased/Excluded/Total
      10.0.10.1            10.0.10.1        - 10.0.10.254       0     / 0     / 254  
      
      
      Pool vlan20 :
      Utilization mark (high/low)    : 100 / 0
      Subnet size (first/next)       : 0 / 0
      Total addresses                : 254
      Leased addresses               : 0
      Excluded addresses             : 0
      Pending event                  : none
      1 subnet is currently in the pool :
      Current index        IP address range                    Leased/Excluded/Total
      10.0.20.1            10.0.20.1        - 10.0.20.254       0     / 0     / 254  
      
      
      Pool vlan30 :
      Utilization mark (high/low)    : 100 / 0
      Subnet size (first/next)       : 0 / 0
      Total addresses                : 254
      Leased addresses               : 0
      Excluded addresses             : 0
      Pending event                  : none
      1 subnet is currently in the pool :
      Current index        IP address range                    Leased/Excluded/Total
      10.0.30.1            10.0.30.1        - 10.0.30.254       0     / 0     / 254  
      
      
      Pool vlan40 :
      Utilization mark (high/low)    : 100 / 0
      Subnet size (first/next)       : 0 / 0
      Total addresses                : 254
      Leased addresses               : 0
      Excluded addresses             : 0
      Pending event                  : none
      1 subnet is currently in the pool :
      Current index        IP address range                    Leased/Excluded/Total
      10.0.40.1            10.0.40.1        - 10.0.40.254       0     / 0     / 254  
      9500-01#

37. Verify your SVI configuration

    • 9500-01#sh ip int brief | in Vlan
      Vlan1                  10.0.1.113      YES DHCP   up                    up      
      Vlan10                 10.0.10.1       YES manual down                  down    
      Vlan20                 10.0.20.1       YES manual down                  down    
      Vlan30                 10.0.30.1       YES manual down                  down    
      Vlan40                 10.0.40.1       YES manual down                  down    
      9500-01#

38. Configure Layer 2 Switchports,  SGTs and CST (Cisco TrustSec) on your Core Stack interfaces. (Please note that enforcement has been disabled on downlink ports allowing it to happen downstream)

    • 9500-01#conf t
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#cts sgt 2
      9500-01(config)#cts role-based enforcement vlan-list 1,10,20,30,40
      9500-01(config)#ip access-list role-based Allow_All
      9500-01(config-rb-acl)#permit ip
      9500-01(config-rb-acl)#exit
      9500-01(config)#cts role-based permissions default Allow_All
      9500-01(config)#interface TwentyFiveGigE1/0/23
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 1
      9500-01(config-if)#switchport trunk allowed vlan 1,10,20,30,40
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01(config)#interface TwentyFiveGigE1/0/24
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 1
      9500-01(config-if)#switchport trunk allowed vlan 1,10,20,30,40
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01(config)#interface TwentyFiveGigE2/0/23
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 1
      9500-01(config-if)#switchport trunk allowed vlan 1,10,20,30,40
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01(config)#interface TwentyFiveGigE2/0/24
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 1
      9500-01(config-if)#switchport trunk allowed vlan 1,10,20,30,40
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

39. Spare WAN Edge Connectivity; Follow these steps to create warm-spare with two MX appliances: (Please note that this might result in a brief interruption of packet forwarding on the MX Appliance) 
    • Navigate to Security & SD-WAN > Monitor > Appliance status and click on Configure warm spare
    • 
    • Now click on Enabled then choose the Spare MX from the drop-down menu and then choose the Uplink IP option that suits your requirements (Please note that choosing Virtual IPs requires an additional IP address on the upstream network and a single broadcast domain between the two MXs) then click on Update
    • 
    • Now click on Spare to access the Appliance status page of your Spare MX and click on the Edit button to rename the spare unit (e.g. Secondary WAN Edge)
    • 
    • 
    • Then configure the following on your C9500 Core Stack:

    • 9500-01#configure terminal
      9500-01(config)#interface Twe1/0/2
      9500-01(config-if)#switchport mode access
      9500-01(config-if)#switchport access vlan 1
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface Twe2/0/2
      9500-01(config-if)#switchport mode access
      9500-01(config-if)#switchport access vlan 1
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]

    • Then connect the Spare MX downlinks to your C9500 Core Stack (e.g. Spare MX port 19 to Twe1/0/2 and port 20 to Twe2/0/2)
    • Then connect the Spare MX with it's uplinks (This must match the uplink configuration on your Primary WAN Edge)
    • Power on the Spare MX and wait for it to come online on dashboard
    • 
    • 
    • 
    • You can also verify that your C9500 Core Stack interfaces to the Spare MX are up, and that the redundant uplinks are in STP BLK mode

    • 9500-01#sh ip interface brief
      Interface              IP-Address      OK? Method Status                Protocol       
      TwentyFiveGigE1/0/2    unassigned      YES unset  up                    up      
      TwentyFiveGigE2/0/2    unassigned      YES unset  up                    up 
      9500-01#
      9500-01#show spanning-tree
      
      
      MST0
        Spanning tree enabled protocol mstp
        Root ID    Priority    4096
                   Address     b0c5.3c60.fba0
                   This bridge is the root
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
        Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
                   Address     b0c5.3c60.fba0
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
      Interface           Role Sts Cost      Prio.Nbr Type
      ------------------- ---- --- --------- -------- --------------------------------
      Twe1/0/1            Desg FWD 2000      128.193  P2p
      Twe1/0/2            Desg FWD 2000      128.194  P2p
      Twe2/0/1            Back BLK 2000      128.385  P2p
      Twe2/0/2            Back BLK 2000      128.386  P2p
      
      
      
      
      9500-01#
      

40. Access Policy configuration; When you're logged in dashboard, Navigate to Switching > Configure > Access policies to configure Access Policies as required for your Campus LAN. Please see the following example for two Access Policies; 802.1x & MAB:
    • 
    • 
41. Adaptive Policy Configuration; Configure Adaptive Policy for your Campus LAN. When you're logged in dashboard, Navigate to Organization > Configure > Adaptive Policy then click on the Groups tab on the top. There should be two groups (Unknown, Infrastructure) that are already available. Click on Add group to add each group required for your Campus LAN. You need to fill in the Name, the SGT value, and a description then click on Review changes then click on Submit. Please see the following examples:
    • 
42. Adaptive Policy Configuration; Configure Adaptive Policy for your Campus LAN. When you're logged in dashboard, Navigate to Organization > Configure > Adaptive Policy then click on the Policies tab on the top. The source groups are on the left side, and the destination groups are on the right side. Select a source group from the left side then select all destination groups on the right side that should be allowed then click on Allow and click on Save at the bottom of the page. Next, Select a source group from the left side then select all destination groups on the right side that should be denied (i.e. Blocked) then click on Deny and click on Save at the bottom of the page. After creating the policy for that specific source group, the allowed destination groups will be displayed with a Green tab and the denied destination groups will be displayed with a Red tab. Repeat this step for all policies required for all Groups (Allow and Deny) 
    • 
43. Access Switch Ports Configuration; Configure Uplink Ports on your Access Switches. When you're logged in dashboard, Navigate to Switching > Monitor > Switch Ports, then select your uplink ports and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard): 
44. Optional - For ease of management, it is recommended that you rename the ports connecting to your Core switches with the actual switch name / Connecting port as shown below.
45. Access Switch Ports Configuration; Configure Wired Client Ports (802.1x) on your Access Switches. Navigate to or Refresh Switching > Monitor > Switch Ports, then select your Wired Client ports (5-8) and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard):
46. Access Switch Ports Configuration; Configure Wired Client Ports (MAB) on your Access Switches. Navigate to or Refresh Switching > Monitor > Switch Ports, then select your Wired Client ports (9-12) and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard):
47. Access Switch Ports Configuration; Configure MR Ports on your Access Switches. Navigate to or Refresh Switching > Monitor > Switch Ports, then select your ports connecting to MR Access Points (13-16) and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard):
48. Optional - Access Switch Ports Configuration; Configure unused ports on your Access Switches such that they are disabled and mapped to an unrouted VLAN (e.g. VLAN 999). Navigate to Switching > Configure > Switch Ports and filter for any unused ports (e.g. 17-24) and configure them as shown below: 
    •  
49. Rename Wireless SSIDs; To configure your SSIDs per the above table, first navigate to Wireless > Configure > SSIDs then rename the SSIDs per your requirements (Refer to the above table for guidance) 
    • SSID#1 (First column, aka vap:0, enabled by default): Click on rename and change it to Acme Corp
    • SSID#2 (Second column, aka vap:1): Click on rename and change it to Acme BYOD, then click on the top drop-down menu to enable it
    • SSID#3 (Third column, aka vap:2): Click on rename and change it to Guest, then click on the top drop-down menu to enable it
    • SSID#4 (Fourth column, aka vap:3): Click on rename and change it to Acme IoT, then click on the top drop-down menu to enable it
    • Click Save at the bottom of the page
50. Configure Access Control for Acme Corp; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Acme Corp:
    • 
    • 
    • 
    • 
    • Click Save at the bottom of the page
    •  
    • Please Note: Adaptive Policy Group feature is not currently available in the New Version of the Access. You will need to click on View old version  which is available at the top right corner of the page to be able to access this and configure the Adaptive Policy Group (10: Corp). Then, please click Save at the bottom of the page
51. Configure Access Control for Acme BYOD; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Acme BYOD:
    • 
    • Click on which is available on the top right corner of the page, then choose the Adaptive Policy Group 20: BYOD and then click on Save at the bottom of the page.
    • 
52. Configure Access Control for Guest; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Guest:
    • 
    • Click on at the top right corner of the page then choose the Adaptive Policy Group 30: Guest then click on Save at the bottom of the page
    • 
53. Configure Access Control for Acme IoT; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Acme IoT:
    • 
    • Click on at the top right corner of the page then choose the Adaptive Policy Group 40: IoT then click on Save at the bottom of the page
    • 
54. Enabling Stacking on your MS390 and C9300 Switches in Meraki Dashboard; Please follow these steps
    1. Connect a single uplink to each switch (e.g. Port 1 on MS390-01 to Port TwentyFiveGigE1/0/23 on C9500)
    2. Make sure all stacking cables are unplugged from all switches
    3. Power up all switches
    4. Verify that your C9500 Stack downlinks are up and not shutdown

       • 9500-01#sh ip interface brief      
         Interface              IP-Address      OK? Method Status                Protocol  
         TwentyFiveGigE1/0/23   unassigned      YES unset  up                    up      
         TwentyFiveGigE1/0/24   unassigned      YES unset  up                    up          
         TwentyFiveGigE2/0/23   unassigned      YES unset  up                    up      
         TwentyFiveGigE2/0/24   unassigned      YES unset  up                    up      
         9500-01#

    5. Wait for them to come online on dashboard. Navigate to Switching > Monitor > Switches and check the status of your Access Switches
       • 
    6. After they come online and download their configuration and firmware (Up to date) you can proceed to the next step. You can see their Configuration status and Firmware version from Switching > Monitor > Switches 
    7. Enable stacking in dashboard by Navigating to Switching > Monitor > Switch stacks then click on add one
       • 
    8. Then give your stack a name and select it's members and click on Create 
       • 
    9. Now click on Add a stack to create all other stacks in your Campus LAN access layer by repeating the above steps
       • 
    10. Power off all access switches
    11. Disconnect all uplink cables from all switches
    12. Nominate your Primary switch for each stack (e.g. MS390-01 for stack1 and C9300-01 for stack2) 
    13. On the Primary switches, plug the uplink again
    14. Plug stacking cables on all switches in each stack to form a ring topology and make sure that the Cisco logo is upright
    15. Power on your Primary switches first, then power other stack members
    16. Wait for the stack to come online on dashboard. To check the status of your stack, Navigate to Switching > Monitor > Switch stacks and then click on each stack to verify that all members are online and that stacking cables show as connected
        • 
    17. Plug uplinks on all other non-primary members and verify that the uplink is online in dashboard by navigating to Switching > Monitor > Switch stacks and then click on each stack to verify that all uplinks are showing as connected however they should be in STP discarding mode
        • 
    18. Configure the same Static IP for all members in each stack by navigating to Switching > Monitor > Switches then click on the primary switch (e.g. MS390-01 for Stack1) and under LAN IP menu copy the IP address then click on the edit button to specify the Static IP address information (You can use the same IP address that was assigned using DHCP) then click Save. The same Static IP address information should now be copied for all members of the same stack. You can verify this by navigating to Switch > Monitor > Switches (Tip: Click on the configure button on the right hand side of the table to add Local IP information display)
        • 
        • 
        • 
        • 
        • 
    19. Finally, configure etherchannels on both your Access Switch Stacks and your Core Switch Stacks so that all uplinks can be operational (STP forwarding mode) at the same time. Follow these steps:
        • First, disconnect the downlinks to non-primary switches from your C9500 Core Stack (e.g. Port TwentyFiveGigE2/0/23 and TwentyFiveGigE2/0/24)
        • Navigate to Switching > Monitor > Switch ports and search for uplink then select all uplinks in the same stack (in case you have tagged your ports otherwise search for them manually and select them all) then click on Aggregate. Please note that all port members of the same Ether Channel must have the same configuration otherwise Dashboard will not allow you to click the aggergate button.
          • 
          • 
          • 
          • 
          • 
          • Please repeat above steps for all stacks in your network
          • Please note that the above step will cause all members within the stack to go offline in Dashboard
        • On your C9500 Core Stack, please configure etherchannel Settings for your downlinks such that each Stack downlinks should be in a separate Port-channel and that the mode is active:

