Meraki

Mloraditch

A pinhole reset is the only way I know of for a device to be factory reset, if that didn't happen and you are getting the alert, I'd check with support.

Mloraditch

I suspect you may have slightly different encryption settings between the two sites. Perhaps one is WPA3 transition and the other is WPA2 (this is just an example)? Devices will discover the specific encryption of an ssid when they first join and save it. They will not be able to connect to an identically named SSID with different encryption without forgetting the ssid.

Mloraditch

The partner comms on this model was nearly silent as well. 🤦‍ I didn't know about it until you posted and found one webinar that apparently happened a few weeks ago on salesconnect.

Mloraditch

Aggressive mode could only be enabled by support and I believe it was removed in MX15 so I would essentially consider it not available as those older firmware versions are also not supported at this point. Documentation involving it has also been mostly removed.

Mloraditch

There is not, this where an SNMP monitoring system would be more useful. The only other thing is you can use multiple tags, you could create a separate tag that encompasses all your ports that need alerting.

Mloraditch

Just to answer these questions: Who is support manager of Cisco? There are various folks in the support organization. You can always ask to speak to a manager when talking to the tech on your case Who is escalating things to the devs? Support Escalates these things, each new report of a bug does get get linked to the bug and helps escalate it. Do Cisco employees check their community threads? They do but only a support case can officially link to the bug. I do strongly recommend that both of you work with your Cisco Reseller/partner to communicate with your Meraki Account Manager. They can bring extra attention to the issue.

Mloraditch

There have been the multiple known issues with reboots for that model for a while. You are certainly not the only customer with the issue. The important thing is to report the issues, as you have, to help raise the priority of the bug with the developers. I certainly understand your frustration, you can also raise the issue with your account manager who may be able to help push the issue as well.

Mloraditch

The CC macs are usually the HA (VRRP) macs of MXs. As to the rest of the MACs, MACs are assigned by the IEEE to manufacturers and they then assign them to the devices. Any rhyme or reason to the leading digits and where they are assigned is generally going to be purely coincidence.

Mloraditch

You have to create a network of the type Systems Manager

Mloraditch

If something in a specific website isn't loading it's likely either content filtering, or Layer 7 firewall rules. The event logs may clear that up or you can always call support. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_a_Layer_7_Firewall_Rule

Mloraditch

Once you have tags you can set up those type of alerts under network wide, alerts. https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network_Alerts_and_Notifications#:~:text=Note%3A%20Alerting%20for%20a%20specific,Switching%20%3E%20Monitor%20%3E%20Switch%20ports. For an actual report you'd probably need to pull data via the API or setup webhooks. You could also use SNMP monitoring, but the alerts probably wouldn't be needed in that case.

Mloraditch

I definitely recommend calling Meraki support.

Mloraditch

That allow list would only apply to content filtering. AMP has an allow list, but IPS doesn't have a traditional one, and Geo Filtering doesn't at all.

Mloraditch

I would guess the issue (if it's a Meraki issue) is Geo Blocking on your Layer 7 firewall settings. There have been many issues over the years with IPs getting loaded into the wrong country by the provider of that database. The best you can do is open a support case to determine fully and then they can alert the provider and then turn off the misidentified country until its fixed. It's also possible some other thing like URL filtering/AMP/IDS have a similar issue where a bad definition/signature has been loaded. You may be able to look in event logs and identify, but I'd just call support. They should be able to find it quickly and will need to log a case to get the data resolved if that's the issue.

Mloraditch

I suggest looking at getting started https://developer.cisco.com/meraki/api-v1/getting-started/ and go from there. I find postman pretty helpful for what I need to do. You could definitely do what you need with a runner in there. Not super pretty but you would get results you could combine and then parse. There are plenty of resources out there on the internet to learn and test with Postman or Python in a general sense.

Mloraditch

I am not aware of any Apple feature to push files out MDM or otherwise. There are definitely options for kiosk mode type things but this would not be a meraki feature per se. You'd just deploy the app of your choice. If your clients just want prestaged videos available to play when desired a shared folder app on a shared account might be your best option.

Mloraditch

The API is going to be your friend here: https://developer.cisco.com/meraki/api-v1/get-network-clients/ You should be able to iterate through your networks, filter by online and then just filter out guest users in the resulting data

Mloraditch

The list must be less than a 1000 vlans total. Your list is well over a thousand So 1-998,1100,1200 would be valid for an example or 1-500,600-700,1100-1200 and so on

Mloraditch

Have you packet captured the switch port connected to the physical host where the docker is? You need to see if the packets are actually leaving the host, if they are, then you can probably easily call Meraki support and find where the issue is. Your topology seems sound, but based on the one way traceroute it seems the hangup may be in the docker host. If that's the case you may need to get some help from a linux resource. Although who knows what our fellow members might know! 🙂

Mloraditch

Yes that makes sense once all is updated you should be good

Mloraditch

As long as the AP you want to be meshed can see another working AP it will come online. Your theory is correct. You do not need to configure anything else. More details here: https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Wireless_Mesh_Networking

Mloraditch

There have been discussions over the years: https://community.meraki.com/t5/Developers-APIs/Network-Config-Template-API-Download/m-p/95063 But based on the documentation and what I'm reading, some API calls may work when using the template as the network ID, but other than this set of endpoints: https://developer.cisco.com/meraki/api-v1/create-organization-config-template/ there are no specific API calls to work with Templates. The very explicit error you got unfortunately further indicates the limitations.

Mloraditch

There is a known cisco bug related to the error: https://bst.cisco.com/bugsearch/bug/CSCwh17392?rfs=qvred Is this is MAC? or have you recently updated your client profile? There could be something misformatted/typed in the XML

Mloraditch

There is a new(ish?) option in the GUI for TLS for syslog: I don't look at that field often, but often enough that I think I'd have seen it before. The documentation page also doesn't mention it yet. I suspect they are in the middle of rolling this feature out and it will only work on newer models or firmware and perhaps the gui stuff isn't working right. I would call support and make them aware.

Mloraditch

Considering the whole platform is end of life, if my renewal was coming up I would be investigating alternatives and determining if I could afford to switch to something else, or maybe renew for a shorter term while I came up with a plan

About Mloraditch

Mloraditch

Matthew Loraditch

Community Record

Badges