Just wanted to feedback to everyone here. We never found the exact issue, however, we suspect it to have something to do with setup procedure. We eventually just did everything from scratch. Deleted the API key, removed the syslog entries, and deleted the Forescout config. (When we originally started this, we created the API key, and loaded it onto Forescout where it registered. Only then did we change syslog details on the Meraki network.) Then did it all again. New API key, syslog config and Forescout Meraki plugin load and config. This time, we created the API key, configured the syslog events on Meraki network and only then loaded the API key on Forescout (once all the Meraki setup steps were done) I can't imagine how the procedure would make a difference, but at least worth noting the steps I guess. We are now facing a 10 min window, instead of 12 hours like before. VAST improvement. Still not near instant as when using postman, but much better. We will be playing with timers on Forescout to see if this can be improved as well. If we manage to improve this, I'll feedback here. Almost wish we can reproduce the 12 hour issue now to find the actual problem...
... View more