Meraki

RaphaelL · ‎Jul 29 2019

This is what I got from support : After gathering the data and discussing this with our Engineering team we've determined that this is the expected behavior for MX devices using 802.1X based authentication. The current reauthentication timer on the MX is set at 3600s / 1hr, and I've confirmed that unfortunately at this time we are unable to change that value at all, so this is all working as expected in this situation from what we can see. I'm still worried about the DHCP renew at every reauth. I don't think that is a expected behavior...

RaphaelL · ‎Jul 17 2019

I don't know about the SDK but I'm using this : import os proxy = 'proxyURL' os.environ['http_proxy'] = proxy os.environ['HTTP_PROXY'] = proxy os.environ['https_proxy'] = proxy os.environ['HTTPS_PROXY'] = proxy works like a charm.

RaphaelL · ‎Jul 17 2019

No worries ! That is part of the issue , there is 0 settings for MAB / 802.1X on the MX ( except de radius port and server ) and I can't find any documentation from Meraki. I think I will have to open a support ticket about this one and post the result here.

RaphaelL · ‎Jul 17 2019

There is no switch in the situation the devices are directly plugged into the MX. Device -> MX -> ISE. In that case the MX is the Authenticator.

RaphaelL · ‎Jul 17 2019

Thank you , but I'm well aware of the situation of the MX68 , the log below is exactly the same for all our MX65(W) , should have mentioned it.

RaphaelL · ‎Jul 16 2019

Hi , This is a fairly complex issue. We are running the 14.39 firmware with MX65(W) and MX68. We activated the 802.1X / MAB auth ( hybrid ) and since that activation every device is renewing it's DHCP lease every single hour ( 1 hour 16-18 secs ) This is annoying because it is flooding our logs and the lease we are giving to our devices are 24h ( should renew at 12h ) This is affecting all our 2k teleworker. Devices that are authenticated via MAB do not renew every hour. Cisco IP phones ( multiple models , also do not renew but are reauthing every hour ). In Cisco ISE we don't see anything suspicious and everything is working fine on our MS. MX is a different story. See the logs below : As anyone seen this issue ?

RaphaelL · ‎Jun 18 2019

I guess there are 2 types of straight people also. People that are open minded and people that feel intimidated by a temporary logo supporting a good cause. Thanks and have a great day.

RaphaelL · ‎Jun 5 2019

Well another case this morning , a teleworker reported some issue with his MX : Latency dropped right after the reboot but is still high. Maybe a 3rd reboot would fix it.

RaphaelL · ‎May 29 2019

Even with the latest firmware it is not available : Support : Wired 802.1x is planned for the MX67/68 platform, however, it is unfortunately, not available at this time. Support does not have an ETA of when this will be available and what firmware build will include this feature. Let us know if you have any further questions.

RaphaelL · ‎May 29 2019

Ah ! I think we had our Meraki Rep to enable this feature for us. It is the only explanation that I can give for the moment. EDIT : Tested and ... not working with 14.39 firmware and MX67/MX68 series. Seems like you are right about it. I will test the latest version and report the results

RaphaelL · ‎May 29 2019

Here is a screenshot. This is a template for our MX65-68. Access policy is hybrid ( MAB and 802.1x ) and it is working like a charm

RaphaelL · ‎May 29 2019

Well , We have over 300 MX68 with 802.1X enabled and over 1200 MX65. We are running the 14.39 firmware.

RaphaelL · ‎May 28 2019

I'm still monitoring it every morning . At the moment everything is fine , but I'm pretty sure It will comeback at 4th time

RaphaelL · ‎May 24 2019

Well that is my issue , the teleworker wasn't home , the only device that was plugged is a Cisco phone 7945. No unsual traffic was detected and it is not a ISP issue in that case. After the reboot it's back to 20ms and probably that this weekend it will climb back to 1000ms and I will have to reboot it. We have a few ( 5-10 on 2000 ) that have this behavior. Really weird. Support didn't find anything unusual on the MX.

RaphaelL · ‎May 23 2019

We are now monitoring Windows logging times and we have found that people on Meraki MX have a way worse experience than people working on-site. After analysing some cases ( as the one below ), we noticed that the latency rocked around 1800ms , we ask her to reboot the MX and it went back to normal ( 20-40ms ) and loggon times we reduced ( from 8 mins to under a minute ). We are using the 14.39 RC and I saw in 15.4 firmware release notes : • Resolved a rare issue that could result in packet loss on some flows. The loss would persist on these flows until they were remapped with different TCP or UDP ports. Could this be the issue ? Has anyone seen this before ?

