500-220 Engineering Cisco Meraki Solutions (ECMS) v2.2 Questions and Answers

• More hardware devices than device licenses: An organization needs to have enough device licenses to cover all the hardware devices in its network. A device license is consumed by each device that is added to the network. If the number of devices exceeds the number of licenses, the organization will be out of license and will lose access to some features and support until it purchases more licenses or removes some devices4.
• Expired device license: A device license has an expiration date that depends on the license term purchased by the organization. If a device license expires, it will no longer be valid and will not count towards the license limit. The organization will need to renew the expired license or purchase a new one to avoid being out of license4.

Route Priority

Each type of route configured on the MX has a specific priority in comparison with other types of routes. The priority is as follows:

Directly Connected

Client VPN

Static Routes

AutoVPN Routes

Non-Meraki VPN Peers

BGP learned Routes

NAT*

https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior

Before deploying MXs as one-arm VPN concentrators, place them into Passthrough or VPN Concentrator mode on the Addressing and VLANs page. In one-armed VPN concentrator mode, the units in the pair are connected to the network "only" via their respective ‘Internet’ ports. Make sure they are NOT connected directly via their LAN ports. Each MX must be within the same IP subnet and able to communicate with each other, as well as with the Meraki dashboard. Only VPN traffic is routed to the MX, and both ingress and egress packets are sent through the same interface.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_Auto_VPN_General_Best_Practices

This is because the alert mentions 802.1X failure, which is a network access control method that is used with WPA2-enterprise and RADIUS servers1.

This question is related to the topic of Wireless Access Points Quick Start in the Cisco Meraki documentation. You can find more information about this topic in the Wireless Access Points Quick Start article or the Using the Cisco Meraki Device Local Status Page page.

Routed Mode:

• This mode is the default mode of operation
• This mode is generally also the default gateway for devices on the LAN
• Client traffic to the internet has the source IP rewritten to match the WAN IP of the appliance
• DHCP services can be configured on the MX appliance

Passthrough Mode:

• The MX appliance acts as a layer 2 bridge
• VLANs cannot be configured
• No address translation is provided
• This mode is not recommended at the network perimeter

This question is related to the topic of MX Addressing and VLANs in the Cisco Meraki documentation. You can find more information about this topic in the MX Addressing and VLANs article or the General MX Best Practices page.

What happens if a network loses connectivity to the Meraki cloud?

Because of Meraki’s out of band architecture, most end users are not affected if Meraki wireless APs, switches, or security appliances cannot

communicate with Meraki’s cloud services (e.g., because of a temporary WAN failure):

• Users can access the local network (printers, file shares, etc.)

• If WAN connectivity is available, users can access the Internet

• Network policies (firewall rules, QoS, etc.) continue to be enforced

• Users can authenticate via 802.1X/RADIUS and can roam wirelessly between access points

• Users can initiate and renew DHCP leases

• Established VPN tunnels continue to operate

• Local configuration tools are available (e.g., device IP configuration

https://meraki.cisco.com/lib/pdf/meraki_datasheet_cloud_management.pdf

SM Sentry enrollment can be enabled on any MR network via the Splash page section of the Wireless > Configure > Access control page. https://documentation.meraki.com/MR/MR_Splash_Page/Systems_Manager_Sentry_Enrollment

The correct answer is B and D. These are the two methods of targeting and applying management profiles to System Manager clients, according to the [System Manager: Getting Started] article. The article explains that:

• Defining the scope: This method allows you to target devices based on their network, tag, or owner. You can define the scope of a profile from the Systems Manager > Manage > Settings page or from the Systems Manager > Monitor > Overview page.
• Using device tags: This method allows you to target devices based on their attributes, such as OS, model, location, or user. You can use device tags to create dynamic groups of devices that share common characteristics. You can apply device tags from the Systems Manager > Monitor > Devices page or from the Systems Manager > Manage > Tags page.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/High_Density_Wi-Fi_Deployments

The number of devices in an organization can not exceed the license limits. If this occurs, the organization will enter a 30-day grace period, during which the organization must be brought back into compliance, otherwise it will be shut down until proper licensing is applied to the organization. https://documentation.meraki.com/General_Administration/Licensing/Meraki_Co-Termination_Licensing_Overview

These are the two features and functions that are supported when using an MX appliance in Passthrough mode. According to the [MX Addressing and VLANs] article, Passthrough mode allows the MX appliance to act as a layer 2 bridge, passing traffic between its LAN and WAN ports without performing any routing or address translation. However, some features such as intrusion prevention and site-to-site VPN are still available in this mode.

https://documentation.meraki.com/MV/Initial_Configuration/Privacy_Windows

https://documentation.meraki.com/MS/Layer_3_Switching/MS_Warm_Spare_(VRRP)_Overview

See Behavior - Firmware MX 15.11 or Lower section For MXs running firmware MX15.11 or below, the source IP that MX uses while pinging a destination is the MX IP of highest VLAN ID. If the destination is across a VPN, the MX uses the MX IP of highest VLAN ID participating in VPN. For MXs running firmware MX 15.12+, additional ping options have been added to the live tool. The ping tool now has a drop down to select the source IP address for pinging destinations from the MX. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Ping_Live_Tool

When band steering is enabled on an SSID, APs will stop advertising that SSID in 2.4GHz beacons. Since 2.4GHz-only clients that rely on a passive scan will not “see” that SSID in beacons, they might not be able to join this SSID unless they do an active scan or have been pre-configured with the SSID name and security settings (for example, a pre-shared key). https://documentation.meraki.com/MR/Radio_Settings/Band_Steering