        • 9500-01#configure terminal
          Enter configuration commands, one per line.  End with CNTL/Z.
          9500-01(config)#interface TwentyFiveGigE1/0/23
          9500-01(config-if)#channel-group 1 mode active
          Creating a port-channel interface Port-channel 1
          
          
          9500-01(config-if)#
          9500-01(config-if)#interface TwentyFiveGigE2/0/23
          9500-01(config-if)#channel-group 1 mode active
          9500-01(config-if)#interface TwentyFiveGigE1/0/24
          9500-01(config-if)#channel-group 2 mode active
          Creating a port-channel interface Port-channel 2
          
          
          9500-01(config-if)#interface TwentyFiveGigE2/0/24   
          9500-01(config-if)#channel-group 2 mode active
          9500-01(config-if)#end
          9500-01#
          9500-01#show etherchannel 1 port-channel
          Port-channels in the group:
          ---------------------------
          
          
          Port-channel: Po1    (Primary Aggregator)
          
          
          ------------
          
          
          Age of the Port-channel   = 0d:01h:42m:43s
          Logical slot/port   = 9/1          Number of ports = 2
          HotStandBy port = null
          Port state          = Port-channel Ag-Inuse
          Protocol            =   LACP
          Port security       = Disabled
          Fast-switchover     = disabled
          Fast-switchover Dampening = disabled
          
          
          Ports in the Port-channel:
          
          
          Index   Load   Port        EC state        No of bits
          ------+------+------+------------------+-----------
            0     00     Twe1/0/23      Active             0
            0     00     Twe2/0/23      Active             0
          
          
          Time since last port bundled:    0d:01h:40m:21s     Twe2/0/23
          
          
          9500-01#
          9500-01#show etherchannel 2 port-channel
          Port-channels in the group:
          ---------------------------
          
          
          Port-channel: Po2    (Primary Aggregator)
          
          
          ------------
          
          
          Age of the Port-channel   = 0d:01h:43m:56s
          Logical slot/port   = 9/2          Number of ports = 2
          HotStandBy port = null
          Port state          = Port-channel Ag-Inuse
          Protocol            =   LACP
          Port security       = Disabled
          Fast-switchover     = disabled
          Fast-switchover Dampening = disabled
          
          
          Ports in the Port-channel:
          
          
          Index   Load   Port        EC state        No of bits
          ------+------+------+------------------+-----------
            0     00     Twe1/0/24      Active             0
            0     00     Twe2/0/24      Active             0
          
          
          Time since last port bundled:    0d:01h:42m:04s     Twe2/0/24
          
          
          9500-01#9500-01#wr mem
          Building configuration...
          
          [OK]
          9500-01#
          

        • Plug all uplinks to non-primary switches
        • Now all your switches should come back online on Dashboard
          • 
        • And now all your uplinks from each stack should be in STP Forwarding mode, which you can verify on Dashboard by navigating to Switching > Monitor > Switch stacks and checking the uplink port status. Also you can check that on your C9500 Core Stack:
          • 
          • 

          • 9500-01#show spanning-tree interface port-channel 1
            
            
            Mst Instance        Role Sts Cost      Prio.Nbr Type
            ------------------- ---- --- --------- -------- --------------------------------
            MST0                Desg FWD 10000     128.2089 P2p
            9500-01#show spanning-tree interface port-channel 2
            
            
            Mst Instance        Role Sts Cost      Prio.Nbr Type
            ------------------- ---- --- --------- -------- --------------------------------
            MST0                Desg FWD 1000      128.2090 P2p 
            9500-01#show spanning-tree         
            
            
            MST0
              Spanning tree enabled protocol mstp
              Root ID    Priority    4096
                         Address     b0c5.3c60.fba0
                         This bridge is the root
                         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
            
            
              Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
                         Address     b0c5.3c60.fba0
                         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
            
            
            Interface           Role Sts Cost      Prio.Nbr Type
            ------------------- ---- --- --------- -------- --------------------------------
            Twe1/0/1            Desg FWD 2000      128.193  P2p
            Twe1/0/2            Desg FWD 2000      128.194  P2p
            Twe2/0/1            Back BLK 2000      128.385  P2p
            Twe2/0/2            Back BLK 2000      128.386  P2p
            Po1                 Desg FWD 10000     128.2089 P2p
            Po2                 Desg FWD 1000      128.2090 P2p
            
            
            
            
            9500-01#
            

55. Configure Multiple Spanning Tree Protocol (802.1s)  in Dashboard for MS390 and C9300 switches; Navigate to Switching > Configure > Switch settings and select your stack and choose the appropriate STP priority per stack (61440 for all Access Switch Stacks) then click Save at the bottom of the page
    • 
    • Verify that the Access Stacks are seeing the C9500 Core Stack as the root by navigating to Switching > Monitor > Switches then click on any switch and under the RSTP root menu check the root bridge information
56. Configure Dynamic ARP Inspection (DAI) on your C9500 Core Switches; All Downlinks to Access Switches and Uplinks to MX Edge must be configured as Trusted and all other interfaces as Untrusted: (Please note that the order of commands is important to avoid loss of connectivity)

    • 9500-01#show cdp neighbors
      Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                        S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                        D - Remote, C - CVTA, M - Two-port Mac Relay
      
      
      Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
      a4b4395f2a80     Twe 1/0/24        124               S    C9300-24U Port C9300-NM-8X/1
      2c3f0b0fec00     Twe 2/0/23        174               S    MS390-24  Port 1
      2c3f0b047e80     Twe 1/0/23        159               S    MS390-24U Port 1
      4ce175b0ba00     Twe 2/0/24        177               S    C9300-24U Port C9300-NM-8X/1
      
      
      Total cdp entries displayed : 4
      9500-01#configure terminal
      9500-01(config)#interface TwentyFiveGigE1/0/1
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface TwentyFiveGigE1/0/2
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface TwentyFiveGigE2/0/1
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface TwentyFiveGigE2/0/2
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface Po1
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface Po2
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#ip arp inspection vlan 1,10,20,30,40
      9500-01(config)#ip dhcp snooping vlan 1,10,20,30,40
      9500-01(config)#end
      9500-01#show ip dhcp snooping
      Switch DHCP snooping is enabled
      Switch DHCP gleaning is disabled
      DHCP snooping is configured on following VLANs:
      1,10,20,30,40
      DHCP snooping is operational on following VLANs:
      1,10,20,30,40
      DHCP snooping is configured on the following L3 Interfaces:
      
      
      Insertion of option 82 is enabled
         circuit-id default format: vlan-mod-port
         remote-id: b0c5.3c60.fba0 (MAC)
      Option 82 on untrusted port is not allowed
      Verification of hwaddr field is enabled
      Verification of giaddr field is enabled
      DHCP snooping trust/rate is configured on the following Interfaces:
      
      
      Interface                  Trusted    Allow option    Rate limit (pps)
      -----------------------    -------    ------------    ----------------
      TwentyFiveGigE1/0/1              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE1/0/2              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE1/0/23             yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE1/0/24             yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/1              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/2              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/23             yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/24             yes        yes             unlimited
        Custom circuit-ids:
      Port-channel1                    yes        yes             unlimited
        Custom circuit-ids:
      Port-channel2                    yes        yes             unlimited
        Custom circuit-ids:   
      9500-01#
      9500-01#show ip arp inspection
      
      
      Source Mac Validation      : Disabled
      Destination Mac Validation : Disabled
      IP Address Validation      : Disabled
      
      
      Vlan     Configuration    Operation   ACL Match          Static ACL
      ----     -------------    ---------   ---------          ----------
          1     Enabled          Active                         
         10     Enabled          Active                         
         20     Enabled          Active                         
         30     Enabled          Active                         
         40     Enabled          Active                         
      
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

57. Configure Dynamic Arp Inspection (DAI) on your Access Switch Stacks; Navigate to Switching > Monitor > DHCP Servers & ARP and scroll down to Dynamic ARP Inspection and enable it then click Save at the bottom of the page:
    • 
58. Setting up your Access Points; Connect your APs to the respective ports on the Access Switches (e.g. Ports 13-16) and wait for them to come online on dashboard and download their firmware and configuration files. To check the status of your APs navigate to Wireless > Monitor > Access points and check the status, configuration and firmware of your APs.
    • 
59. Re-addressing your Network Devices; In this step, you will adjust your IP addressing configuration to align with your network design. This step could have been done earlier in the process however it will be easier to adjust after all your network devices have come online since the MX (The DHCP server for Management VLAN 1) has kept a record of the actual MAC addresses of all DHCP clients. Follow these steps to re-assign the desired IP addresses: (Please note that this will cause disruption to your network connectivity) 
    1. Navigate to Organization > Monitor > Overview then click on Devices tab to check the current IP addressing for your network devices
    2. Navigate to Security & SD-WAN > Monitor > Appliance status then click on the Tools tab and click on Run next to ARP Table
    3. Take a note of the MAC addresses of your network devices
    4. Navigate to Security & SD-WAN > Configure > DHCP then under Fixed IP assignments click on Add a fixed IP assignment and add entries for your network devices using the MAC addresses you have from Step #3 above then click on Save at the bottom of the page
       • 
    5. Navigate to Switching > Configure > Switch ports then filter for MR (in case you have previously tagged your ports or select ports manually if you haven't) then select those ports and click on Edit, then set Port status to Disabled then click on Save. 
       • 
    6. After a few minutes (For configuration to be up to date) Navigate to Switching > Configure > Switch ports then filter for MR (in case you have previously tagged your ports or select ports manually if you haven't) then select those ports and click on Edit, then set Port status to Enabled then click on Save. 
       • 
    7. Navigate to Switching > Monitor > Switches then click on each primary switch to change its IP address to the one desired using Static IP configuration (remember that all members of the same stack need to have the same static IP address)
       • 
       • 
    8. On your C9500 Core Stack, bounce your VLAN 1 interface. Then verify that the interface VLAN 1 came up with the correct IP address (e.g. 10.0.0.2 per this design) 

       • 9500-01#configure terminal
         Enter configuration commands, one per line.  End with CNTL/Z.
         9500-01(config)#interface vlan 1
         9500-01(config-if)#shutdown
         9500-01(config-if)#no shutdown
         9500-01(config-if)#end
         9500-01#sh ip interface brief vlan 1
         Interface              IP-Address      OK? Method Status                Protocol
         Vlan1                  10.0.1.2        YES DHCP   up                    up      
         9500-01#
         

    9. Navigate to Organization > Monitor > Overview then click on Devices tab to check the current IP addressing for your network devices
       • 
60. Configure QoS in your Campus LAN; Quality of Service configuration needs to be consistent across the whole Campus LAN. Please refer to the above table as an example. To configure QoS, please follow these steps: (For the purpose of this CVD, Default traffic shaping rules will be used to mark traffic with DSCP values without setting any traffic limits. Please adjust traffic shaping rules based on your own requirements) 
    1. Navigate to Wireless > Configure >  Firewall & Traffic Shaping and choose the Acme Corp SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. Click Save at the bottom of the page when you are done. Click Save at the bottom of the page when you are done. 
       • 
    2. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the Acme BYOD SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. 
       • 
    3. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the Guest SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. Click Save at the bottom of the page when you are done. 
       • 
    4. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the IoT SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. Click Save at the bottom of the page when you are done. 
       • 
    5. Navigate to Switching > Configure > Switch settings and under the Quality of Service menu configure the VLAN to DSCP mappings. Please click on Edit DSCP to CoS map to change settings per your requirements. (For more information on MS QoS settings and operation, please refer to the following article) Click Save at the bottom of the page when you are done. (Please note that the ports used in the below example are based on Cisco Webex traffic flow)
       • 
       • 
    6. Please ensure that your C9500 Core Stack is configured to trust incoming QoS. Here's a reference of the configuration needed to be applied:

       • 9500-01#configure terminal
         Enter configuration commands, one per line.  End with CNTL/Z.
         9500-01(config)#interface TwentyFiveGigE1/0/1
         9500-01(config-if)#auto qos trust dscp
         9500-01(config-if)#interface TwentyFiveGigE1/0/2
         9500-01(config-if)#auto qos trust dscp    
         9500-01(config-if)#interface TwentyFiveGigE2/0/1
         9500-01(config-if)#auto qos trust dscp    
         9500-01(config-if)#interface TwentyFiveGigE2/0/2
         9500-01(config-if)#auto qos trust dscp    
         9500-01(config-if)#interface TwentyFiveGigE1/0/23
         9500-01(config-if)#auto qos trust dscp
         Warning: add service policy will cause inconsistency with port TwentyFiveGigE2/0/23 in ether channel 1.
         9500-01(config-if)#interface TwentyFiveGigE1/0/24
         9500-01(config-if)#auto qos trust dscp
         Warning: add service policy will cause inconsistency with port TwentyFiveGigE2/0/24 in ether channel 2.
         9500-01(config-if)#interface TwentyFiveGigE1/0/24
         9500-01(config-if)#auto qos trust dscp
         9500-01(config-if)#end
         9500-01#show auto qos
         TwentyFiveGigE1/0/1
         auto qos trust dscp
         
         
         TwentyFiveGigE1/0/2
         auto qos trust dscp
         
         
         TwentyFiveGigE1/0/23
         auto qos trust dscp
         
         
         TwentyFiveGigE1/0/24
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/1
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/2
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/23
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/24
         auto qos trust dscp
         
         
         9500-01#wr mem
         

    7. Navigate to Security & SD-WAN > Configure > SD-WAN & Traffic shaping and make sure your Uplink configuration matches your WAN speed. Then, under Uplink selection choose the settings that match your requirements (e.g. Load balancing). Under Traffic shaping rules, select Enable default traffic shaping rules then click on Add a new shaping rule to create the rules needed for your network (for more information about Traffic shaping rules on MX appliances, please refer to the following article). Please see the following example: 
       • 
       • 
       • 
       • 

Testing & Verification  

9500-01#ping 10.0.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
9500-01#

9500-01#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/5 ms
9500-01#ping cisco.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 72.163.4.185, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 108/110/112 ms
9500-01#

9500-01#ping 10.0.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 2/2/3 ms
9500-01#ping 10.0.1.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 2/2/4 ms
9500-01#ping 10.0.1.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
9500-01#ping 10.0.1.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
9500-01#

STP Convergence

STP convergence will be tested using several methods as outlined below. Please see the following table for steady-state of the Campus LAN before testing:

		Bridge ID	STP Status
C9500-01	Primary	4096:b0c5.3c60.fba0
C9500-02	Member	4096.40b5.c111.01e0
MS390-01	Primary	61440:2c3f.0b04.7e80	STP ROOT   b0:c5:3c:60:fb:a0 (priority 4096) Blocking ports None
MS390-02	Member	61440:2c3f.0b0f.ec00
C9300-01	Primary	61440:a4b4.395f.2a8b	STP ROOT   b0:c5:3c:60:fb:a0 (priority 4096) Blocking ports None
C9300-02	Member	61440:4ce1.75b0.ba00
Client Device		IP Address: 10.0.20.4

Introducing loops (Access to Core)

A loop was introduced by adding a link between C9300-01 /NM Port 2 and C9500 Core Stack / Port TwentyFiveGigE1/0/22 (Please note that for the purposes of this test, the interface has been unshut and configured as a Trunk port with Native VLAN 1 with STP guards on that interface) 

9500-01#show ip interface brief | in TwentyFiveGigE1/0/22
TwentyFiveGigE1/0/22   unassigned      YES unset  up                    up      
ow9500-01#show run interface TwentyFiveGigE1/0/22
Building configuration...


