Meraki

rhbirkelund · ‎Sep 3 2024

No SVIs at all on the Catalyst.

rhbirkelund · ‎Sep 3 2024

So, fun stuff. I opened a case on this with Meraki Support. Apparently, this is expected behaviour from the Catalyst switch, and is tied to a known issue which has been closed by the development team and will not be fixed. To change it will require a Feature Request. By default and IGMP querier is configured on the Catalyst switches even though routing is not configured on the switch. The switch sends IGMP queries on all known VLANs, and this causes the MX to detact them as IP/VLAN mismatch since queries are sourced from it's Management interface. So due to the expected behaviour of the catalyst, it is also expected that the MX will log them as IP/VLAN mismatch, as it continues to send these IGMP queries. So in short, from Meraki: "Nothing to see here, move along". I will try to keep my opinion to myself....

rhbirkelund · ‎Aug 29 2024

10.45.0.2 is the management address of the C9300X stack on Vlan 1.

rhbirkelund · ‎Aug 29 2024

Hey For the first time, I have this 9300X stack in Meraki Persona, that I'm working with on a customer case. I'm seeing "Source IP and/or VLAN mismatch" in the Event Log about every 30 minutes on the clock, and for the life of me, I cannot seem to understand where it is coming from. The switch is a member of a 2 member stack, where both MX'es in HA go into each member on port 24. The Mac address in the event log matches that of the interface mac of port 24 on the 9300X. All ports on the 9300X stack are trunk, and are all trunking the exact same vlans. (Weird limitation btw to only support up to 1000 vlans in total, and they all have to be changed at once, in order to use vlans outside of 1-1000....) The only other device connected to the stack is a MS255 switch on port 1 on Momber 1 only. This port is also trunk, and they match in both ends. All switches and APs are management in Vlan 1, which is native. The MX is also default with VLan 1 native, and allowed all. I can simply not grasp why I am getting a mismatch on Vlan 1 and 1023, according to the event log. There are no clients - wired or wireless - connected, and nothing that refers to Vlan 1023. The only Meraki devices I have online is a pair of MX450, C9300X stacked, a MS225 and a CW9164, daisy chained all the way through.

rhbirkelund · ‎Aug 26 2024

What MX model are you using?

rhbirkelund · ‎Jul 29 2024

Congratulations ro everyone. 😀

rhbirkelund · ‎Jul 26 2024

Can you not utilize Warm Spare on your MXs?

rhbirkelund · ‎Jul 25 2024

Thank you very much for the recognition. 🙂

rhbirkelund · ‎Jul 25 2024

I tend to keep the ISP/WAN switches in a dedicated Network, outside of the site's network. Otherwise, the Application Visibility has a tendency to show skewed data.

rhbirkelund · ‎Jul 25 2024

Meraki Wireless can do GRE tunneling, but you are limited to the fact that it needs to be within the Meraki portfolio. To use the GRE tunneling yoiu'd configure your SSID with Tunneled, and then choos the Hub to with the GRE tunnels would terminate. But, for this to happen, you'll need a Meraki MX. You don't need to replace your entire Dell L3 with a Meraki MX, but you can configure it in a VPN Concentrator mode, and then configure the Wireless to tunnel back to is as a Hub. This way you'll get the Wireless Controller like experience from Aruba or Cisco with using Meraki.

rhbirkelund · ‎Jul 22 2024

Did you also claim the devices serial numbers into your inventory on the Dashboard?

rhbirkelund · ‎Jul 22 2024

First of all, the mac addres you get from the API is the Radio MAC. Second, you should edit your post, to remove the Serial Number, and in general don't share Meraki serial numbers.

rhbirkelund · ‎Jul 18 2024

I'm looking forward to see this, when my current customer project comes online, where we'll be doing a bunch of BGP. 😄

rhbirkelund · ‎Jul 18 2024

Do you have devices in your inventory that aren't named? That's probably the reason.

rhbirkelund · ‎Jul 18 2024

Nice! I needed this for my Mama's Spaghetti/Chow Mein Noodle BGP post!

rhbirkelund · ‎Jul 17 2024

Create a new profile, and use Device Profile (defualt), not User Profile (Apple). Add Settings, and you shold be able to see a Passcode Payload.

rhbirkelund · ‎Jul 17 2024

Assuming you're getting a list of all appliances in a single organization, and want to sort according to name, it'd be like this organization_id = "" response = dashboard.organizations.getOrganizationInventoryDevices( organization_id, total_pages='all', productTypes = ['appliance'] ) SortedListOfDevices = sorted(response, key=lambda d: d['name'])

rhbirkelund · ‎Jul 17 2024

I hear that MX Layer 8 firewall rules are roadmapped but sadly, there's no timeframe yet. 😉

rhbirkelund · ‎Jul 17 2024

I often use the simulate mode, when while starting out on a script, just to be sure I don't accidently post something unexpected to those orgs I use to test against. 🙂

rhbirkelund · ‎Jul 17 2024

Odd. I have it on my MX68W with adv.sec.

rhbirkelund · ‎Jul 17 2024

https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Wireless_Mesh_Networking https://documentation.meraki.com/MR/Deployment_Guides/Mesh_Deployment_Guide Is there something specific you are looking for?

rhbirkelund · ‎Jul 16 2024

The reponse is usually a list, where each element is a dictionary. So you need to sort the list based on values that are further "down the chain", which are in a dictionary. You can sort the list using the sorted() method and pass a lambda function as key; newlist = sorted(list_to_be_sorted, key=lambda d: d['name']) https://stackoverflow.com/questions/72899/how-to-sort-a-list-of-dictionaries-by-a-value-of-the-dictionary-in-python

rhbirkelund · ‎Jul 16 2024

Unfortunately, no. There is no option to create an API key for an account that is not tied to an Email. API keys are personal. However, what you could do is have your organization create a service account only for Meraki Automation, and generate an API key for that account. It'll still be tied to a "personal" Meraki Administrator, but it would not be tied to a specific employee.

rhbirkelund · ‎Jul 16 2024

That's definitely not unlikely that the default rule in the end should be popped. (Although I'd expect the API to be able to handle that rule, but that's another story..) However, then I'd expect a different error than the python error. If memory serves me right, I think it would fail within the REST call itself, and not a positional error in the function call.

rhbirkelund · ‎Jul 16 2024

Yes, it is simple and I see that we will still get the "easy" switching between organizations. Although, instead of simply browsing to dashboard.meraki.com, we'd now have to jump in through myapplications.meraki.com, and from there jump into the dashboard. However, it still creates those issues where one has a local login somewhere in Meraki, which conflicts with SAML SSO. E.g. my lab at home is a CMNA kit (from when you could get a full stack) with a couple other devices I scoured up over the years. This is an organization I'd prefer not having ties to my employers AD, however I still use my company email on it, to switch back and forth between lab networks and customers when needing to do changes. Addtionally, SAML users can not create API Keys, so we'll have to add a local user to their dashboard anyway if needing to use Meraki API. Then from my perspective, I'd expect to run into the same troubles, since the API user cannot be a SAML user, but must a local user, and theres a match on the email address. But I suppose, this is where user.displayname as the username attribute, comes into play?

About rhbirkelund

rhbirkelund

Community Record

Badges