How long should the recovery / setup take?

For most Meraki MX/MR/MS Cisco Real World Problems cases, allow 15-45 minutes the first time. Repeats are usually under 10 minutes once you know the menu path.

Will this exact procedure work on every Meraki MX/MR/MS model?

The procedure reflects current Meraki MX/MR/MS behaviour. Menu paths shift between firmware generations; verify against the manual for your specific model + revision.

Is the procedure safe in production / live use?

Apply during a maintenance window where possible. Capture pre-change state. Meraki MX/MR/MS doesn't usually publish rollback procedures, so make sure you can restore manually.

Does this affect my Meraki MX/MR/MS warranty?

Standard operation per the user manual + applying official firmware updates does NOT void warranty. Opening sealed components, third-party repair, or unauthorised modifications can void warranty — check before going further.

Cisco Real World Problems

How to configure IPv6 DHCPv6 PD prefix delegation on Meraki MX/MR/MS

By Sai Kiran Pandrala · Cisco network engineer · Last verified: 2026-06-05

Why this matters on a Meraki MX

How do I get an upstream /56 delegated and split it cleanly across downstream VLANs? On a Meraki MX/MR/MS stack, the answer is rarely "copy a vendor template and ship it." The cloud-managed SD-WAN edge role this box plays decides how every knob in the IPsec or IPv6 stack ought to be tuned. Get the role wrong, and even a textbook config will give you flapping SAs, prefix-delegation black holes, or RAs reaching the wrong VLAN. I've watched ESS Bengaluru chase a IPv6 DHCPv6 Prefix Delegation (PD) bug for three days that boiled down to a wrong assumption about the Meraki MX's role in the path. We'll skip that detour here.

Quick cost framing before we touch CLI: MX85 hardware is ₹2.3L / $2,750 and the Advanced Security licence is ₹68k / $820 per year. That number matters because the second a SmartNet escalation comes into play, your weekend just got expensive. The procedure below keeps the work inside the box's existing entitlements.

Field story (why I wrote this guide)

In November, a Redington-resold branch office in Bengaluru tried to dual-stack its WAN against a Tata Tele upstream that delegated a /56 via DHCPv6-PD. The Meraki MX/MR/MS stack accepted the prefix on the WAN, but downstream VLANs got nothing, no RAs, no addresses, end users blamed the firewall as usual. The Wireshark 4.2 capture on the LAN showed RAs were missing because I had not set 'ipv6 nd ra suppress no' on the SVIs after the upgrade to IOS-XE 17.12. Twenty minutes of config work, no licence cost, no ticket to TAC. Saved the branch a ₹26,000 SmartNet escalation per device. GeM tender documents stored on the on-prem Synology were back online before lunch.

Prereqs before you log in

A maintenance window of at least 45 minutes: 75 if this is the first time on a Meraki MX.
Console access via Putty 0.78 or SecureCRT 9.4 (don't trust SSH alone if the IKE policy is about to change under you).
A pre-change show running-config | section crypto capture and a show ipv6 interface brief capture, saved to a Comsys Mumbai-style change record so you can roll back.
Latest stable train. For most Meraki MX deployments in 2026, that's IOS XE 17.12.4 or 17.15.1, depending on TAC's current recommended SR train.
NTP locked to a known-good source, clock drift will kill cert-based IKEv2 inside 5 minutes.
If the box is in inventory on Catalyst Center / DNA Center, deactivate compliance enforcement for the window so it doesn't snap the config back.

Tools I keep on the bench

The kit hasn't changed much in two years, and I won't pretend it has just to look fancy. Wireshark 4.2 with the dhcpv6 filter, tcpdump 4.99 on the WAN uplink, Cisco DNA Center for IPv6 assurance. On the licensing side, Cisco DNA Center is the single source of truth when this work touches a fabric; Putty 0.78 and SecureCRT 9.4 remain the console clients I trust. For PSIRT and design references, I leave Cisco's documentation tab pinned to the model number for Meraki MX so I'm not chasing the wrong sysguide.