Current configuration : 132 bytes
!
interface TwentyFiveGigE1/0/22
switchport trunk allowed vlan 1,10,20,30,40
switchport mode trunk
spanning-tree guard root
end


9500-01#
9500-01#show spanning-tree


MST0
  Spanning tree enabled protocol mstp
  Root ID    Priority    4096
             Address     b0c5.3c60.fba0
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


  Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
             Address     b0c5.3c60.fba0
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Twe1/0/1            Desg FWD 2000      128.193  P2p
Twe1/0/2            Desg FWD 2000      128.194  P2p
Twe1/0/22           Desg FWD 2000      128.214  P2p
Twe2/0/1            Back BLK 2000      128.385  P2p
Twe2/0/2            Back BLK 2000      128.386  P2p
Po1                 Desg FWD 10000     128.2089 P2p
Po2                 Desg FWD 1000      128.2090 P2p 

Interface Twe1/0/22 is in STP FWD state (As expected since this is the Root bridge)

 

Interface 26 is in STP BLK state (As expected since the Ether-channel is in FWD state) 

No impact on traffic flow for wireless clients

 

Introducing Loops (Access Layer, with STP Guard: Loop Guard)

For the purposes of this test and in addition to the previous loop connections, the following ports were connected:

MS390-01 / Port 11 < - > C9300-01 / Port 11

Port 11 on MS390-01 in STP BLK state (Bridge ID: 61440:2c3f.0b04.7e80)

Port 11 on C9300-01 in STP FWD state (Bridge ID: 61440:a4b4.395f.2a8b)

Packet capture on MS390-01 / Port 11 shows that Bridge ID: 61440:4ce1.75b0.ba00 is relaying the Root bridge BPDUs with Root Bridge ID: 4096:b0c5.3c60.fba0

 

Introducing Loops (Access Layer, without STP Guard)

For the purposes of this test and in addition to the previous loop connections, the following ports were connected:

MS390-02 / Port 12 < - > C9300-02 / Port 12

MS390-02 / Port 12 is in STP BLK state (Bridge ID: 61440:2c3f.0b0f.ec00)

C9300-02 / Port 12 is in STP FWD state (Bridge ID: 61440:4ce1.75b0.ba00)

 

Introducing Loops (Core Layer)

For the purpose of this test and in addition to the previous loop connections, the following ports were connected:

Port Twe1/0/10 to port Twe2/0/10 on the C9500 Core switches. 

9500-01#show run interface Twe1/0/10
Building configuration...


Current configuration : 132 bytes
!
interface TwentyFiveGigE1/0/10
switchport trunk allowed vlan 1,10,20,30,40
switchport mode trunk
spanning-tree guard root
end


9500-01#show run interface Twe2/0/10
Building configuration...


Current configuration : 132 bytes
!
interface TwentyFiveGigE2/0/10
switchport trunk allowed vlan 1,10,20,30,40
switchport mode trunk
spanning-tree guard root
end


9500-01#
9500-01#show ip interface brief | in TwentyFiveGigE1/0/10
TwentyFiveGigE1/0/10   unassigned      YES unset  up                    up      
9500-01#
9500-01#show ip interface brief | in TwentyFiveGigE2/0/10
TwentyFiveGigE2/0/10   unassigned      YES unset  up                    up    
9500-01#show spanning-tree


MST0
  Spanning tree enabled protocol mstp
  Root ID    Priority    4096
             Address     b0c5.3c60.fba0
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


  Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
             Address     b0c5.3c60.fba0
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Twe1/0/1            Desg FWD 2000      128.193  P2p
Twe1/0/2            Desg FWD 2000      128.194  P2p
Twe1/0/10           Desg BLK 2000      128.202  P2p 
Twe1/0/22           Desg FWD 2000      128.214  P2p
Twe2/0/1            Back BLK 2000      128.385  P2p
Twe2/0/2            Back BLK 2000      128.386  P2p
Twe2/0/10           Desg BKN*2000      128.394  P2p *ROOT_Inc 
Po1                 Desg FWD 10000     128.2089 P2p
Po2                 Desg FWD 1000      128.2090 P2p 


9500-01#show spanning-tree interface Twe2/0/10 detail
Port 394 (TwentyFiveGigE2/0/10) of MST0 is broken  (Root Inconsistent)
   Port path cost 2000, Port priority 128, Port Identifier 128.394.
   Designated root has priority 4096, address 4ce1.75b0.ba00
   Designated bridge has priority 8192, address b0c5.3c60.fba0
   Designated port id is 128.394, designated path cost 0
   Timers: message age 4, forward delay 0, hold 0
   Number of transitions to forwarding state: 0
   Link type is point-to-point by default, Internal
   PVST Simulation is enabled by default
   Root guard is enabled on the port
   BPDU: sent 2592, received 5175
9500-01#

 

Introducing Rogue Bridge in VLAN 1

For the purpose of this test and in addition to the previous loop connections, the Bridge priority on C9300 Stack will be reduced to 4096 (likely root) and increasing the Bridge priority on C9500 to 8192.

• Downlinks on C9500 are configured with STP Root Guard
• Access Layer Links (Stack to Stack) are configured with STP Loop Guard + UDLD

9500-01(config)#spanning-tree mst 0 priority 8192
9500-01(config)#end
9500-01#show spanning-tree


MST0
  Spanning tree enabled protocol mstp
  Root ID    Priority    8192
             Address     b0c5.3c60.fba0
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


  Bridge ID  Priority    8192   (priority 8192 sys-id-ext 0)
             Address     b0c5.3c60.fba0
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Twe1/0/1            Desg FWD 2000      128.193  P2p
Twe1/0/10           Desg FWD 2000      128.202  P2p
Twe1/0/22           Desg FWD 2000      128.214  P2p
Twe2/0/1            Back BLK 2000      128.385  P2p
Twe2/0/10           Desg BKN*2000      128.394  P2p *ROOT_Inc
Po1                 Desg FWD 10000     128.2089 P2p
Po2                 Desg FWD 1000      128.2090 P2p




9500-01#

9500-01#show spanning-tree


MST0
  Spanning tree enabled protocol mstp
  Root ID    Priority    8192
             Address     b0c5.3c60.fba0
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


  Bridge ID  Priority    8192   (priority 8192 sys-id-ext 0)
             Address     b0c5.3c60.fba0
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec


Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Twe1/0/1            Desg FWD 2000      128.193  P2p
Twe1/0/2            Desg FWD 2000      128.194  P2p
Twe1/0/10           Desg FWD 2000      128.202  P2p
Twe1/0/22           Desg BKN*2000      128.214  P2p *ROOT_Inc
Twe2/0/1            Back BLK 2000      128.385  P2p
Twe2/0/2            Back BLK 2000      128.386  P2p
Twe2/0/10           Desg BKN*2000      128.394  P2p *ROOT_Inc
Po1                 Desg FWD 10000     128.2089 P2p
Po2                 Desg FWD 1000      128.2090 P2p




9500-01#
9500-01#show spanning-tree interface Twe1/0/22 detail
Port 214 (TwentyFiveGigE1/0/22) of MST0 is broken  (Root Inconsistent)
   Port path cost 2000, Port priority 128, Port Identifier 128.214.
   Designated root has priority 4096, address 4ce1.75b0.ba00
   Designated bridge has priority 8192, address b0c5.3c60.fba0
   Designated port id is 128.214, designated path cost 0
   Timers: message age 5, forward delay 0, hold 0
   Number of transitions to forwarding state: 2
   Link type is point-to-point by default, Internal
   PVST Simulation is enabled by default
   Root guard is enabled on the port
   BPDU: sent 4611, received 319
9500-01#

C9500 Core Stack is still the Root Bridge (i.e. The root Bridge placement has been enforced).

Downlink to C9300-01 is in STP Inconsistent State

C9300 Stack is root

All C9300 ports are in FWD state

 

C9300 Stack is root for MS390

All MS390 to C9300 are in STP BLK state

Wireless client traffic flow disrupted for about 30 secs

Reverting all configuration back to original state:

1. Disconnect and shutdown interface TwentyFiveGigE1/0/22
2. Disconnect port 11 on MS390-01 and C9300-01 and remove Loop Guard and UDLD
3. Disconnect port 12 on MS390-02 and C9300-02
4. Disconnect and revert port TwentyFiveGigE1/0/10 and TwentyFiveGigE20/10 back to access with VLAN 1 and shutdown
5. Change MST priority on C9300 stack to 61440
6. Change MST priority on C9500 Core Stack to 4096

 

9500-01#show ip interface brief 
TwentyFiveGigE1/0/1    unassigned      YES unset  down                  down 
TwentyFiveGigE1/0/2    unassigned      YES unset  down                  down  
TwentyFiveGigE2/0/1    unassigned      YES unset  up                    up   
TwentyFiveGigE2/0/2    unassigned      YES unset  up                    up
9500-01#show switch
Switch/Stack Mac Address : b0c5.3c60.fba0 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version  State
-------------------------------------------------------------------------------------
*1       Active   b0c5.3c60.fba0     5      V02     Ready                               
2       Standby  40b5.c111.01e0     1      V02     Ready                               






9500-01#

Overview

This option is similar to the above except that the default VLAN 1 does not exist and the Native VLAN is replaced with another non-trivial VLAN assignment which can be considered a more preferable option for customers as it's separate from the Management VLAN. Also, a Transit VLAN has been introduced between the C9500 Core Stack and the MX WAN Edge to facilitate the separation between Management traffic (VLAN 100) and Client Traffic (Transit VLAN 192)

This design is based on consistent STP protocols running in this Hybrid Campus, as such Multiple Spanning Tree Protocol (MST, aka 802.1s) will be configured since it is supported on both the Meraki and Catalyst platforms. 

You should consider this option if you need to steer away from having VLAN 1 in your Campus LAN. Here's some things to consider about this design option: 

Pros:

• Flexibility in your VLAN design
• Facilitates Wireless Roaming across the whole campus
• Easier to deploy and consistent configuration across the entire Campus LAN
• Minimize the risk of VLAN hopping
• Considered more secure due to separation between Management traffic and Client traffic

Cons: 

• Non-deterministic route failover
• Slow convergence
• STP can be tricky given that the Hybrid Campus LAN consists of different switching platforms

Logical Architecture 

The following diagram shows the logical architecture for a STP based convergence Campus LAN Design with hybrid components:

Physical Architecture 

The following diagram shows the physical architecture and port list for this design:

Assumptions 

The following assumptions has been taken into account:

• VLAN 1 should not be configured on any switchport in this Campus LAN
• It is assumed that Wireless roaming is required everywhere in the Campus 
• It is assumed that VLANs are spanning across multiple zones  
• Corporate SSID (Broadcast in all zones) users are assigned VLAN 10 on all APs. CoA VLAN is VLAN 30 (Via Cisco ISE) 
• BYOD SSID (Broadcast in all zones) users are assigned VLAN 20 on all APs. CoA VLAN is VLAN 30 (Via Cisco ISE)
• Guest SSID (Broadcast in all zones) users are assigned VLAN 30 on all APs
• IoT SSID (Broadcast in all zones) users are assigned VLAN 40 on all APs
• Access Switches will be running in Layer 2 mode (No SVIs or DHCP)
• MS390 Access Switches physically stacked together
• Converted C9300 Access Switches physically stacked together
• C9500 Core Switches with Stackwise-virtual stacking using SVLs
• Access Switch uplinks are in trunk mode with native VLAN = VLAN 1 (Management VLAN*) 
• STP root is at Distribution/Collapsed-core
• Distribution/Collpased-core uplinks are in Trunk mode with Native VLAN = VLAN 1 (Management VLAN) 
• All VLAN SVIs are hosted on the core layer 
• Network devices will be assigned fixed IPs from the management VLAN DHCP pool. Default Gateway is 10.0.100.1

Network Segments 

Please check the following table for more information about the network segments (e.g. VLANs, SVIs, etc) for this design:

Quality of Service 

Device List

Access Policies

Port List

Wireless SSID List

Configuration and Implementation Guidelines

The following section will take you through the steps to amend your design by removing VLAN 1 and creating the desired new Native VLAN (e.g. VLAN 100) across your Campus LAN. The steps below should not be followed in isolation as first you have to complete the configuration of your Campus LAN based on the above previous section. The below steps are meant to replace VLAN 1 in your Campus LAN with a new one. 

