Meraki

Adrian4 · ‎Oct 26 2023

in the appliance status page I can see WAN2 has the ip next to it with a green active sign. If i go to uplink config the public ip is there again with a different DNS name than the VPN one. Just to see if there was anything on my company laptop that cold be interfering, I grabbed a spare laptop, formatted it - connected to a guest wifi and tried again with nothing installed on the laptop except the VPN client. - I get the exact same message as my company laptop - connection attempt timed out.

Adrian4 · ‎Oct 25 2023

no, no forwarding etc. I can ping the hostname and see it get all the way to the mx ok. I made sure antivirus isn't blocking anything. I ran a packet capture on the mx during a connection attempt but couldn't see any relevant traffic - but then i couldn't see any traffic to my laptop during a successful ping test either. The MX does have an inbound firewall enabled surprisingly with a block all rule. I didnt thin this would be blocking it but I added a allow all rule all the same and it still didn't help so i removed it again.

Adrian4 · ‎Oct 25 2023

I dont see anything in the log after i enabled the anyconnect server - i assume that means nothing is reaching the mx? I have no filters set so should be seeing everything

Adrian4 · ‎Oct 25 2023

im on a separate network

Adrian4 · ‎Oct 25 2023

Hello, I am trying to setup a very basic client VPN connection in order to test it out and see if its something my company would move to using. But I cant get event he most basic config to work 😛 I am testing with a MX67w firmware version MX 18.107.2 I have downloaded/installed the latest AnyConnect client from the dashboard. In Security/SD-WAN I have gone into client VPN and enabled the AnyConnect settings. Selected Meraki Cloud authentication Put in a subnet I'm not using anywhere else I have cert authentication to disabled, although while testing a turned it on and was expecting a choice of cert methods but I only get a single option to upload a cert file (guide says here should be an auto generated option) https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#How_to_Enable_AnyConnect_on_Your_Dashboard using google public dns set my user account to allow VPN access. Saved settings. Then I copied the hostname and pasted it into the client and clicked connect - I don't get a credentials prompt, it just gives me an error after a while saying connection attempt timed out. I am able to ping the MX's public IP no problem. I'm using standard 443 port. There isn't any firewall or other device between the ISP router and the MX. Dunno what else to try.

Adrian4 · ‎Oct 24 2023

yea, we already have 2.4 turned off in our main office but to do it in the area this other office is in means impacting over 60 APs in important areas. Means going through CAB etc 😕 ta very much

Adrian4 · ‎Oct 23 2023

not really no, changes effect too many people. I am going to try and turn off 2.4 but it feels like working around the problem rather than addressing it.

Adrian4 · ‎Oct 23 2023

they seem to be standard settings just like in your screenshot.

Adrian4 · ‎Oct 23 2023

but why are the clients auth expiring every few mins?

Adrian4 · ‎Oct 23 2023

Hello, I have a small office with about 5 or people in it, all on WiFi. There is a single MR46 on the ceiling no further than 5 meters from each of them with clear line of sight. One of the users is reporting constant problems with the wifi suddenly dropping. Sometimes they will connect again within a min, sometimes it takes longer. I think the issue is effecting all of them, but this one user just has a different model laptop and the adaptor seems to be less able to deal with the issue gracefully (the other users seem to drop and come back fairly quickly). Looking at the logs and some monitoring software, I can see that they are jumping from 2.4 to 5Ghz regularly. For some reason their authentication seems to expire every few mins and then they re-connect but on the other Band. connect to 5ghz - auth expires/drop - connect to 2.4 - auth expires/drop - connect to 5ghz - auth expires/drop - etc etc When I was in the room with a scanner I could see the strength of the 2.4 was jumping up and down a a bit but the 5Ghz was always the strongest signal by a good margin. I have set their driver options to prefer 5Ghz and updated the drivers. Unfortunately turning off 2.4 all together is not an option. any ideas what's going on? thanks.

