Onboarding IOS XE Based Secure Routers into Dashboard
Prerequisites
Supported Devices
The following Generation-2 Secure Routers are available for use with Dashboard management:
-
C8455-G2
-
C8355-G2
-
C8235-G2
General Information
- A new organization, specifically for use with IOS XE Based Secure Routers is recommended.
- An organization may only have AutoVPN enabled for 1 device type. This may be either IOS XE Secure Routers or MX/Secure SD-WAN Routers
- A new network will need to be created.
- The Cloud ID of the IOS XE Based Secure Router will be required
- If intending to leverage Configuration Source: Device, a username with privilege 15 will be required.
When removing a device from a network a factory reset will be required in order to re-onboard the device.
BUNDLE mode (.bin) for Software Images is not supported. INSTALL Mode (.conf) is required.
Firmware Version
IOS XE Based Secure Routers require firmware version 26.1.1 or higher for Dashboard management.
ROMMON Operational Mode
Onboarding an IOS XE based Secure Router into Dashboard requires the device to be set to ‘Autonomous Mode’.
The Mode of a device can be verified as described within this guide.
The mode of a device can be changed by using the following commands:
controller-mode enable switches the device to controller mode
controller-mode disable switches the device to autonomous mode
Connectivity & Firewalling
Onboarding an IOS XE based Secure Router into Dashboard requires connectivity and reachability to Dashboard services. IP and Port information associated with Dashboard services are located within this guide.
Additional Configuration (Configuration Source: Device Only)
The following items are required for onboarding a Router into Dashboard with Configuration Source: Device:
Authentication, Authorization, and Accounting
Router(config)#aaa new-model
Router(config)#aaa authentication login default local
Router(config)#aaa authorization exec default local
A privilege 15 user must also be configured. The recommended configuration should leverage a password which is:
- Minimum of 8 characters
- Contains at least 1 upper case character
- Contains at least 1 lower case character
- Contains at least 1 special character
- No username similarity
- No default key words
- No character substitution
An example is provided below:
Router(config)#user unit17manager privilege 15 password This1MeetsRequirements!
IP Addressing
An IP Address with the ability to reach Dashboard is required in order to onboard and manage a device. DHCP is enabled on WAN Interfaces by default.
A static IP Address may be configured via the local status page, as described below, or via the configuration terminal of a device.
If it is intended for the device to be onboarded into Configuration Source: Cloud, note that all configuration is erased during the onboarding process. In order to maintain a static IP address through the onboarding process for Configuration Source: Cloud, it is necessary to configure addressing via the Local Status Page.
Per-Platform WAN Interface Table
Each platform has a designated Primary and Secondary WAN interface. Please refer to the table below to identify which interface is used for primary WAN connectivity.
Note: The primary WAN of a device should be used for onboarding.
|
Platform Name |
Interface ID |
Function |
|
C8455-G2 |
11 |
Primary WAN |
|
C8455-G2 |
10 |
Secondary WAN |
|
C8355-G2 |
0/0/9 |
Primary WAN |
|
C8355-G2 |
0/0/8 |
Secondary WAN |
|
C8235-G2 |
0/0/9 |
Primary WAN |
|
C8235-G2 |
0/0/8 |
Secondary WAN |
Configuring a WAN IP Address with Local Status Page
For scenarios where DHCP is not available, it is possible to configure WAN IP addressing via the Local Status Page.
The local status page can be accessed via the Management interface. Addressing assigned when connecting to the management interface is outlined below:
-
Subnet: 10.128.128.128
-
Gateway: 10.128.128.130
-
Netmask: 255.255.255.240
Note: DHCP is enabled on the management interface. Connectivity into a client facing data VLAN is not recommended.
The local status page may be accessed via HTTPS at 10.128.128.130, or by URL at:
Onboarding
Optional: Organization Creation
A dedicated organization for IOS XE Based Secure Routers may be required. An organization may only support AutoVPN enablement for each device type (IOS XE Based Secure Router or MX/SD-WAN Secure Router)
Creation of a new organization is detailed in this guide.
Network Creation
A new network should be created prior to claiming your device. This network type should be a 'Security Appliance' or 'Combined'
Additional details on creating a new network are detailed in this guide.
Claiming a Device
The standard device claiming process may be used in order to join the device into the organization's inventory. Details on this process are available in this guide.
Configuration Source: Cloud
The following device related prerequisites must be performed prior to onboarding:
- Latest firmware image (26.1.1+) has been downloaded and installed onto the device in install mode
- An uplink has been connected to the device
- Primary uplinks is the highest numbered layer-3 interface
- A transport which does not require 802.1q VLAN Tagging is in use
- A review of Uplink Auto-Configuration and Configuration Updater for IOS XE Based Devices has been performed
This step assumes the following Dashboard related connectivity & management functions have been performed:
- IP Addressing has been configured, or DHCP has been successful
- Firewall exceptions have been confirmed
- Device(s) have been claimed into Organization Inventory
- A new 'Security Appliance' or 'Combined' type network has been created
Once a device has been onboarded into Configuration Source: Cloud mode, the console and local CLI/SSH is disabled. If the device is to be offboarded into Autonomous mode or Configuration Source: Device, a factory reset via the reset button must be issued after removing the device from Dashboard. If migrating from Configuration Source: Cloud to Autonomous mode, please use the 'factory-reset all' function in order to remove the ROMMON variable associated with Configuration Source: cloud.
Consent token access will be required in order to access the local CLI console. To gain access, please contact technical support.
Detailed steps to onboard a device into a network in Configuration Source: Cloud are below:
From the 'Organization' -> 'Inventory' page, select the checkbox next to the device intended to be managed, then select 'Add to Network'
Select the network desired from the drop-down menu.