1. Login to your dashboard account
2. MX Addressing & VLANs; Navigate to Security & SD-WAN > Configure > Addressing & VLANs, then click on VLANs then click on Add VLAN to add your new infrastructure and Transit VLANs then click on Create. Please do not delete the existing VLAN 1 yet. Then, click on Save at the bottom of the page.
   • 
   • 
   • 
   • As seen above, VLAN 1 needs to be kept at this stage to avoid losing connectivity to all downstream devices. 
3. MX Addressing & VLANs; Navigate to Security & SD-WAN > Configure > DHCP, then under VLAN 100 AND 192 click on Fixed IP assignments, and add entries for your network devices. (Tip: You can copy the MAC addresses from VLAN 1 and make sure to add the correct IP assignment to them). Then, click on Save at the bottom of the page. 
   • 
   • 
4. Create VLAN 100 and 192 on your C9500 Core Stack

   • Switch>en
     Switch#conf t
     Enter configuration commands, one per line.  End with CNTL/Z.
     9500-02(config)#interface vlan 100
     9500-02(config-if)#ip address dhcp 
     9500-02(config-if)#no shut
     9500-02(config)#interface vlan 192
     9500-02(config-if)#ip address dhcp
     9500-02(config-if)#no shut
     9500-02(config)#vlan 100
     9500-02(config-if)#no shut
     9500-02(config)#vlan 192
     9500-02(config-if)#no shut
     9500-02(config-if)#end
     9500-02#wr mem
     Building configuration...
     [OK]

5. Navigate to Switching > Configure > Switch ports and filter for MR (if you have tagged the ports accordingly, otherwise select your downlink ports manually), then change the Native VLAN on these switchports from Native VLAN 1 to Native VLAN 100. Also, please add VLAN 100 to the list of Allowed VLANs and remove VLAN 1 from the allowed list of VLANs. Then, click on Save at the bottom of the page.
   • 
   • Please note that this will cause disruption to client traffic 
6. Navigate to Switching > Monitor > Switches and click on the first Primary switch then change the IP address settings from Static to DHCP and please leave the VLAN field blank. (DO NOT add VLAN 100 at this stage). Then, click on Save at the bottom of the window. Please repeat this for all primary switches in your network.
   • 
   • As seen from the above screen shot, the VLAN value has been kept empty at this stage
7. On your C9500 Core Stack, add an MST instance in VLAN 100 and VLAN 192

   • 9500-01(config)#spanning-tree mst configuration
     9500-01(config-mst)#instance 0 vlan 100
     9500-01(config-mst)#instance 0 vlan 192
     9500-01(config-mst)#name region1
     9500-01(config-mst)#revision 1
     9500-01(config-mst)#exit
     9500-01(config)#spanning-tree mode mst
     9500-01(config)#spanning-tree mst 0 priority 4096
     9500-01(config)#exit
     9500-01#wr mem
     Building configuration...
     [OK]
     9500-01#

8. Navigate to Switching > Monitor > Switch ports and filter for uplink (if you have tagged the ports accordingly, otherwise select your uplink ports manually), then change the Native VLAN on these switchports from Native VLAN 1 to Native VLAN 100. Also, please add VLAN 100 to the list of Allowed VLANs and remove VLAN 1 from the allowed list of VLANs. Then, click on Save at the bottom of the page.
   • 
   • Please note that this will cause the Access Stacks to go offline on the Meraki dashboard
9. On your C9500 Core Stack, change the Native VLAN on your downlink Port-channels to VLAN 100

   • 9500-01(config)#interface po1
     9500-01(config-if)#switchport trunk allowed vlan 10,20,30,40,100
     9500-01(config-if)#switchport trunk native vlan 100
     9500-01(config-if)#interface po2                                
     9500-01(config-if)#switchport trunk allowed vlan 10,20,30,40,100
     9500-01(config-if)#switchport trunk native vlan 100
     9500-01(config)#end
     9500-01#wr mem
     Building configuration...
     [OK]
     9500-01#

10. Shutdown all uplinks from C9500 Core Stack to Port 19 and 20 on your Secondary WAN Edge appliance to avoid having a dual-active situation.

    • 9500-01(config)#interface twe1/0/24
      9500-01(config-if)#shutdown
      9500-01(config-if)#interface twe2/0/24
      9500-01(config-if)#shutdown
      9500-01(config)#end
      9500-01#

11. MX Addressing & VLANs; Navigate to Security & SD-WAN > Configure > Addressing & VLANs, then under Per-port settings, change the Native VLAN on your downlinks to VLAN 100 and allow both VLAN 100 and  192
    • 
12. On your C9500 Core Stack, change the Native VLAN on your uplink to VLAN 100 and allow VLANs 100 and 192 (Please note that you will need to connect to your C9500 Core Stack via console access since VLAN 1 does not exist anymore on the upstream device which is the MX WAN Edge in this case) 

    • 9500-01(config)#define interface-range uplinks TwentyFiveGigE1/0/1-2 , TwentyFiveGigE2/0/1-2
      9500-01(config)#interface range macro uplinks
      9500-01(config-if)#switchport mode trunk 
      9500-01(config-if)#switchport trunk allowed vlan 100,192
      9500-01(config-if)#switchport trunk native vlan 100
      9500-01(config)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#

13. On your C9500 Core Stack, create a default route for your SVI interfaces:

    • 9500-01(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.1
      9500-01(config)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#

14. Adjust your Static Routes on the MX to point to the transit VLAN instead of VLAN 1. Navigate to Security & SD-WAN > Configure > Addressing & VLANs and under Static routes click on a static route to change the next-hop. Please repeat that for all your static routes. Then, click on Save at the bottom of the page:
    • 
    • 
15. Wait for your Access Switches to come back online and acquire an IP address in the new Native VLAN 100. Then, proceed to the next step.
16. Now your switches should have acquired an IP address per the fixed IP assignment configuration. Navigate to Switching > Monitor > Switches then click on the first Primary switch and then change the IP address settings to static. Then, click on Save at the bottom of the window. Repeat this for all Primary switches in your network. 
    • 
    • Please repeat the above step for all stacks in your network
17. Navigate to your Primary WAN Edge device and ping 10.0.100.2 to make sure that it is reachable via VLAN 100. Then proceed to the next step. 
18. Unshut the uplinks on your C9500 Core Stack to the Secondary WAN Edge appliance:

    • 9500-01(config)#interface twe1/0/24
      9500-01(config-if)#no shutdown
      9500-01(config-if)#interface twe2/0/24
      9500-01(config-if)#no shutdown
      9500-01(config)#end
      9500-01#

19. Verify that all your devices have come back online and acquired an IP address in the new Management VLAN. Navigate to Organization > Monitor > Overview then click on the devices tab:
    • 
20. Navigate to Switching > Configure > Switch settings then change the Management VLAN configuration to VLAN 100. Then, click on Save at the bottom of the page
    • 
21. Delete VLAN 1 from your MX appliance. Navigate to Security & SD-WAN > Configure > Addressing & VLANs and select the old Management VLAN 1 and then click on Delete. Then, click on Save at the bottom of the page. 
22. Where applicable - Please remember to adjust any routing between your Campus LAN and remote servers (e.g. Cisco ISE for 802.1x auth) as in this case devices will use the new Management VLAN 100 as the source of Radius requests. To verify that you have connectivity to your remote servers, Navigate to Wireless > Monitor > Access points then click on any AP and from the Tools section ping your remote server. Repeat this process from one of your switches.
    • 
    • 
    • With the current scope of the design, Cisco ISE resides in AWS and is reachable via AutoVPN which terminates on the vMX in AWS as well. As such, it was required to add a route on the VPC to 10.0.100.0/24 pointing to the vMX
    • Also, please ensure that the new Management VLAN has been enabled with AutoVPN by navigating to Security & SD-WAN > Configure > Site-to-site VPN and ensure that VLAN 100 is enabled. 
23. Where applicable - Please remember to adjust your Radius server configuration (e.g. Cisco ISE) as the Network devices now are grouped in a new Management VLAN 100. Please see the below example for Cisco ISE:
    • 

Overview

This option assumes that your OSPF domain is extended all the way to your core layer and thus there is no need to rely on STP between your Access and Core for convergence (as long as there are separate broadcast domains between Access and Core). It offers fast convergence since it relies on ECMP rather than STP layer 2 paths. However, it doesn't offer great flexibility in your VLAN design as each VLAN cannot span between multiple stacks/closets. 

Pros:

• Deterministic route failover
• Fast convergence
• Relies on either stacking or gateway redundancy at upper layers
• Complete end to end separation between Management traffic and Client traffic

Cons:

• VLANs cannot span multiple stacks/closets
• Your backbone area size can be unmanageable
• Forces Layer 3 roaming across the Campus LAN 
• Additional VLANs needed to route traffic between Campus LAN layers (aka Transit VLAN)

Logical Architecture  

The following diagram shows the logical architecture for a Layer 3 convergence Campus LAN Design with hybrid components:

Physical Architecture 

The following diagram shows the physical architecture and port list for this design:

Assumptions 

The following assumptions have been taken into account:

• It is assumed that Wireless roaming is required only within a specific Campus Zone
• It is assumed that VLANs are NOT spanning across multiple zones  
• There will be NO use of VLAN 1 across the Campus LAN
• Corporate SSID (Broadcast in all zones) users are assigned VLAN 11/12 based on the AP zone. 
• BYOD SSID (Broadcast in all zones) users are assigned VLAN 21/22 based on the AP zone.
• Guest SSID (Broadcast in Zone1) users are assigned VLAN 30 on all APs in that zone
• IoT SSID (Broadcast in zone2) users are assigned VLAN 40 on all APs in that Zone
• Access Switches will be running Layer 3 (SVIs and DHCP)
• MS390 Access Switches physically stacked together
• Converted C9300 Access Switches physically stacked together
• C9500 Core Switches with Stackwise-virtual stacking using SVLs
• Access Switch uplinks are in trunk mode with native VLAN = VLAN 1 (Management VLAN) 
• STP root is at Distribution/Collapsed-core
• Network devices will be assigned fixed IPs from the management VLAN DHCP pool. Default Gateway will vary based on the Zone and stack.

Network Segments 

Please check the following table for more information about the network segments (e.g. VLANs, SVIs, etc) for this design:

Quality of Service 

Device List 

Access Policies 

Port List 

Wireless SSID List 

Configuration and Implementation Guidelines 

It is assumed that by this stage, Catalyst devices have been added to dashboard for either Monitoring (e.g. C9500) and/or Management (e.g. C9300). For more information, please refer to the above section. 

Before proceeding, please make sure that you have the appropriate licenses claimed into your dashboard account.