RaphaelL · ‎May 14 2019

Hi there ! # Save changes postnewaddr = meraki.updatedevice(apikey,deviceinfo['networkId'],deviceinfo['serial'],deviceinfo['address']) I would do : postnewaddr = meraki.updatedevice(apikeu,deviceinfo['networkId'],deviceinfo['serial'], address = deviceinfo['address']) The reference in Meraki.py is : def updatedevice(apikey, networkid, serial, name=None, tags=None, lat=None, lng=None, address=None, move=None, suppressprint=False): So the first variable is name, that is the reason why It changed the name instead of address. ( had the same issue yesterday haha ) It should be working now. Try it 🙂

RaphaelL · ‎May 10 2019

That would be super easy with API ! I recommend to use the meraki.py library ( https://github.com/meraki/dashboard-api-python/ ) Python 3.6 -> pip install meraki Then you could use something like that : apikey = "your api key" orgid = "your org id" newaddr = " your new addr " inventory = meraki.getorginventory(apikey,orgid) # Return your inventory for mr in inventory: if "MR" in mr['model']: # if the model contains MR ( AP ) could be MS , MX , MV mrinfo = meraki.getdevicedetail(apikey,mr['networkId'],mr['serial']) # To get the device info that contains the adress if "OldAdress" in mrinfo['address']: # To check if the device matches your old adress postnewaddr = meraki.updatedevice(apikey,mr['networkId'],newaddr) #Push the new addr This is mostly complete. I didnt run it , so double check it before doing so. And I'm not responsible if something bad happens. Always try your calls before running them in a production environnement. Hope it helps !

RaphaelL · ‎May 8 2019

Well , I though that unlocking the phone would force the Wifi out of sleep but that's not the case. Scolling through my facebook feed and my pings drops to 3-4ms as expected. I get a couple 75ms from time to time but nothing serious. We learn something everyday !

RaphaelL · ‎May 8 2019

HI there , I own a MR33 with 26.2 firmware. The AP is in my house ( it aint a big house ) and my cellphone ( samsung S8 ) is connected via my 5ghz network. Everything is fine except that my cellphone does that : Réponse de 192.168.1.70 : octets=32 temps=7 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=193 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=608 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=495 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=411 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=328 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=244 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=169 ms TTL=64 Réponse de 192.168.1.70 : octets=32 temps=86 ms TTL=64 Even from the dashboard it shows the same result. I can ping my TV, my RPI anything under 3-5ms. I have placed my cellphone 1 feet from the AP ( dashboard shows signal : 66 db ) and still no changes. Has anyone even seen that ? I tried unlocking the cellphone , It reduced it a little bit but I'm still over 70-150ms

RaphaelL · ‎Apr 17 2019

Cool ! I have seen those calls in the changelog couple days ago. Would have been nice to include the ''stack status'' or something like that eg : switch cables status ( port 53,54 ) 🙂

RaphaelL · ‎Apr 8 2019

Hi there , I'm looking through the docs : https://dashboard.meraki.com/api_docs# But it seems like there is no way to get a switch port status via API eg : API calls that returns switch port status -> Down ,Up , Disabled ... Is this API call hidden or just missing ? Thanks

RaphaelL · ‎Apr 6 2019

Hi there , I'm currently using the API call : GET /networks/{networkId}/devices/{serial}/lossAndLatencyHistory and the return is something like : { "startTs": "2019-04-07T02:54:00Z", "endTs": "2019-04-07T02:55:00Z", "lossPercent": 0, "latencyMs": 13.5 } although my timezone is curently configured as UTC -4 ( Montreal , Canada ). I know I could easly modify the output in python. But any idea why the output is UTC 0 instead of UTC -4. Can anyone test it and confirm that ''issue''. Thanks a lot

RaphaelL · ‎Apr 6 2019

So I'm done with my script ! I can now identify any device via LLDP that as AP in it's name and identify if it's port is either in access or trunk. If it is in access , it is flagged as misconfigured. If you guys need it I can share my code ( only have to adapt your key ,orgID, and the output messages ( currently in french ) Last question : I'm looking for the equivalent of : GET /devices/[serial]/switchPorts but for MX ( not MS ). I don't see anything. I would like to be able to identify misused ports on MX. Going to make a wish if this feature is not already there. Thanks a lot

RaphaelL · ‎Apr 5 2019

Thanks for the pseudo code. I'm almost done , but I have one last concern. Since I will have to retrieve info from over 2500 devices , it looks like I'm going to be bottlenecked by the 5 calls / sec limit , ain't that right ? - Raphael

RaphaelL · ‎Apr 5 2019

Hi there , I'm currently trying to something to get every switch port configuration and every LLDP / CDP device on every switch port. The issue I'm looking at , is that I have to do a call for every device we have. ex: GET /networks/[networkId]/devices/[serial]/lldp_cdp and : GET /devices/[serial]/switchPorts I have to identify every single AP that is misconfigured ( like an AP seen on access port. We have over 2500 device so I really need to script that. Anyone done something similar ? Thanks a lot.

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges