Meraki Solutions Specialist cheat sheet

The organization is the top tier: it holds inventory, licenses, administrators, configuration templates, and API keys; networks sit inside it and contain devices.

Meraki devices initiate outbound TCP 443 sessions to the Meraki cloud and need no inbound firewall ports, static public IP, or management VPN to reach the dashboard.

Configuration is authored in the cloud and pushed to devices; if the cloud is unreachable, devices continue running their last cached configuration.

Co-termination licensing aligns every license in an organization to a single shared expiration date; claiming new hardware shifts that date based on license value and duration.

Per-device licensing gives each device an independent expiration date and permits mixing license terms inside one organization.

After a license expires the device enters a grace period of roughly 30 days before it stops passing traffic, with warnings shown in the dashboard beforehand.

Administrator roles include full organization admin, read-only organization admin, network admin scoped to selected networks, and monitor-only; SAML SSO and MFA are configured at organization level.

Configuration templates are organization-level objects; a bound network inherits template settings and cannot locally override the settings the template controls.

Early access features are opted into per organization, then enabled or disabled per network after the organization opt-in.

Zero-touch sequence: claim a serial or order number into organization inventory, assign the device to a network, then power it on with DHCP internet access so it pulls its configuration.

Devices can be moved between networks inside the same organization from the dashboard; the device reboots and adopts the destination network's settings.

Replace device retains the original configuration by swapping the failed serial for the new unit in the same network slot.

MX addressing uses WAN1 and WAN2 for uplinks plus LAN ports for downstream traffic; VLAN interfaces are defined on the MX as layer-3 gateways.

Switch access ports carry one untagged VLAN; trunk ports carry multiple VLANs with an explicit allowed-VLAN list and one native VLAN.

In NAT mode an SSID has the AP serve DHCP in a private subnet and translate client traffic to the AP address; in bridged mode clients land on a LAN VLAN.

Firmware can be scheduled for upgrade per network or applied per device, and devices auto-upgrade after a set window once new firmware is released.

Link aggregation between Meraki switches uses LACP and must be configured identically on both ends of the port group.

MX layer-3 firewall rules are evaluated top-down per VLAN and terminate in a configurable default policy, either allow or deny, for unmatched traffic.

Layer-7 firewall rules match applications and categories by traffic signature rather than port number.

An Advanced Security license is required for IDS/IPS with Snort signatures, AMP file inspection, and full URL category filtering including HTTPS inspection.

Site-to-site VPN firewall rules determine which local subnets remote Auto VPN peers may reach; the default posture is allow.

Splash page guest Wi-Fi supports click-through, dashboard-managed sign-on, RADIUS, and social login, plus a walled garden for domains reachable before authentication.

Group policies override network-wide firewall, VLAN, traffic-shaping, and content-filtering settings for matched clients, identities, or devices.

802.1X on MR uses WPA2-Enterprise with an external RADIUS server; returned RADIUS attributes can assign VLANs and group policies.

Adaptive policy applies group-to-group allow or deny rules consistently across MX, MS, and MR regardless of subnet or VLAN numbering.

Alerts are configured per network and delivered by email, SMS, or webhook for conditions such as device offline, uplink down, or usage thresholds.

Packet capture is available on MX, MS, and MR with interface, filter, and duration options, producing a downloadable pcap file.

MX live tools include ping, traceroute, ARP and routing tables, cable test, and throughput or uplink performance tests.

Meraki Insight measures web application response time and attributes delay to the client, LAN, WAN, or the server side.

The event log records configuration changes and device events, is filterable by time and keyword, and retains data for roughly 30 days.

Syslog export streams flows, URLs, security events, and appliance or switch event logs to an external syslog server.

Summary reports are scheduled email/PDF reports of usage, health, and security data delivered daily, weekly, or monthly.

Wireless health views report client counts, signal quality, channel utilization, and RF spectrum per access point and per band.

The REST base URL is https://api.meraki.com/api/v1, and organization or network IDs form the resource path in each call.

Authentication uses the X-Cisco-Meraki-API-Key header; a key inherits the permissions of the administrator who generated it.

The rate limit is about 10 requests per second per organization; exceeding it returns HTTP 429 with a Retry-After header.

List endpoints paginate, so follow the Link header rel="next" URL and raise perPage to reduce the number of calls.

Action batches submit many configuration actions in one asynchronous call and are tracked through the batch status endpoint.

Webhooks post JSON alert payloads to an HTTPS receiver; fields include alertType, alertLevel, device serial, network ID, and timestamp.

Scanning API pushes MR location analytics to a customer-hosted endpoint after the scanner is validated with a dashboard-provided token.

SNMP v2c and v3 are enabled per network to poll device, interface, and wireless metrics using published Meraki MIBs.