1. Login to your dashboard account (or create an account if you don't have one)
2. Navigate to Organization > Configure > Inventory
3. For Co-term license model, click on Claim. And for PDL, please click on Add
4. Enter the order and/or serial number(s) to claim the devices into your account. For PDL, click Next then please choose to add them to Inventory (Do not add them to a network)
5. Create a Dashboard Network; Navigate to Organization > Configure > Create network to create a network for your Campus LAN (Or use an existing network if you already have one). If you are creating a new network, please choose "Combined" as this will facilitate a single topology diagram for your Campus LAN. Choose a name (e.g. Campus) and then click Create network
   • 
6. Dashboard Network Settings; Navigate to Network-wide > Configure > General and choose the settings for your network (e.g. Timezone, Traffic Analytics, firmware upgrade day/time, etc)
   • 
7. Schedule Firmware Upgrade; Navigate to Organization > Configure > Firmware upgrades to select the firmware settings for your devices such that devices upgrade once they connect to dashboard. Select the device type then click on Schedule upgrade
8. Add Devices to a Dashboard Network; Navigate to Organization > Configure > Inventory:
   • For Co-term licensing model, select the MS390 and C9300 switches and the Primary WAN Edge then click on Add then choose the Network Campus
   • For PDL licensing model, select the MS390 and C9300 switches and the Primary WAN Edge then click on Change network assignment and then choose the Network Campus
   • Please DO NOT add the Secondary WAN Edge device at this stage
9. Rename MX Security Appliance; Navigate to Security & SD-WAN > Monitor > Appliance status then click on the edit button to rename the MX to Primary WAN Edge then click on Save
   • 
10. MX Connectivity; Plug in your WAN uplink(s) on the Primary WAN Edge MX then power it on and wait for it to come online on dashboard. This might take a few minutes as the MX will download its firmware and configuration. Navigate to Security & SD-WAN > Configure > Appliance status and verify that the MX has come online and that its firmware and configuration is up to date.
11. Rename Access Switches; Navigate to Switching > Monitor > Switches then click on each MS390 and C9300 switch and then click on the edit button on top of the page to rename it per the above table then click on Save such that all your switches have their designated names
    • 
12. Rename MR APs; Navigate to Wireless > Monitor > Access points then click on each AP and then click on the edit button on top of the page to rename it per the above table then click on Save such that all your APs have their designated names
13. MR AP Tags; Navigate to Wireless > Monitor >  Access points then click on each AP and then click on the edit button next to TAGS to add Tags to your AP per the above table then click on Save such that all your APs have their designated tags
    • 
14. MX Addressing & VLANs; Navigate to Security & SD-WAN > Configure > Addressing & VLANs, and in the Deployment Settings menu select Routed mode. Further down the page on the Routing menu, click on VLANs then click on Add VLAN to add your Management and Transit VLANs then click on Create. Then for the per-port VLAN settings, select your downlink ports (19 and 20) and click on Edit and configure them as Trunk with VLAN 3 (Allowed VLANs 3, 100, 200, 1923) and click on Update. Finally, click on Save at the bottom of the page.
    • 
    • 
    • 
    • 
    • 
    • Please repeat the above steps to create VLANs 100 and 200
    • 
    • 
    • 
    • 
15. Campus LAN Static Routes; Create Static Routes for your Campus network by navigating further down the page to Static routes then click on Add Static Route. Start by adding your Corporate LAN subnet then click on Update and then add static routes to all other subnets (e.g. BYOD, Guest and IoT). Finally, click on Save at the bottom of the page. (The Next hop IP that you have used here will be used to create a fixed assignment for the Core Stack later in DHCP settings). 
    • 
    • 
    • 
    • 
    • 
16. Optional - If you are accessing any resources over Meraki SD-WAN, please navigate to Security & SD-WAN > Configure > Site-to-site VPN and enable VPN based on your topology and traffic flow requirements. (In this case, we will configure this Campus as Spoke with Split Tunneling) 
    • Choose Type: Spoke then click on Add a hub and select your hub site where you need access to resources via VPN. You can also add multiple hubs for resiliency. To choose Split Tunneling, please leave the box next to the Hub unticked as shown below. 
    • Under VPN Settings, choose which subnet to be Enabled in VPN (e.g. Management VLAN will be required for Radius authentication purposes as the MR/MS390/C9300 devices will reach out to Cisco ISE using their management IP). Any Subnet that needs to access resources via VPN must be Enabled otherwise keep it as Disabled.
    • 
    • Finally, click on Save at the bottom of the page
    • On the Hub site, please make sure to advertise the subnets that are required to be reachable via VPN. Navigate to Security & SD-WAN > Configure > Site-to-site VPN then add a local network then click Save at the bottom of the page (Please make sure that you are configuring this on the Hub's dashboard network) 
17. Optional - Verify that your VPN has come up by selecting your Campus LAN dashboard network from the Top-Left Network drop-down list and then navigate to Security & SD-WAN > Monitor > VPN status then check the status of your VPN peers. Next, navigate to Security & SD-WAN > Monitor > Route table and check the status of your remote subnets that are reachable via VPN. You can also verify connectivity by pinging a remote subnet (e.g. 172.31.16.32 which is Cisco ISE) by navigating to Security & SD-WAN > Monitor > Appliance status then click on Tools and ping the specified IP address (Please note that the MX will choose the highest VLANs interface IP participating in VPN by default as the source)

    Please note that in order to ping a remote subnet, you must either have BGP enabled or have static routes at the far-end pointing back to the Campus LAN local subnets. (In other words the source of your traffic which for ping by default is the highest VLAN participating in AutoVPN if not otherwise specified)

    In this example, the VPC in AWS has been configured with a Route Entry to route 10.0.100.0/24 and 10.0.200.0/24 via the vMX deployed in AWS that has a VPN tunnel back to the Campus LAN site.

    

    If the remote VPN peer (e.g. AWS) is configured in Routed mode, the static route is not required since traffic will always be NAT'd to a local reachable IP address.  Please also don't forget to create Network Device groups on Cisco ISE for your network devices to be able to send authentication messages to Cisco ISE. See the below example: 

18. SD-WAN & Traffic Shaping Configuration; To configure Traffic Shaping settings for your Campus LAN site. Navigate to Security & SD-WAN > Configure > SD-WAN & Traffic Shaping to configure your preferred settings. For the purpose of this CVD, the default traffic shaping rules will be used to mark traffic with a DSCP tag without policing egress traffic (except for traffic marked with DSCP 46) or applying any traffic limits. (Please adjust these settings based on your requirements such as traffic limits or priority queue values. For more information about traffic shaping settings on the MX devices, please refer to the following article)
    • 
19. Optional - Configure Threat Protection (Requires Advanced License or above) for your Campus LAN site. Navigate to Security & SD-WAN > Configure > Threat Protection and choose the settings that meet your site requirements. Please see the following configuration example: 
20. Click on Save at the bottom of the page
21. Optional - Configure Content Filtering Settings (Requires Advanced License or above) for your Campus LAN site. Navigate to Security & SD-WAN > Configure > Content filtering and choose the settings that meet your site requirements. Please see the following configuration example: 
22. Click on Save at the bottom of the page
23. Core Switch Uplinks; On the Catalyst 9500 core switches, Connect their uplinks to the Primary WAN Edge MX and power them both on.
24. Core Switch Network Access; Connect to the first C9500 switch via console and configure it with the following commands:

    • Switch>en
      Switch#conf t
      Enter configuration commands, one per line.  End with CNTL/Z.
      Switch(config)#hostname 9500-01
      9500-01(config)#ip domain name meraki-cvd.local
      9500-01(config)#cdp run
      9500-01(config)#lldp run
      9500-01(config)#stackwise 
      Please reload the switch for Stackwise Virtual configuration to take effect
      Upon reboot, the config will be part of running config but not part of start up config.
      9500-01(config-stackwise-virtual)#domain 1
      9500-01(config)#exit
      9500-01(config)#interface Twe1/0/1
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 3
      9500-01(config-if)#switchport trunk allowed vlan 3,100,200,1923
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface Twe1/0/2
      9500-01(config-if)#switchport mode trunkk
      9500-01(config-if)#switchport trunk native vlan 3
      9500-01(config-if)#switchport trunk allowed vlan 3,100,200,1923
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 3
      9500-01(config-if)#ip address dhcp 
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 100
      9500-01(config-if)#ip address dhcp
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 200
      9500-01(config-if)#ip address dhcp
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 1923
      9500-01(config-if)#ip address 192.168.3.2 255.255.255.0
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#
      9500-01#sh ip int brief
      Interface              IP-Address      OK? Method Status                Protocol
      Vlan3                  10.0.3.2        YES DHCP   up                    up  
      Vlan100                10.0.100.2      YES DHCP   up                    up    
      Vlan200                10.0.200.2      YES DHCP   up                    up 
      Vlan1923               192.168.3.2     YES manual up                    up        
      GigabitEthernet0/0     unassigned      YES NVRAM  down                  down    
      TwentyFiveGigE1/0/1    unassigned      YES unset  up                    up      
      TwentyFiveGigE1/0/2    unassigned      YES unset  up                    up 
      9500-01#ping 8.8.8.8
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/5 ms
      9500-01#ping cisco.com
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 72.163.4.185, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 109/109/109 ms
      9500-01#switch 1 renumber 1
      9500-01#switch priority 5
      9500-01#wr mem
      Building configuration...
      [OK]
      

25. Core Switch Network Access; Connect to the second C9500 switch via console and configure it with the following commands:

    • Switch>en
      Switch#conf t
      Enter configuration commands, one per line.  End with CNTL/Z.
      Switch(config)#hostname 9500-02
      9500-02(config)#ip domain name meraki-cvd.local
      9500-01(config)#cdp run
      9500-01(config)#lldp run
      9500-02(config)#stackwise 
      Please reload the switch for Stackwise Virtual configuration to take effect
      Upon reboot, the config will be part of running config but not part of start up config.
      9500-02(config-stackwise-virtual)#domain 1
      9500-02(config)#exit
      9500-02(config)#interface Twe1/0/1
      9500-01(config-if)#switchport mode trunk
      9500-02(config-if)#switchport trnk native vlan 3
      9500-01(config-if)#switchport trunk allowed vlan 3,100,200,1923
      9500-02(config-if)#no shut
      9500-02(config-if)#exit
      9500-02(config)#interface Twe1/0/2
      9500-01(config-if)#switchport mode access
      9500-02(config-if)#switchport access vlan 3
      9500-01(config-if)#switchport trunk allowed vlan 3,100,200,1923
      9500-02(config-if)#no shut
      9500-02(config-if)#exit
      9500-02(config)#interface vlan 3
      9500-02(config-if)#ip address dhcp 
      9500-02(config-if)#no shut
      9500-01(config)#interface vlan 100
      9500-01(config-if)#ip address dhcp
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 200
      9500-01(config-if)#ip address dhcp
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface vlan 1923
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#
      9500-01#sh ip int brief
      Interface              IP-Address      OK? Method Status                Protocol
      Vlan3                  10.0.3.3        YES DHCP   up                    up  
      Vlan100                10.0.100.3      YES DHCP   up                    up    
      Vlan200                10.0.200.3      YES DHCP   up                    up 
      Vlan1923               unassigned      YES manual up                    down        
      GigabitEthernet0/0     unassigned      YES NVRAM  down                  down    
      TwentyFiveGigE1/0/1    unassigned      YES unset  up                    up      
      TwentyFiveGigE1/0/2    unassigned      YES unset  up                    up
      9500-02#ping 8.8.8.8
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/5 ms
      9500-02#ping cisco.com
      Type escape sequence to abort.
      Sending 5, 100-byte ICMP Echos to 72.163.4.185, timeout is 2 seconds:
      !!!!!
      Success rate is 100 percent (5/5), round-trip min/avg/max = 109/109/109 ms
      9500-02#switch 1 renumber 2
      9500-02#switch priority 1
      9500-02#wr mem
      Building configuration...
      [OK]

26. SVL Configuration; Now that both C9500 switches have access to the network, proceed to configure the Stackwise Virtual Links per the port list proviced above (In this case using two ports for the SVL providning a total stacking bandwidth of 80 Gbps)

    • 9500-01(config)#interface HundredGigE1/0/25
      9500-01(config-if)#stackwise-virtual link 1
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface HundredGigE1/0/26
      9500-01(config-if)#stackwise-virtual link 1
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#reload
      Proceed with reload? [confirm]
      

    • 9500-02(config)#interface HundredGigE1/0/25
      9500-02(config-if)#stackwise-virtual link 1
      9500-02(config-if)#no shut
      9500-02(config-if)#exit
      9500-02(config)#interface HundredGigE1/0/26
      9500-02(config-if)#stackwise-virtual link 1
      9500-02(config-if)#no shut
      9500-02(config-if)#end
      9500-02#wr mem
      Building configuration...
      [OK]
      9500-02#reload
      Proceed with reload? [confirm]
      

27. Connect Stacking Cables; Whilst the C9500 switches are reloading, connect the stacking cables on both switches
28. Verify Stackwise Configuration; Please wait for about 10 minutes for the switches to come back up and initialize the stack. Then, connect to the 9500-01 (Stack Primary) via console to verify that the stack is operational. The stackwise-virtual link should be U (Up) and R (Ready).  

    • 9500-01#show stackwise-virtual
      Stackwise Virtual Configuration:
      --------------------------------
      Stackwise Virtual : Enabled
      Domain Number : 1  
      
      
      Switch Stackwise Virtual Link Ports
      ------ ---------------------- ------
      1      1                      HundredGigE1/0/25           
                                    HundredGigE1/0/26           
      2      1                      HundredGigE2/0/25           
                                    HundredGigE2/0/26           
      
      
      9500-01#
      9500-01#show stackwise-virtual link
      Stackwise Virtual Link(SVL) Information:
      ----------------------------------------
      Flags:
      ------
      Link Status
      -----------
      U-Up D-Down
      Protocol Status
      ---------------
      S-Suspended P-Pending E-Error T-Timeout R-Ready
      -----------------------------------------------
      Switch SVL Ports                    Link-Status Protocol-Status
      ------ --- -----                    ----------- ---------------
      1      1   HundredGigE1/0/25        U           R              
                 HundredGigE1/0/26        U           R              
      2      1   HundredGigE2/0/25        U           R              
                 HundredGigE2/0/26        U           R              
      
      
      9500-01#
      9500-01#show stackwise-virtual bandwidth
      Switch Bandwidth
      ------ ---------
      1       80G
      2       80G
      
      
      9500-01#
      9500-01#sh switch
      Switch/Stack Mac Address : b0c5.3c60.fba0 - Local Mac Address
      Mac persistency wait time: Indefinite
                                                   H/W   Current
      Switch#   Role    Mac Address     Priority Version  State
      -------------------------------------------------------------------------------------
      *1       Active   b0c5.3c60.fba0     5      V02     Ready                               
      2        Standby  40b5.c111.01e0     1      V02     Ready                               
      
      
      
      
      
      
      9500-01#

29. Optional - Attach and configure stackwise-virtual dual-active-detection; DAD is a feature used to avoid a dual-active situation within a stack of switches. It will rely on a direct attachment link between the two switches to send hello packets and determine if the active switch is responding or not. Please note that DAD cannot be applied to any SVL links and has to be a dedicated interface. For the purpose of this CVD, interface HundredGigE1/0/27 and HundredGigE2/0/27 will be used for enabling DAD between the two C9500 switches. 

