500-220 Engineering Cisco Meraki Solutions (ECMS) v2.2 Question and Answers

• More hardware devices than device licenses: An organization needs to have enough device licenses to cover all the hardware devices in its network. A device license is consumed by each device that is added to the network. If the number of devices exceeds the number of licenses, the organization will be out of license and will lose access to some features and support until it purchases more licenses or removes some devices4.
• Expired device license: A device license has an expiration date that depends on the license term purchased by the organization. If a device license expires, it will no longer be valid and will not count towards the license limit. The organization will need to renew the expired license or purchase a new one to avoid being out of license4.

What happens if a network loses connectivity to the Meraki cloud?

Because of Meraki’s out of band architecture, most end users are not affected if Meraki wireless APs, switches, or security appliances cannot

communicate with Meraki’s cloud services (e.g., because of a temporary WAN failure):

• Users can access the local network (printers, file shares, etc.)

• If WAN connectivity is available, users can access the Internet

• Network policies (firewall rules, QoS, etc.) continue to be enforced

• Users can authenticate via 802.1X/RADIUS and can roam wirelessly between access points

• Users can initiate and renew DHCP leases

• Established VPN tunnels continue to operate

• Local configuration tools are available (e.g., device IP configuration

https://meraki.cisco.com/lib/pdf/meraki_datasheet_cloud_management.pdf

The error message “NotNow” is seen in the Event Log on an iOS device's details page when an action cannot be performed because the device is locked with a passcode. These actions include pushing managed apps, installing profiles, and other actions. When this occurs the device will attempt to re-connect with the MDM server as soon as the device is unlocked in order to retry the action. https://documentation.meraki.com/SM/Monitoring_and_Reporting/Status_of_%22NotNow%22_in_Systems_Manager_Event_Log

Ports used to contact the VPN registry:

- Source UDP port range 32768-61000

- Destination UDP port 9350 or UDP port 9351

Ports used for IPsec tunneling:

- Source UDP port range 32768-61000

- Destination UDP port range 32768-61000

https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshooting

https://documentation.meraki.com/SM/Device_Enrollment/Containerization_with_Systems_Manager

When band steering is enabled on an SSID, APs will stop advertising that SSID in 2.4GHz beacons. Since 2.4GHz-only clients that rely on a passive scan will not “see” that SSID in beacons, they might not be able to join this SSID unless they do an active scan or have been pre-configured with the SSID name and security settings (for example, a pre-shared key). https://documentation.meraki.com/MR/Radio_Settings/Band_Steering

The number of devices in an organization can not exceed the license limits. If this occurs, the organization will enter a 30-day grace period, during which the organization must be brought back into compliance, otherwise it will be shut down until proper licensing is applied to the organization. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Co-Termination_Licensing_Overview

Verbs in the API follow the usual REST conventions:

GET returns the value of a resource or a list of resources, depending on whether an identifier is specified.

POST adds a new resource

PUT updates a resource

DELETE removes a resource

https://documentation.meraki.com/General_Administration/Other_Topics/Cisco_Meraki_Dashboard_API

On the device, navigate to Settings > General > Device Management

Select Meraki Management, and select Remove to delete the management profile and any managed configuration profiles installed via SM

Meraki MR Access Points, in combination with a wireless profile installed on the iOS device, will enable the Fast Lane technologies. The fastest way to install a wireless profile on an iOS device is via Meraki EMM. https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Wireless_QoS_and_Fast_Lane

To clarify, when an SSID is configured with Sign-On Splash page enabled, the two settings that must be configured for unauthenticated clients to have full network access and not be allow listed are:

• Controller disconnection behavior: This setting determines how the clients are treated when the Meraki cloud controller is unreachable. The options are Restricted or Unrestricted. The former option blocks all traffic from unauthenticated clients until the controller is reachable again. The latter option allows unauthenticated clients to access the network without signing on until the controller is reachable again1.
• Captive Portal strength: This setting determines how often the clients are redirected to the splash page for authentication. The options are Block all access until sign-on is complete or Allow non-HTTP traffic prior to sign-on. The latter option allows unauthenticated clients to access other protocols such as DNS, DHCP, ICMP, etc., but blocks HTTP and HTTPS traffic until they sign on. This option is recommended for compatibility with devices that do not support web-based authentication1.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/High_Density_Wi-Fi_Deployments

By default, iOS apps provisioned through Systems Manager that are found in the App Store will self-update if automatic updates has been turned on in the Settings. For custom iOS apps, or to manually push down updates, check the following steps. https://documentation.meraki.com/SM/Apps_and_Software/Updating_Managed_iOS_Apps

https://documentation.meraki.com/MV/Initial_Configuration/Privacy_Windows

This is the approximate number of APs that are needed based on client count, assuming that each AP can support up to 25 concurrent video streaming users. This can be calculated by using the formula:

Number of APs = (Number of Users x Percentage of Users on a Band) / Number of Users per AP on that Band

Where Number of Users is 100, Percentage of Users on 2.4 Ghz is 30%, Percentage of Users on 5 Ghz is 70%, Number of Users per AP on 2.4 Ghz is 15, and Number of Users per AP on 5 Ghz is 30. Therefore,

Number of APs = (100 x 0.3 / 15) + (100 x 0.7 / 30) Number of APs = (3.33) + (2.33) Number of APs = 5.66

Rounding to the nearest whole number, the number of APs is 4.

This question is related to the topic of Wireless Capacity Planning in the Cisco Meraki documentation. You can find more information about this topic in the [Wireless Capacity Planning] article or the [Best Practice Design - MR Wireless] page.

Implementing syslog versus SNMP can meet the design requirement of gathering information such as flows and client connectivity. Syslog can collect and report various types of events, such as VPN connectivity, uplink connectivity, DHCP leases, firewall rules, IDS alerts, and security events. Syslog can also provide detailed information about the flows and client connectivity on the network devices, such as source and destination IP addresses, ports, protocols, bytes transferred, etc. SNMP, on the other hand, can collect and report various statistics and information about the network devices, such as CPU utilization, interface status, memory usage, etc. However, SNMP does not provide as much information about the flows and client connectivity as syslog does.