After selecting 'Next', select 'Configuration Source: Cloud'
After selecting 'Next', review the information provided and confirm the device/network details.
Permit some time for configuration fetch to take place. Fetch should succeed within 15 minutes for initial onboarding.
Configuration Source: Device
This step assumes the following items have been performed:
- AAA Has been configured, including the required privelage 15 user
- IP Addressing has been configured, or DHCP has been successful
- Firewall exceptions have been confirmed
- Device(s) have been claimed into Organization Inventory
- A new 'Security Appliance' or 'Combined' type network has been created
Detailed steps to onboard a device into a network in Configuration Source: Device are below:
From the 'Organization' -> 'Inventory' page, select the checkbox next to the device intended to be managed, then select 'Add to Network'
Under 'Existing network', select the recently created network.
Enter the username, password, and enable password configured during initial device bring-up & prerequisite configuration. Select next.
Permit some time for configuration fetch to take place. Fetch should succeed within 15 minutes for initial onboarding.
Troubleshooting
The following items detail troubleshooting which may be performed in the event of failed onboarding.
Validate Cloud Connection Service
Dashboard connectivity is managed by a process called 'cloud-mgmt'. Validation of it's presence in startup and running configuration can be done as shown below:
Router#show run | in service
service cloud-mgmt connect
Router#show startup-config | in service
service cloud-mgmt connect
Validate Cloud Connection Status
Cloud connectivity will always be in a 'Failed' state until a device has been added to a Dashboard network
Upon validating that the cloud-mgmt service is set to launch at startup, and that it is currently enabled, validation of the status of the service should be performed as detailed below:
Router#show cloud-mgmt
Chassis Serial Migration
Num PID Number Cloud ID Mac Address Status Mode
-----------------------------------------------------------------------------------------------
1 C8235-G2 FGL2922L5GM REDACTED REDACTED Registered C8K-C [Monitoring]
Detailed information regarding the status of cloud connectivity may be run from the configure terminal:
Router#show cloud-mgmt connect
Service cloud-mgmt connect: enable
Cloud-Mgmt Tunnel Config
------------------------------------
Fetch State: Config fetch succeeded
Fetch Fail:
Last Fetch(UTC): 2025-11-21 19:26:24
Next Fetch(UTC): 2025-11-21 20:38:58
Config Server: cs219-2037.meraki.com
Primary: usw.nt.meraki.com
Secondary: use.nt.meraki.com
Client IPv6 Addr: REDACTED
Network Name: Gorman Home Router
Cloud-Mgmt Tunnel State
------------------------------------
Primary: Up
Secondary: Up
Primary Last Change(UTC): 2025-11-21 19:26:30
Secondary Last Change(UTC): 2025-11-21 19:26:30
Client Last Restart(UTC): 2025-11-21 19:26:24
Cloud-Mgmt Tunnel Interface
------------------------------------
VRF:
Status: Enable
Rx Packets: 7950
Tx Packets: 7638
Rx Errors: 0
Tx Errors: 0
Rx Drop Packets: 0
Tx Drop Packets: 0
Rx Packets (Last 5s): 0
Tx Packets (Last 5s): 0
Rx Errors (Last 5s): 0
Tx Errors (Last 5s): 0
Rx Drop Packets (Last 5s): 0
Tx Drop Packets (Last 5s): 0
Cloud-Mgmt Device Registration
------------------------------------
url: https://catalyst.meraki.com/nodes/register
Device Number: 1
PID: C8235-G2
Serial Number: FGL2922L5GM
Cloud ID: REDACTED
Mac Address: 00:00:00:00:00:00
Status: Registered
Timestamp(UTC): 2025-11-21 17:51:12
Restarting the cloud-mgmt service
The cloud-mgmt service may be restarted by inputting the following from the configure terminal:
Router(config)#no service cloud-mgmt connect
service cloud-mgmt connect has been disabled.
Router(config)#service cloud-mgmt connect
Verify Uplinks (Configuration Source: Cloud)
Router#show uac uplink db
Uplink Autoconfig: Enable
Uplink Allow-list enforce: IPv4:Yes IPv6:Yes
IPV4 Uplink: TenGigabitEthernet0/0/9
Ping Pass Count: 104
GW ARP Pass Count:207
IPv4 Preferred Uplink : Same as Selected Uplink
IPV6 Uplink: None
Ping Pass Count: 0
GW ARP Pass Count:0
IPv6 Preferred Uplink: TenGigabitEthernet0/0/9
Ping Pass Count: 0
GW ARP Pass Count:0
IfName Score State IPAddress Subnet/Prefix ARPFail PingFail GWProbe Ping ReScore Allowed
Te0/0/8 4 9 10.8.30.54 255.255.255.0 0 0 2C084 2C084 0 1
Te0/0/9 8 11 10.8.31.51 255.255.255.0 0 0 C02AC8 C02AC8 0 1
Common Issues
Received Bad Reply From Dashboard
Most commonly a result of a device not being added into a Dashboard network
Router#show cloud-mgmt connect
Service cloud-mgmt connect: enable
Cloud-Mgmt Tunnel Config
------------------------------------
Fetch State: Not up to date
Fetch Fail: Received Bad Reply
Last Fetch(UTC): 2025-11-21 19:26:24
Next Fetch(UTC): 2025-11-21 20:38:58
Config Server: cs219-2037.meraki.com
Primary: usw.nt.meraki.com
Secondary: use.nt.meraki.com
Client IPv6 Addr: REDACTED
Network Name: Meraki Admin Network
Key Logs
The following logs and outputs will greatly assist the technical assistance center (TAC) in providing timely responses.
- show tech
- show cloud-mgmt
- show cloud-mgmt connect