    • 9500-01#configure terminal
      9500-01(config)#interface HundredGigE1/0/27
      9500-01(config-if)#stackwise-virtual dual-active-detection
      WARNING: All the extraneous configurations will be removed for HundredGigE1/0/27 on reboot.
      INFO: Upon reboot, the config will be part of running config but not part of start up config.
      9500-01(config-if)#interface HundredGigE2/0/27
      9500-01(config-if)#stackwise-virtual dual-active-detection
      WARNING: All the extraneous configurations will be removed for HundredGigE1/0/27 on reboot.
      INFO: Upon reboot, the config will be part of running config but not part of start up config.
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#reload
      Reload command is being issued on Active unit, this will reload the whole stack
      Proceed with reload? [confirm]Connection to 10.0.3.2 closed by remote host.
      Connection to 10.0.3.2 closed.
      >>
      9500-01#sh stackwise-virtual dual-active-detection
      In dual-active recovery mode: No
      Recovery Reload: Enabled
      
      
      Dual-Active-Detection Configuration:
      -------------------------------------
      Switch Dad port Status
      ------ ------------ ---------
      1 HundredGigE1/0/27         up     
      2 HundredGigE2/0/27         up     
      
      
      9500-01#
      

30. Configure Multiple Spanning Tree Protocol (802.1s). Connect to the 9500-01 (Stack Primary) via console and use the following commands:

    • 9500-01(config)#spanning-tree mst configuration
      9500-01(config-mst)#instance 0 vlan 3,100,200,1921,1922,1923
      9500-01(config-mst)#name region1
      9500-01(config-mst)#revision 1
      9500-01(config-mst)#exit
      9500-01(config)#spanning-tree mode mst
      9500-01(config)#spanning-tree mst 0 priority 4096
      9500-01(config)#exit
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

31. Verify Spanning Tree Configuration (Please note that interface Twe2/0/1 will be in STP blocking state due to the fact that both uplinks are connected to the same MX edge device at this stage)

    • 9500-01#show spanning-tree
      
      
      MST0
        Spanning tree enabled protocol mstp
        Root ID    Priority    4096
                   Address     b0c5.3c60.fba0
                   This bridge is the root
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
        Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
                   Address     b0c5.3c60.fba0
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
      Interface           Role Sts Cost      Prio.Nbr Type
      ------------------- ---- --- --------- -------- --------------------------------
      Twe1/0/1            Desg FWD 2000      128.193  P2p
      Twe2/0/1            Back BLK 2000      128.385  P2p
      
      
      
      9500-01#

32. Configure STP Root Guard and UDLD on the Core Stack Downlinks:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#int Twe1/0/23
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#int Twe1/0/24
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#int Twe2/0/23            
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#int Twe2/0/24            
      9500-01(config-if)#spanning-tree guard root
      9500-01(config-if)#udld port aggressive
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

33. Optional - STP Hygiene; It is recommended to configure STP Root Guard on all C9500 Core Stack downlinks to avoid any new introduced downstream switches from claiming root bridge status:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#define interface-range stp-protect TwentyFiveGigE1/0/3 - 22
      9500-01(config)#interface range macro stp-protect
      9500-01(config-if-range)#spanning-tree guard root
      9500-01(config-if-range)#exit
      9500-01(config)#define interface-range stp-protect2 TwentyFiveGigE2/0/3 - 22
      9500-01(config)#interface range macro stp-protect2
      9500-01(config-if-range)#spanning-tree guard root
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#

34. Optional - STP Hygiene; It is recommended to configure STP Loop Guard on all C9500 Core Stack un-used stacking links:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#interface HundredGigE1/0/27
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if-range)#exit
      9500-01(config)#interface HundredGigE1/0/28
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if)#exit
      9500-01(config)#interface HundredGigE2/0/27
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if-range)#exit
      9500-01(config)#interface HundredGigE2/0/28
      9500-01(config-if)#spanning-tree guard loop
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#

35. Configure SVIs for your Campus LAN on the Core Stack:

    • 9500-01(config)#interface vlan 1921
      9500-01(config-if)#ip address 192.168.1.1 255.255.255.0
      9500-01(config-if)#no shut
      9500-01(config-if)#interface vlan 1922                  
      9500-01(config-if)#ip address 192.168.2.1 255.255.255.0
      9500-01(config-if)#no shut                            
      9500-01(config-if)#exit
      9500-01(config)#ip dhcp pool vlan100 
      9500-01(dhcp-config)#network 10.0.100.0 /24
      9500-01(dhcp-config)#default-router 10.0.100.1
      9500-01(dhcp-config)#dns-server 208.67.222.222 208.67.220.220
      9500-01(dhcp-config)#ip dhcp pool vlan200
      9500-01(dhcp-config)#network 10.0.200.0 /24
      9500-01(dhcp-config)#default-router 10.0.200.1                
      9500-01(dhcp-config)#dns-server 208.67.222.222 208.67.220.220
      9500-01(dhcp-config)#end
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

36. Verify your DHCP pool configuration

    • 9500-01#sh ip dhcp pool
      
      
      Pool vlan100 :
      Utilization mark (high/low)    : 100 / 0
      Subnet size (first/next)       : 0 / 0
      Total addresses                : 254
      Leased addresses               : 0
      Excluded addresses             : 0
      Pending event                  : none
      1 subnet is currently in the pool :
      Current index        IP address range                    Leased/Excluded/Total
      10.0.100.1           10.0.100.1       - 10.0.100.254      0     / 0     / 254  
      
      
      Pool vlan200 :
      Utilization mark (high/low)    : 100 / 0
      Subnet size (first/next)       : 0 / 0
      Total addresses                : 254
      Leased addresses               : 0
      Excluded addresses             : 0
      Pending event                  : none
      1 subnet is currently in the pool :
      Current index        IP address range                    Leased/Excluded/Total
      10.0.200.1           10.0.200.1       - 10.0.200.254      0     / 0     / 254   
      9500-01#

37. Verify your SVI configuration

    • 9500-01#sh ip int brief | in Vlan
      Vlan3                  10.0.3.113      YES DHCP   up                    up      
      Vlan100                10.0.100.2      YES DHCP   up                    up     
      Vlan200                10.0.200.2      YES DHCP   up                    up
      Vlan1921               192.168.1.1     YES manual up                    down
      Vlan1922               192.168.2.1     YES manual up                    down
      Vlan1923               192.168.3.2     YES manual up                    up      
      9500-01#

38. Configure Layer 2 Switchports,  SGTs and CST (Cisco TrustSec) on your Core Stack interfaces. (Please note that enforcement has been disabled on downlink ports allowing it to happen downstream)

    • 9500-01#conf t
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#cts sgt 2
      9500-01(config)#cts role-based enforcement vlan-list 3,11,12,21,22,30,40,100,200
      9500-01(config)#ip access-list role-based Allow_All
      9500-01(config-rb-acl)#permit ip
      9500-01(config-rb-acl)#exit
      9500-01(config)#cts role-based permissions default Allow_All
      9500-01(config)#interface TwentyFiveGigE1/0/23
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 100
      9500-01(config-if)#switchport trunk allowed vlan 100,1921
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01(config)#interface TwentyFiveGigE1/0/24
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 200
      9500-01(config-if)#switchport trunk allowed vlan 200,1922
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01(config)#interface TwentyFiveGigE2/0/23
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 100
      9500-01(config-if)#switchport trunk allowed vlan 100,1921
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01(config)#interface TwentyFiveGigE2/0/24
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 200
      9500-01(config-if)#switchport trunk allowed vlan 200,1922
      9500-01(config-if)#no cts role-based enforcement
      9500-01(config-if)#cts manual
      9500-01(config-if-cts-manual)#propagate sgt
      9500-01(config-if-cts-manual)#policy static sgt 2 trusted
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

39. Spare WAN Edge Connectivity; Follow these steps to create warm-spare with two MX appliances: (Please note that this might result in a brief interruption of packet forwarding on the MX Appliance) 
    • Navigate to Security & SD-WAN > Monitor > Appliance status and click on Configure warm spare
    • 
    • Now click on Enabled then choose the Spare MX from the drop-down menu and then choose the Uplink IP option that suits your requirements (Please note that choosing Virtual IPs requires an additional IP address on the upstream network and a single broadcast domain between the two MXs) then click on Update
    • 
    • Now click on Spare to access the Appliance status page of your Spare MX and click on the Edit button to rename the spare unit (e.g. Secondary WAN Edge)
    • 
    • 
    • Then configure the following on your C9500 Core Stack:

    • 9500-01#configure terminal
      9500-01(config)#interface Twe1/0/2
      9500-01(config-if)#switchport mode trunk
      9500-01(config-if)#switchport trunk native vlan 3
      9500-01(config-if)#switchport trunk allowed vlan 3,100,200,1923
      9500-01(config-if)#no shut
      9500-01(config-if)#exit
      9500-01(config)#interface Twe2/0/2
      9500-01(config-if)#switchport mode access
      9500-01(config-if)#switchport trunk native vlan 3
      9500-01(config-if)#switchport trunk allowed vlan 3,100,200,1923
      9500-01(config-if)#no shut
      9500-01(config-if)#end
      9500-01#wr mem
      Building configuration...
      [OK]

    • Then connect the Spare MX downlinks to your C9500 Core Stack (e.g. Spare MX port 19 to Twe1/0/2 and port 20 to Twe2/0/2)
    • Then connect the Spare MX with it's uplinks (This must match the uplink configuration on your Primary WAN Edge)
    • Power on the Spare MX and wait for it to come online on dashboard
    • 
    • 
    • 
    • You can also verify that your C9500 Core Stack interfaces to the Spare MX are up, and that the redundant uplinks are in STP BLK mode

    • 9500-01#sh ip interface brief
      Interface              IP-Address      OK? Method Status                Protocol       
      TwentyFiveGigE1/0/2    unassigned      YES unset  up                    up      
      TwentyFiveGigE2/0/2    unassigned      YES unset  up                    up 
      9500-01#
      9500-01#show spanning-tree
      
      
      MST0
        Spanning tree enabled protocol mstp
        Root ID    Priority    4096
                   Address     b0c5.3c60.fba0
                   This bridge is the root
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
        Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
                   Address     b0c5.3c60.fba0
                   Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      
      
      Interface           Role Sts Cost      Prio.Nbr Type
      ------------------- ---- --- --------- -------- --------------------------------
      Twe1/0/1            Desg FWD 2000      128.193  P2p
      Twe1/0/2            Desg FWD 2000      128.194  P2p
      Twe2/0/1            Back BLK 2000      128.385  P2p
      Twe2/0/2            Back BLK 2000      128.386  P2p
      
      
      
      
      9500-01#
      

40. Access Policy configuration; When you're logged in dashboard, Navigate to Switching > Configure > Access policies to configure Access Policies as required for your Campus LAN. Please see the following example for two Access Policies; 802.1x & MAB:
    • 
    • 
41. Adaptive Policy Configuration; Configure Adaptive Policy for your Campus LAN. When you're logged in dashboard, Navigate to Organization > Configure > Adaptive Policy then click on the Groups tab on the top. There should be two groups (Unknown, Infrastructure) that are already available. Click on Add group to add each group required for your Campus LAN. You need to fill in the Name, the SGT value, and a description then click on Review changes then click on Submit. Please see the following examples:
    • 
42. Adaptive Policy Configuration; Configure Adaptive Policy for your Campus LAN. When you're logged in dashboard, Navigate to Organization > Configure > Adaptive Policy then click on the Policies tab on the top. The source groups are on the left side, and the destination groups are on the right side. Select a source group from the left side then select all destination groups on the right side that should be allowed then click on Allow and click on Save at the bottom of the page. Next, Select a source group from the left side then select all destination groups on the right side that should be denied (i.e. Blocked) then click on Deny and click on Save at the bottom of the page. After creating the policy for that specific source group, the allowed destination groups will be displayed with a Green tab and the denied destination groups will be displayed with a Red tab. Repeat this step for all policies required for all Groups (Allow and Deny) 
    • 
43. Access Switch Ports Preparation; MS390 switches support a maximum of 1000 configured VLANs and given that the default configuration has all switchports in Trunk mode with Native VLAN 1 and allowed VLANs 1-1000 (consuming the 1000 limit already), Dashboard will not allow for the configuration of this design to be saved (i.e. configuring VLAN 1921/1922 as this will breach the 1000 VLANs limit). As such, ports will need to be configured with a different range or VLAN set other than the default settings before applying the configuration needed for this design. It is therefore recommended to configure ALL ports in your network as access in a parking VLAN such as 999. To do that, Navigate to Switching > Monitor > Switch ports then select all ports (Please be mindful of the page overflow and make sure to browse the different pages and apply configuration to ALL ports) and then make sure to deselect stacking ports (as you cannot change configuration on dedicated stacking ports) then click on the Edit button and configure all ports as shown below:
    • 
    • 
    • 
    • 
    •  
    • 
    • 
    • 
    • IMPORTANT - The above step is essential before proceeding to the next steps. If you proceed to the next step and receive an error on Dashboard then it means that some switchports are still configured with the default configuration. Please revisit the Switching > Monitor > Switch ports page and ensure that no ports have a Trunk with allowed VLANs 1-1000
44. Access Switch Ports Configuration; Configure Uplink Ports on your Access Switches. When you're logged in dashboard, Navigate to Switching > Monitor > Switch ports, then select your uplink ports and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard): 
    • 
    • 
    • 
45. Optional - For ease of management, it is recommended that you rename the ports connecting to your Core switches with the actual switch name / Connecting port as shown below.
    • 
46. Access Switch Ports Configuration; Configure Wired Client Ports (802.1x) on your Access Switches. Navigate to or Refresh Switching > Monitor > Switch Ports, then select your Wired Client ports (5-8) and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard): 
    • 
    • 
    • 
    • 
    • 
    • 
47. Access Switch Ports Configuration; Configure Wired Client Ports (MAB) on your Access Switches. Navigate to or Refresh Switching > Monitor > Switch Ports, then select your Wired Client ports (9-12) and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard):
    • 
    • 
    • 
48. Access Switch Ports Configuration; Configure MR Ports on your Access Switches. Navigate to or Refresh Switching > Configure > Switch Ports, then select your ports connecting to MR Access Points (13-16) and configure them as shown below. (Tip: You can filter for ports by using search terms in dashboard):
    •  
    • 
    • 
    •  
    • 
    • 
49. Optional - Access Switch Ports Configuration; Configure unused ports on your Access Switches such that they are disabled and mapped to a parking VLAN such as 999. Navigate to Switching > Monitor > Switch Ports and filter for any unused ports (e.g. 17-24) and configure them as shown below: 
    •   
50. Rename Wireless SSIDs; To configure your SSIDs per the above table, first navigate to Wireless > Configure > SSIDs then rename the SSIDs per your requirements (Refer to the above table for guidance) 
    • SSID#1 (First column, aka vap:0, enabled by default): Click on rename and change it to Acme Corp
    • SSID#2 (Second column, aka vap:1): Click on rename and change it to Acme BYOD, then click on the top drop-down menu to enable it
    • SSID#3 (Third column, aka vap:2): Click on rename and change it to Guest, then click on the top drop-down menu to enable it
    • SSID#4 (Fourth column, aka vap:3): Click on rename and change it to Acme IoT, then click on the top drop-down menu to enable it
    • Click Save at the bottom of the page
51. Configure Access Control for Acme Corp; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Acme Corp:
    •   
    • Click Save at the bottom of the page
    •  
    • Please Note: Adaptive Policy Group feature is not currently available in the New Version of the Access. You will need to click on View old version  which is available at the top right corner of the page to be able to access this and configure the Adaptive Policy Group (10: Corp). Then, please click Save at the bottom of the page
52. Configure Access Control for Acme BYOD; Navigate to Wireless > Configure >  Access control then from the top drop-down menu choose Acme BYOD:
    • 
    • Click on which is available on the top right corner of the page, then choose the Adaptive Policy Group 20: BYOD and then click on Save at the bottom of the page.
    • 
53. Configure Access Control for Guest; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Guest:
    • 
    • Click Save at the bottom of the page
    • Click on the top right corner of the page on "View Old Version"  then choose the Adaptive Policy Group 30:Guest then click on Save at the bottom of the page
    • 
    • Navigate to Wireless > Configure > SSID availability and configure broadcast via Tag = Zone 1
    • 
54. Configure Access Control for Acme IoT; Navigate to Wireless > Configure > Access control then from the top drop-down menu choose Acme IoT: (Please note that in this example Acme IoT SSID has been configured with iPSK without Radius)
    • First Navigate to Network-wide > Configure > Group policies then create a group policy for IoT devices and then click Save at the bottom of the page
    • 
    • 
    • Then, Navigate to Wireless > Configure > Access control and choose Acme IoT from the top drop-menu and configure settings as shown below, First choose iPSK without Radius from the Security menu:
    • 
    • 
    • Then, click on Add an identity PSK:
    • 
    • 
    • 
    • 
    • Click on Save at the bottom of the page
    • Click on at the top right corner of the page then choose the Adaptive Policy Group 40: IoT then click on Save at the bottom of the page
    • 
    • Navigate to Wireless > Configure > SSID availability and configure broadcast via Tag = Zone 2
    • 
55. Enabling Stacking on your MS390 and C9300 Switches in Meraki Dashboard; Please follow these steps
    1. Connect a single uplink to each switch (e.g. Port 1 on MS390-01 to Port TwentyFiveGigE1/0/23 on C9500)
    2. Make sure all stacking cables are unplugged from all switches
    3. Power up all switches
    4. Verify that your C9500 Stack downlinks are up and not shutdown

