Meraki

BrechtSchamp · ‎Mar 25 2019

I'm wondering if the python library rate limits the calls. I checked the source and upon first inspection it doesn't seem like it does that. Therefore I'm wondering if you're getting penalized for going over the max rate of 5 calls/s (per organization). Regarding the calls themselves, I don't think there's any other more efficient way of getting to that data. Using the devices statusses call already saves you from going over each network and calling its devices one by one.

BrechtSchamp · ‎Mar 25 2019

Yes. Let's say in one of the sites you have a static route pointing to 172.18.0.0/24 with the gateway set to 10.8.44.25. In that list I showed you there should then be a 172.18.0.0/24 entry for that specific site. If the dropdown is set to yes, then all your sites should be able to use that route. If they have their own direct route over the local hardware it will be preferred due to the route preferences in the MX, refer to the link @ww shared.

BrechtSchamp · ‎Mar 25 2019

The first requirement is to have Meraki AutoVPN enabled in all your sites. Then in Security & SD-WAN > Site-to-site VPN of the network where you have setup the static route, you will see that destination subnet listed in the Local Networks. When you change the dropdown from "no" to "yes" for that entry, it will be announced inside the AutoVPN network. Now your other sites will be able to use the static route going through Meraki AutoVPN.

BrechtSchamp · ‎Mar 25 2019

Centralized location for all your certifications. The benefit is that the vendors themselves leverage API's from acclaim to automatically update acclaim when you pass exams.

BrechtSchamp · ‎Mar 25 2019

That should work. Multimode uses 850nm light normally. Best to check with your ISP what wavelength they're using and make sure that it is indeed multimode. If the link is long they would normally go for single mode rather than multimode. The basic rule of thumb is multimode within buildings and single mode in between buildings.

BrechtSchamp · ‎Mar 25 2019

+1 on that

BrechtSchamp · ‎Mar 25 2019

Someone here is using the MX itself as medium converter, but the setup is a little dirty. It's basically that what @PhilipDAth describes in the topic I mentioned above: https://github.com/swiatecki/Networking/blob/master/MX84Fiber/MX84FiberUplink.md Simplest would be a medium converter.

BrechtSchamp · ‎Mar 25 2019

See this topic. https://community.meraki.com/t5/Security-SD-WAN/MX84-Internet-ports-GbE-SFP-option/td-p/5499

BrechtSchamp · ‎Mar 25 2019

Although I'm not familiar with the Lancom routers, that configuration seems to be correct. Sometimes providers limit incoming connections on certain ports, you could check with them if that's the case. I'd also test the port forwarding in steps, so first test port forwarding with just the Lancom and the camera immediately behind it, and then in a second step with the MX in between.

BrechtSchamp · ‎Mar 24 2019

Could also be a mismatch somewhere. Make sure that all equipment on that path is spec'd identically. I.e. if you're using multimode OM4, make sure the SFPs are multimode on both ends and make sure that the patch cable is multimode (ideally OM4) too. Similarly if you're using single mode, everything should be single mode. In your case it's the latter so everything should be single mode. Lastly, it could also be that you're near or over the max distance for that cable/speed. Take a look at the distances mentioned here: https://meraki.cisco.com/lib/pdf/meraki_datasheet_sfp.pdf

BrechtSchamp · ‎Mar 24 2019

As @NolanHerring said. Likely a bad or dirty SFP, bad or dirty fiber or an overly bent fiber patch cable (they have a maximum bend radius).

BrechtSchamp · ‎Mar 24 2019

Have you tried doing it from the view all networks page with the pencil icon next to the name in the list?

BrechtSchamp · ‎Mar 23 2019

All right, I think I figured it out. The remaining issue was the depth of the JSON conversion. Here's the working code: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $api_key = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX' $header = @{ "X-Cisco-Meraki-API-Key" = $api_key "Content-Type" = 'application/json' } $orgID = 'XXXXXXXXXXXXXXXXXXXXXXXXX' $api = @{ "endpoint" = 'https://nXXX.meraki.com/api/v0' } $api.url = '/organizations/' + $orgID + '/thirdPartyVPNPeers' $uri = $api.endpoint + $api.url $parms =@( [ordered]@{ name = "My peer 2" publicIp = "123.123.123.1" privateSubnets = @( "192.168.13.0/24" ) secret = "asdf1234" ipsecPolicies = [ordered]@{ ikeCipherAlgo = @( "tripledes" ) ikeAuthAlgo = @( "sha1" ) ikeDiffieHellmanGroup = @( "group2" ) ikeLifetime = "28800" childCipherAlgo = @( "aes128" ) childAuthAlgo = @( "sha1" ) childPfsGroup = @( "disabled" ) childLifetime = "28800" } } ) $json = ConvertTo-Json -Depth 5 -InputObject $parms $change = Invoke-RestMethod -Method Put -Uri $uri -Body $json -Headers $header -Verbose $change Hope that helps.

BrechtSchamp · ‎Mar 23 2019

I've been analyzing it a bit and I think apart from what @CN mentioned about the child ciphers I think you also need an array at the outermost level: @( [ordered]@{ name = "... } ) I also noticed that for me postman puts not only the child ipsecPolicies in brackets but all of them except the 2 lifetime ones. I also noticed that there's a difference in behavior between: $json = $parms | ConvertTo-Json $json = ConvertTo-Json -InputObject $parms I couldn't get it to work with powershell myself either, I'm still experimenting...

BrechtSchamp · ‎Mar 23 2019

@jdsilva wrote: Fixed! +1

BrechtSchamp · ‎Mar 22 2019

Extra info... Replies on older topics still give notifications.

BrechtSchamp · ‎Mar 22 2019

Also no notifications on the bell icon for replies I think.

BrechtSchamp · ‎Mar 22 2019

Is there anyone else not getting notification emails? I'm subscribed to all subforums but I'm not getting any emails. Happening since today...

BrechtSchamp · ‎Mar 22 2019

This is something the code you write should do, there are no parameters to do this from the API side.

BrechtSchamp · ‎Mar 22 2019

I'm not entirely sure what you're trying to do, but there are no filtering functionalities in that call (apart from the MAC-address you specify). The only thing you can do is limited the number of results returned using the perPage parameter. I tested it out and it seems to work fine here (with perPage set to 5). The startingAfter and endingBefore shouldn't be specified manually but rather use the values as returned by a call. Here's an example, I clicked the headers tab so I could show you the returned "next", "previous" and "last" links:

BrechtSchamp · ‎Mar 22 2019

On both. Keep in mind that by doing that you effectively make the camera available to the whole world. Not that good from a security perspective. From the Lancom you forward to 192.168.1.199 and the MX needs to forward to 10.121.1.49.

BrechtSchamp · ‎Mar 22 2019

Insight bases its analysis on DPI like techniques on the real user traffic. So you would have to have it go through the MX. Maybe you could have it go through the MX and fallback to your current routing instead in case of problems. But that seems like a needlessly complex setup and I'm a fan of k.i.s.s. In the future they may add the sensor functionality to the switches and APs...

BrechtSchamp · ‎Mar 21 2019

I don't think so. They don't have the option to statically define the ip either. Good question!

BrechtSchamp · ‎Mar 21 2019

Don't know if it's the reason, but i noticed one of the dates has 213 instead of 2013. Can you give that a check?

BrechtSchamp · ‎Mar 19 2019

No need to feel dumb. How do you think I found out... 😉

About BrechtSchamp

BrechtSchamp

Community Record

Badges