Step-by-step

Confirm the role. The Meraki MX is being used as the cloud-managed SD-WAN edge. If somebody else has hand-jammed it into another role, stop and fix that first.
Stage a clean session. Connect via Putty 0.78 on COM3 at 9600/8/N/1 for hardware, or SecureCRT 9.4 SSH for the controllers. Enable session logging. Cisco TAC will ask for it.
Snapshot pre-change state. Save the running-config, the relevant crypto / IPv6 show output, and ARP / ND tables. Tag the file with the GeM change ticket number.
Push the IPv6 DHCPv6 Prefix Delegation (PD) config. Use the block below. Adjust addressing and naming for the specific Meraki MX you're touching.
Verify with read-only commands. Don't move on until every verification command returns what you expect.
Run a controlled traffic test. For IPsec, ping across the tunnel with explicit source. For IPv6, plug a Wireshark 4.2 capture into the LAN and watch the RA / DHCPv6 dance.
Commit + close. 'write memory', export the new config to the SolarWinds NCM baseline, then re-enable compliance enforcement on Catalyst Center.

CLI block (paste-ready, then adapt)

! WAN side: ask for a /56 delegation
interface GigabitEthernet0/0/0
 ipv6 enable
 ipv6 address autoconfig default
 ipv6 dhcp client pd hint ::/56
 ipv6 dhcp client pd UPSTREAM-PD rapid-commit
!
! LAN sub-allocation: carve /64s out of the delegated /56
interface Vlan10
 description USERS-VLAN
 ipv6 enable
 ipv6 address UPSTREAM-PD ::10:0:0:0:0/64 eui-64
 ipv6 nd other-config-flag
 no ipv6 nd ra suppress
!
interface Vlan20
 description IOT-VLAN
 ipv6 enable
 ipv6 address UPSTREAM-PD ::20:0:0:0:0/64 eui-64
 ipv6 nd other-config-flag
 no ipv6 nd ra suppress
!
ipv6 dhcp pool POOL-OTHERS
 dns-server 2001:4860:4860::8888
 domain-name howtofixme.local
!
interface Vlan10
 ipv6 dhcp server POOL-OTHERS
!

That block assumes you've already added a loopback for management, a default route or BGP-learned next-hop for the tunnel destination, and the WAN interface is up/up. If any of those is missing, everything above will silently no-op.

Verification commands

show ipv6 dhcp interface
show ipv6 dhcp pool
show ipv6 general-prefix
show ipv6 interface brief
show ipv6 route ::/0
debug ipv6 dhcp detail
debug ipv6 nd

I keep a small text expander in SecureCRT 9.4 for this block. Saves three minutes per device and, more importantly, stops me from forgetting the 'detail' qualifier on a Meraki MX when I'm tired.

What good logs look like

On a healthy bring-up, expect a tight sequence in syslog. Things you should see: %LINEPROTO-5-UPDOWN on the tunnel interface flipping to up, %SYS-5-CONFIG_I when you commit, and clean IKE_AUTH success messages for IPsec cases. Things that scream trouble: %DHCPV6C-5-PD_PREFIX, %DHCPV6C-5-BIND, %IPV6_DHCPC-5-CONFIG, or the dreaded %SPANTREE-2-RECV_PVID_ERR if you accidentally bled the new SVI into the wrong VLAN. Save the syslog to a SolarWinds / Logstash sink before the rekey timer hits 12 hours, that's when the long-tail bugs surface.

Platform quirks that catch people out

Meraki dashboard handles IKEv2 phase parameters for you. Anything not in the dashboard JSON literally cannot be configured: there is no CLI fall-back. If a non-Meraki peer needs aes-gcm-256, open a Meraki support case rather than try to hack it.