       • 9500-01#sh ip interface brief      
         Interface              IP-Address      OK? Method Status                Protocol  
         TwentyFiveGigE1/0/23   unassigned      YES unset  up                    up      
         TwentyFiveGigE1/0/24   unassigned      YES unset  up                    up          
         TwentyFiveGigE2/0/23   unassigned      YES unset  up                    up      
         TwentyFiveGigE2/0/24   unassigned      YES unset  up                    up      
         9500-01#

    5. Wait for them to come online on dashboard. Navigate to Switching > Configure > Switches and check the status of your Access Switches
       • 
    6. After they come online and download their configuration and firmware (Up to date) you can proceed to the next step. You can see their Configuration status and Firmware version from Switching > Configure > Switches 
       • 
    7. Enable stacking in dashboard by Navigating to Switching > Monitor > Switch stacks then click on add one
       • 
    8. Then give your stack a name and select it's members and click on Create 
       • 
    9. Now click on Add a stack to create all other stacks in your Campus LAN access layer by repeating the above steps
       • 
    10. Power off all access switches
    11. Disconnect all uplink cables from all switches
    12. Nominate your Primary switch for each stack (e.g. MS390-01 for stack1 and C9300-01 for stack2) 
    13. On the Primary switches, plug the uplink again
    14. Plug stacking cables on all switches in each stack to form a ring topology and make sure that the Cisco logo is upright
    15. Power on your Primary switches first, then power other stack members
    16. Wait for the stack to come online on dashboard. To check the status of your stack, Navigate to Switching > Monitor > Switch stacks and then click on each stack to verify that all members are online and that stacking cables show as connected
        • 
    17. Plug uplinks on all other non-primary members and verify that the uplink is online in dashboard by navigating to Switching > Monitor > Switch stacks and then click on each stack to verify that all uplinks are showing as connected however they should be in STP discarding mode
        • 
    18. Configure the same Static IP for all members in each stack by navigating to Switching > Monitor > Switches then click on the primary switch (e.g. MS390-01 for Stack1) and under LAN IP menu copy the IP address then click on the edit button to specify the Static IP address information (You can use the same IP address that was assigned using DHCP) then click Save. The same Static IP address information should now be copied for all members of the same stack. You can verify this by navigating to Switching > Monitor > Switches (Tip: Click on the configure button on the right-hand side of the table to add Local IP information display)
        • 
        • 
        • And on your Stack2-9300 Primary Switch:
        • 
        • 
    19. Finally, configure etherchannels on both your Access Switch Stacks and your Core Switch Stacks so that all uplinks can be operational (STP forwarding mode) at the same time. Follow these steps:
        • First, disconnect the downlinks to non-primary switches from your C9500 Core Stack (e.g. Port TwentyFiveGigE2/0/23 and TwentyFiveGigE2/0/24)
        • Navigate to Switching > Monitor > Switch ports and search for uplink then select all uplinks in the same stack (in case you have tagged your ports otherwise search for them manually and select them all) then click on Aggregate. Please note that all port members of the same Ether Channel must have the same configuration otherwise Dashboard will not allow you to click the aggergate button.
          • 
          • 
          • 
          • 
          • Please repeat above steps for all stacks in your network
          • Please note that the above step will cause all members within the stack to go offline in Dashboard
        • On your C9500 Core Stack, please configure etherchannel Settings for your downlinks such that each Stack downlinks should be in a separate Port-channel and that the mode is active:

        • 9500-01#configure terminal
          Enter configuration commands, one per line.  End with CNTL/Z.
          9500-01(config)#interface TwentyFiveGigE1/0/23
          9500-01(config-if)#channel-group 1 mode active
          Creating a port-channel interface Port-channel 1
          
          
          9500-01(config-if)#
          9500-01(config-if)#interface TwentyFiveGigE2/0/23
          9500-01(config-if)#channel-group 1 mode active
          9500-01(config-if)#interface TwentyFiveGigE1/0/24
          9500-01(config-if)#channel-group 2 mode active
          Creating a port-channel interface Port-channel 2
          
          
          9500-01(config-if)#interface TwentyFiveGigE2/0/24   
          9500-01(config-if)#channel-group 2 mode active
          9500-01(config-if)#end
          9500-01#
          9500-01#show etherchannel 1 port-channel
          Port-channels in the group:
          ---------------------------
          
          
          Port-channel: Po1    (Primary Aggregator)
          
          
          ------------
          
          
          Age of the Port-channel   = 0d:01h:42m:43s
          Logical slot/port   = 9/1          Number of ports = 2
          HotStandBy port = null
          Port state          = Port-channel Ag-Inuse
          Protocol            =   LACP
          Port security       = Disabled
          Fast-switchover     = disabled
          Fast-switchover Dampening = disabled
          
          
          Ports in the Port-channel:
          
          
          Index   Load   Port        EC state        No of bits
          ------+------+------+------------------+-----------
            0     00     Twe1/0/23      Active             0
            0     00     Twe2/0/23      Active             0
          
          
          Time since last port bundled:    0d:01h:40m:21s     Twe2/0/23
          
          
          9500-01#
          9500-01#show etherchannel 2 port-channel
          Port-channels in the group:
          ---------------------------
          
          
          Port-channel: Po2    (Primary Aggregator)
          
          
          ------------
          
          
          Age of the Port-channel   = 0d:01h:43m:56s
          Logical slot/port   = 9/2          Number of ports = 2
          HotStandBy port = null
          Port state          = Port-channel Ag-Inuse
          Protocol            =   LACP
          Port security       = Disabled
          Fast-switchover     = disabled
          Fast-switchover Dampening = disabled
          
          
          Ports in the Port-channel:
          
          
          Index   Load   Port        EC state        No of bits
          ------+------+------+------------------+-----------
            0     00     Twe1/0/24      Active             0
            0     00     Twe2/0/24      Active             0
          
          
          Time since last port bundled:    0d:01h:42m:04s     Twe2/0/24
          
          
          9500-01#9500-01#wr mem
          Building configuration...
          
          [OK]
          9500-01#
          

        • Plug all uplinks to non-primary switches
        • Now all your switches should come back online on Dashboard
          • 
        • And now all your uplinks from each stack should be in STP Forwarding mode, which you can verify on Dashboard by navigating to Switching > Monitor > Switch stacks and checking the uplink port status. Also you can check that on your C9500 Core Stack:
          • 
          • 

          • 9500-01#show spanning-tree interface port-channel 1
            
            
            Mst Instance        Role Sts Cost      Prio.Nbr Type
            ------------------- ---- --- --------- -------- --------------------------------
            MST0                Desg FWD 10000     128.2089 P2p
            9500-01#show spanning-tree interface port-channel 2
            
            
            Mst Instance        Role Sts Cost      Prio.Nbr Type
            ------------------- ---- --- --------- -------- --------------------------------
            MST0                Desg FWD 1000      128.2090 P2p 
            9500-01#show spanning-tree         
            
            
            MST0
              Spanning tree enabled protocol mstp
              Root ID    Priority    4096
                         Address     b0c5.3c60.fba0
                         This bridge is the root
                         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
            
            
              Bridge ID  Priority    4096   (priority 4096 sys-id-ext 0)
                         Address     b0c5.3c60.fba0
                         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
            
            
            Interface           Role Sts Cost      Prio.Nbr Type
            ------------------- ---- --- --------- -------- --------------------------------
            Twe1/0/1            Desg FWD 2000      128.193  P2p
            Twe2/0/1            Back BLK 2000      128.385  P2p
            Po1                 Desg FWD 10000     128.2089 P2p
            Po2                 Desg FWD 1000      128.2090 P2p
            
            
            
            
            9500-01#
            

56. Configure Multiple Spanning Tree Protocol (802.1s)  in Dashboard for MS390 and C9300 switches; Navigate to Switch > Configure > Switch settings and select your stack and choose the appropriate STP priority per stack (61440 for all Access Switch Stacks) then click Save at the bottom of the page
    • 
    • Please note that changing the STP priority will cause a brief outage as the STP topology will be recalculated. 
    • Verify that the Access Stacks are seeing the C9500 Core Stack as the root by navigating to Switching > Monitor > Switches then click on any switch and under the RSTP root menu check the root bridge information
57. Configure Dynamic ARP Inspection (DAI) on your C9500 Core Switches; All Downlinks to Access Switches and Uplinks to MX Edge must be configured as Trusted and all other interfaces as Untrusted: (Please note that the order of commands is important to avoid loss of connectivity)

    • 9500-01#show cdp neighbors
      Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                        S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                        D - Remote, C - CVTA, M - Two-port Mac Relay
      
      
      Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
      a4b4395f2a80     Twe 1/0/24        124               S    C9300-24U Port C9300-NM-8X/1
      2c3f0b0fec00     Twe 2/0/23        174               S    MS390-24  Port 1
      2c3f0b047e80     Twe 1/0/23        159               S    MS390-24U Port 1
      4ce175b0ba00     Twe 2/0/24        177               S    C9300-24U Port C9300-NM-8X/1
      
      
      Total cdp entries displayed : 4
      9500-01#configure terminal
      9500-01(config)#interface TwentyFiveGigE1/0/1
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface TwentyFiveGigE1/0/2
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface TwentyFiveGigE2/0/1
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface TwentyFiveGigE2/0/2
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface Po1
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#interface Po2
      9500-01(config-if)#ip arp inspection trust
      9500-01(config-if)#ip dhcp snooping trust
      9500-01(config-if)#exit
      9500-01(config)#ip arp inspection vlan 3,100,200,1921,1922,1923
      9500-01(config)#ip arp inspection validate src-mac
      9500-01(config)#ip arp inspection validate ip src-mac 
      9500-01(config)#ip dhcp snooping vlan 3,100,200, 1921,1922,1923
      9500-01(config)#end
      9500-01#show ip dhcp snooping
      Switch DHCP snooping is enabled
      Switch DHCP gleaning is disabled
      DHCP snooping is configured on following VLANs:
      3,100,200,1921-1923
      DHCP snooping is operational on following VLANs:
      3,100,200,1921-1923
      DHCP snooping is configured on the following L3 Interfaces:
      