India-specific notes

Procurement path. Most new Meraki MX deployments in 2026 come through Redington or Ingram Micro for resale. GeM tender wins push the same SKUs through ESS Bengaluru and Comsys Mumbai. Lead times in Q2 2026 were 8-11 weeks for Catalyst 9300/9500 and 14-18 weeks for Nexus 9000.
SmartNet pricing. Annual SmartNet for the SKUs in this guide runs between ₹85,000 and ₹2 lakh / $1,000-$2,400 depending on speed of replacement tier. Plan for it, TAC quality drops noticeably without an active contract.
NTP source. ntp.bsnl.in or in.pool.ntp.org work fine; do NOT lean on a single domestic source for cert-based crypto.
SP IPv6 readiness. Jio and ACT are clean dual-stack in 2026. Tata Tele and BSNL still vary by POP. confirm before you push DHCPv6-PD into production.

Rollback plan

Two layers. First, keep a copy of the pre-change running-config in flash:/backup-pre-2026-06-05.cfg so 'configure replace' is one command away. Second, keep a printed copy of the rollback CLI on the desk; if the change kills your SSH path, the printed copy is what stops a panicked drive across town. I'll never forget the time I lost SSH to a Catalyst 9500 in a Mumbai bank vault and had to call security to escort me through three doors at 11 p.m. just to reach the console.

When to escalate to Cisco TAC

Two failed IKE_AUTH cycles with identical %CRYPTO error and no config change between them.
Any crash dump in flash:/crashinfo_* dated after the change window.
A licence that shows as 'not registered' after the change but was registered before, that's a Smart Licensing telemetry breakage, and TAC will need the Smart Account ID.
Anything in syslog that mentions 'NXOS-1-FATAL' or 'IOSXE_INFRA-3-ERRMSG_DBG': those are kernel-level warnings, not config bugs.

Cost tradeoffs and timing

If you're sizing the work for a SOW, my rule of thumb on a Meraki MX: 60 minutes of engineer time for the first device, 25 minutes per device after that, plus 15 minutes per device for documentation. At a Comsys Mumbai bill rate of ₹3,800 / $46 per hour, a 20-device rollout lands around ₹38,000 / $460 in labour. Compare that with the cost of NOT doing it: a single SmartNet escalation for an after-hours sev-2 ticket is ₹85,000+, and a security-finding fine on GeM-tendered infrastructure can be several lakh. The maths favours getting it right the first time.

Frequently asked questions

How long does this take on a Meraki MX the first time?

Plan for 60-90 minutes the first time, 25-30 minutes per subsequent device once you've cached the CLI blocks in SecureCRT 9.4. Catalyst Center workflows add 10-15 minutes per device for the deploy.

Will this affect my Cisco SmartNet warranty?

No. Pushing a supported config via the documented CLI is normal operation. SmartNet covers hardware RMA and TAC access; nothing in this procedure voids it. What WILL void coverage is a non-Cisco optic or a third-party flash card, keep those clear of the gear.

Is this safe to run in production on a Meraki MX?

Yes, inside a maintenance window with a captured pre-change config and a tested rollback. Do not run it during business hours on a single-path box. A 10-minute SA flap during business hours can cost a tendered SLA payout.

Do I need a paid licence for this?

MX85 hardware is ₹2.3L / $2,750 and the Advanced Security licence is ₹68k / $820 per year. The procedure stays inside that existing entitlement; you're not unlocking anything new. If you do hit a licence-gated feature, the running config will reject the command with %SYS-5-CONFIG_I and a hint about the missing licence. not a silent failure.

What about IPv4-only environments?

For the IPsec topics, the dual-stack notes are optional. For the IPv6 topics, this guide assumes you've already enabled ipv6 unicast-routing and have at least one upstream IPv6 path. If you don't, fix that before any of the steps above will do anything.

How often should I rotate the credentials / certs?

For PSK-based IKEv2, every 12 months is a sensible rhythm, sooner if a contractor with the secret leaves the team. For cert-based IKEv2, follow your CA's renewal cadence, usually 365 or 730 days: and stage the renewal 30 days before expiry. For DHCPv6-PD and SLAAC, there's nothing to rotate, but rebuild the documentation every 6 months because IPv6 plans drift fast.