      
      Insertion of option 82 is enabled
         circuit-id default format: vlan-mod-port
         remote-id: b0c5.3c60.fba0 (MAC)
      Option 82 on untrusted port is not allowed
      Verification of hwaddr field is enabled
      Verification of giaddr field is enabled
      DHCP snooping trust/rate is configured on the following Interfaces:
      
      
      Interface                  Trusted    Allow option    Rate limit (pps)
      -----------------------    -------    ------------    ----------------
      TwentyFiveGigE1/0/1              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE1/0/2              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE1/0/23             yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE1/0/24             yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/1              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/2              yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/23             yes        yes             unlimited
        Custom circuit-ids:
      TwentyFiveGigE2/0/24             yes        yes             unlimited
        Custom circuit-ids:
      Port-channel1                    yes        yes             unlimited
        Custom circuit-ids:
      Port-channel2                    yes        yes             unlimited
        Custom circuit-ids:   
      9500-01#
      9500-01#show ip arp inspection
      
      
      Source Mac Validation      : Enabled
      Destination Mac Validation : Disabled
      IP Address Validation      : Enabled
      
      
      Vlan     Configuration    Operation   ACL Match          Static ACL
      ----     -------------    ---------   ---------          ----------
          3     Enabled          Active                         
        100     Enabled          Active                         
        200     Enabled          Active                         
       1921     Enabled          Active                         
       1922     Enabled          Active                         
       1923     Enabled          Active                         
      
      
      Vlan     ACL Logging      DHCP Logging      Probe Logging
      ----     -----------      ------------      -------------
          3     Deny             Deny              Off          
        100     Deny             Deny              Off          
        200     Deny             Deny              Off          
       1921     Deny             Deny              Off          
       1922     Deny             Deny              Off          
       1923     Deny             Deny              Off          
      
      
      Vlan      Forwarded        Dropped     DHCP Drops      ACL Drops
      ----      ---------        -------     ----------      ---------
          3              0              0              0              0
        100              0              0              0              0
        200              0              0              0              0
       1921              0              0              0              0
       1922              0              0              0              0
       1923              0              0              0              0
      
      
      Vlan   DHCP Permits    ACL Permits  Probe Permits   Source MAC Failures
      ----   ------------    -----------  -------------   -------------------
          3              0              0              0                     0
        100              0              0              0                     0
        200              0              0              0                     0
       1921              0              0              0                     0
       1922              0              0              0                     0
       1923              0              0              0                     0
      
      
      Vlan   Dest MAC Failures   IP Validation Failures   Invalid Protocol Data
      ----   -----------------   ----------------------   ---------------------
          3                   0                        0                       0
        100                   0                        0                       0
        200                   0                        0                       0
       1921                   0                        0                       0
       1922                   0                        0                       0
       1923                   0                        0                       0
      9500-01#wr mem
      Building configuration...
      [OK]
      9500-01#
      

58. Configure Dynamic Arp Inspection (DAI) on your Access Switch Stacks; Navigate to Switch > Monitor > DHCP Servers & ARP and scroll down to Dynamic ARP Inspection and enable it then click Save at the bottom of the page:
    • 
59. Setting up your Access Points; Connect your APs to the respective ports on the Access Switches (e.g. Ports 13-16) and wait for them to come online on dashboard and download their firmware and configuration files. To check the status of your APs navigate to Wireless > Monitor > Access points and check the status, configuration and firmware of your APs.
    • 
60. Re-addressing your Network Devices; In this step, you will adjust your IP addressing configuration - if required - to align with your network design. This step could have been done earlier in the process however it will be easier to adjust after all your network devices have come online since the MX (The DHCP server for Management VLAN 1) has kept a record of the actual MAC addresses of all DHCP clients. Follow these steps to re-assign the desired IP addresses: (Please note that this will cause disruption to your network connectivity) 
    1. Navigate to Organization > Monitor > Overview then click on Devices tab to check the current IP addressing for your network devices
    2. Navigate to Security & SD-WAN > Monitor > Appliance status then click on the Tools tab and click on Run next to ARP Table
    3. Take a note of the MAC addresses of your network devices
    4. Navigate to Security & SD-WAN > Configure > DHCP then under Fixed IP assignments click on Add a fixed IP assignment and add entries under each DHCP Pool  as shown below for your network devices using the MAC addresses you have from Step #3 above then click on Save at the bottom of the page
       •  
       • 
       • 
       • 
    5. Navigate to Switching > Monitor > Switch ports then filter for MR (in case you have previously tagged your ports or select ports manually if you haven't) then select those ports and click on Edit, then set Port status to Disabled then click on Save. 
       • 
    6. After a few minutes (For configuration to be up to date) Navigate to Switching > Monitor > Switch ports then filter for MR (in case you have previously tagged your ports or select ports manually if you haven't) then select those ports and click on Edit, then set Port status to Enabled then click on Save. 
       • 
    7. Navigate to Switching > Monitor > Switches then click on each primary switch to change its IP address to the one desired using Static IP configuration (remember that all members of the same stack need to have the same static IP address)
       • 
       • 
    8. On your C9500 Core Stack, bounce your VLAN 3,100,200 interfaces. Then verify that the interfaces VLAN 3/100/200 came up with the correct IP address (e.g. 10.0.3.2 per this design) 

       • 9500-01#configure terminal
         Enter configuration commands, one per line.  End with CNTL/Z.
         9500-01(config)#interface vlan 3
         9500-01(config-if)#shutdown
         9500-01(config-if)#no shutdown
         9500-01(config-if)#interface vlan 100
         9500-01(config-if)#shutdown
         9500-01(config-if)#no shutdown
         9500-01(config-if)#interface vlan 200
         9500-01(config-if)#shutdown
         9500-01(config-if)#no shutdown
         9500-01(config-if)#end
         9500-01#sh ip interface brief | in Vlan 
         Vlan1                  unassigned      YES NVRAM  administratively down down    
         Vlan3                  10.0.3.2        YES DHCP   up                    up      
         Vlan100                10.0.100.2      YES DHCP   up                    up      
         Vlan200                10.0.200.2      YES DHCP   up                    up       
         9500-01#
         

    9. Navigate to Organization > Monitor > Overview then click on Devices tab to check the current IP addressing for your network devices:
       • 
61. Configure QoS in your Campus LAN; Quality of Service configuration needs to be consistent across the whole Campus LAN. Please refer to the above table as an example. (For the purpose of this CVD, Default traffic shaping rules will be used to mark traffic with DSCP values without setting any traffic limits. Please adjust traffic shaping rules based on your own requirements). To configure QoS, please follow these steps:
    1. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the Acme Corp SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. Click Save at the bottom of the page when you are done. Click Save at the bottom of the page when you are done. 
       • 
    2. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the Acme BYOD SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. 
       • 
    3. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the Guest SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. Click Save at the bottom of the page when you are done. 
       • 
    4. Navigate to Wireless > Configure > Firewall & Traffic Shaping and choose the IoT SSID from the above drop-down menu. Under Traffic Shaping rules, choose the per-client and per-SSID limits desired and select Shape traffic on this SSID then select Enable default traffic shaping rules. Click Save at the bottom of the page when you are done. 
       • 
    5. Navigate to Switching > Configure > Switch settings and under the Quality of Service menu configure the VLAN to DSCP mappings. Please click on Edit DSCP to CoS map to change settings per your requirements. Click Save at the bottom of the page when you are done. (Please note that the ports used in the below example are based on Cisco Webex traffic flow)
       • 
       • 
    6. Please ensure that your C9500 Core Stack is configured to trust incoming QoS. Here's a reference of the configuration needed to be applied:

       • 9500-01#configure terminal
         Enter configuration commands, one per line.  End with CNTL/Z.
         9500-01(config)#interface TwentyFiveGigE1/0/1
         9500-01(config-if)#auto qos trust dscp
         9500-01(config-if)#interface TwentyFiveGigE1/0/2
         9500-01(config-if)#auto qos trust dscp    
         9500-01(config-if)#interface TwentyFiveGigE2/0/1
         9500-01(config-if)#auto qos trust dscp    
         9500-01(config-if)#interface TwentyFiveGigE2/0/2
         9500-01(config-if)#auto qos trust dscp    
         9500-01(config-if)#interface TwentyFiveGigE1/0/23
         9500-01(config-if)#auto qos trust dscp
         Warning: add service policy will cause inconsistency with port TwentyFiveGigE2/0/23 in ether channel 1.
         9500-01(config-if)#interface TwentyFiveGigE1/0/24
         9500-01(config-if)#auto qos trust dscp
         Warning: add service policy will cause inconsistency with port TwentyFiveGigE2/0/24 in ether channel 2.
         9500-01(config-if)#interface TwentyFiveGigE1/0/24
         9500-01(config-if)#auto qos trust dscp
         9500-01(config-if)#end
         9500-01#show auto qos
         TwentyFiveGigE1/0/1
         auto qos trust dscp
         
         
         TwentyFiveGigE1/0/2
         auto qos trust dscp
         
         
         TwentyFiveGigE1/0/23
         auto qos trust dscp
         
         
         TwentyFiveGigE1/0/24
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/1
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/2
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/23
         auto qos trust dscp
         
         
         TwentyFiveGigE2/0/24
         auto qos trust dscp
         
         
         9500-01#wr mem
         

    7. Navigate to Security & SD-WAN > Configure > SD-WAN & Traffic shaping and make sure your Uplink configuration matches your WAN speed. Then, under Uplink selection choose the settings that match your requirements (e.g. Load balancing). Under Traffic shaping rules, select Enable default traffic shaping rules then click on Add a new shaping rule to create the rules needed for your network. (for more information about Traffic shaping rules on MX appliances, please refer to the following article). Please see the following example: 
       • 
       • 
       • 
       • 
62. Enable OSPF Routing; Navigate to Switching > Configure > OSPF routing and then click on Enabled to enable OSPF. Add the details required and create an OSPF area for your Campus Network. Then, Click Save at the bottom of the page.
    • 
    • 
63. Enable OSPF Routing on your Core Stack; Please use the following commands to add an OSPF instance and create OSPF neighbors:

    • 9500-01#configure terminal
      Enter configuration commands, one per line.  End with CNTL/Z.
      9500-01(config)#router ospf 1
      9500-01(config-router)#network 192.168.1.0 0.0.0.255 area 0
      9500-01(config-router)#network 192.168.2.0 0.0.0.255 area 0
      9500-01(config-router)#neighbor 192.168.1.1
      9500-01(config-router)#neighbor 192.168.2.1
      9500-01(config-router)#end
      9500-01#
      9500-01#show ip ospf neighbor
      
      
      Neighbor ID     Pri   State           Dead Time   Address         Interface
      192.168.2.2       1   FULL/DR         00:00:33    192.168.2.2     Vlan1922
      192.168.1.2       1   FULL/DR         00:00:38    192.168.1.2     Vlan1921
      9500-01#wr mem
      

64. Create SVI Interfaces on your Access Switch Stacks; Navigate to Switching > Configure > Routing & DHCP and click on CREATE INTERFACE and start adding your interfaces but first start with the Transit VLANs. Once you have created an interface click on Save and add another at the bottom of the page to add more interfaces. 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • 
    • Please note that the Static Routes shown above are automatically created per stack and they reflect the default gateway settings that you have configured with the first SVI interface created which is in this case the Transit VLAN interface for each Stack
65. Verify that your Core Stack is receiving OSPF routes from its neighbours:

    • 9500-01#show ip route
      Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
             D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
             N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
             E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
             n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
             i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
             ia - IS-IS inter area, * - candidate default, U - per-user static route
             H - NHRP, G - NHRP registered, g - NHRP registration summary
             o - ODR, P - periodic downloaded static route, l - LISP
             a - application route
             + - replicated route, % - next hop override, p - overrides from PfR
             & - replicated local route overrides by connected
      
      
      Gateway of last resort is 10.0.200.1 to network 0.0.0.0
      
      
      S*    0.0.0.0/0 [254/0] via 10.0.200.1
                      [254/0] via 10.0.100.1
                      [254/0] via 10.0.3.1
            10.0.0.0/8 is variably subnetted, 12 subnets, 2 masks
      C        10.0.3.0/24 is directly connected, Vlan3
      L        10.0.3.2/32 is directly connected, Vlan3
      O        10.0.11.0/24 [110/2] via 192.168.1.2, 00:04:13, Vlan1921
      O        10.0.12.0/24 [110/2] via 192.168.2.2, 00:03:56, Vlan1922
      O        10.0.21.0/24 [110/2] via 192.168.1.2, 00:04:13, Vlan1921
      O        10.0.22.0/24 [110/2] via 192.168.2.2, 00:03:56, Vlan1922
      O        10.0.30.0/24 [110/2] via 192.168.1.2, 00:04:13, Vlan1921
      O        10.0.40.0/24 [110/2] via 192.168.2.2, 00:03:56, Vlan1922
      C        10.0.100.0/24 is directly connected, Vlan100
      L        10.0.100.2/32 is directly connected, Vlan100
      C        10.0.200.0/24 is directly connected, Vlan200
      L        10.0.200.2/32 is directly connected, Vlan200
            192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
      C        192.168.1.0/24 is directly connected, Vlan1921
      L        192.168.1.1/32 is directly connected, Vlan1921
            192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
      C        192.168.2.0/24 is directly connected, Vlan1922
      L        192.168.2.1/32 is directly connected, Vlan1922
            192.168.3.0/24 is variably subnetted, 2 subnets, 2 masks
      C        192.168.3.0/24 is directly connected, Vlan1923
      L        192.168.3.2/32 is directly connected, Vlan1923
      9500-01#

66. And that concludes the configuration requirements for this design option. Please remember to always click Save at the bottom of the page once you have finished configuring each item on the Meraki Dashboard.