Adrian4 · ‎Sep 11 2023

Hi, Thanks for the reply! makes sense. However, the 429 error means iv already hit the rate limit, so adding a sleep timer on that code will help reduce the amount of time i have to wait before i can send again (by preventing the re-try spam) but I still have the issue of hitting the limit in the first place 😞

Adrian4 · ‎Sep 8 2023

Im using "requests" HTTP library

Adrian4 · ‎Sep 8 2023

the problem has returned 😞 every so often getting 429 errors and when I check the summary I see this "429": 1307, So two things - one, when it gets a 429, it is clearly re-trying over thousand times in tiny time frame - not sure I am using these variable properly wait_on_rate_limit=True, maximum_retries=100 Am I supposed to pass them as part of the API headers or something? Secondly, I must still be doing something to trigger the 429 rate limit in the first place. The limit is 5 requests per second I think? After each and every request call I have put in a 0.3 second delay which should mean I cant be sending more than 4 a second so how is this happening? To produce the delay I am using the time module and setting a global variable of DELAY = 0.3 then after every request putting the line time.sleep(DELAY) networks = requests.get(networks_url, headers=headers, verify=f"{root_path}/Cisco Umbrella Root CA.crt") time.sleep(DELAY)

Adrian4 · ‎Sep 1 2023

thanks for the confirmation 🙂

Adrian4 · ‎Sep 1 2023

thank you! to be honest I had never come across 429 errors until a day or two ago 😛

Adrian4 · ‎Sep 1 2023

In content filtering - blocked / allowed urls....is it possible to do this with a organisational policy object? This way I can just edit one policy to add/remove things rather than maintaining identical http lists on every site. thanks!

Adrian4 · ‎Sep 1 2023

Hello, Recently I have been running into this unexpectantly. If I wait 5 or 10 mins it goes away but it kept happening so I ran the API requests summary endpoint each time it happened and I saw thousands of requests with a 429 response. Since 429 is the too many requests error, I assumed a first call 429 and then it re-try's a thousands times immediately after until it gives up which is what gives me all those 429? I tried to dig deeper into where they were coming from.... all the 429 requests were apparently getNetworkWirelessClientCountHistory ?!? - that doesn't make any sense as i only ran that once and it was successful. also - in the thousands, they seem to alternate from ssid 4 to ssid14 over and over - not sure what that is about as I am not jumping around SSIDs and the one im connected to isnt 4 or 14. can anyone shed some light?

Adrian4 · ‎Aug 17 2023

I'v just hit the exact same issue! lol. Is there a way via API to change the allow/deny status of this rule like you can in the dashboard?

Adrian4 · ‎Jul 20 2023

follow up question - would a batch request run faster than lots of individual requests? Im not sure if the time it takes to run lots of individual requests is mostly because of the request transit time or the actual processing time.

Adrian4 · ‎Jul 20 2023

cheers

Adrian4 · ‎Jul 20 2023

Hello, I am building an python app that backups and restores switch port configs and the backup part is done. Doing the restore however, I just wanted to confirm - do I have to do a separate API call for each and every port?!? Or can I nest the body dictionary for each port in one parent dictionary and do them all in one call? https://developer.cisco.com/meraki/api-v1/update-device-switch-port/ Thanks!

Adrian4 · ‎Jul 19 2023

nice, thanks very much!

Adrian4 · ‎Jul 17 2023

Hello, We have a organisation with 30 or so sites. Currently they are all configured as hubs for a full mesh topology and we want to move to hub and spoke. My question is, what is the impact of changing a site from a hub to a spoke? Obviously all non hub VPNs will drop but what about the spoke sites general connectivity? At the moment, all open internet traffic goes straight out to the internet from each site. Only internal traffic that needs to go to other sites gets passed along the SD-WAN. - Would that continue if we changed to spoke, or would it suddenly try to pass all its traffic through the hub? Just trying to to identify any gotcha's before they happen 😛 thanks!

Adrian4 · ‎Jun 28 2023

Hello, I am trying to build a script that copies SSID info from one network and updates another network with that info. PUT endpint https://api.meraki.com/api/v1/networks/{destination_id}/wireless/ssids/{ssid['number']} It seems to work ok with PSK SSIDS but on one which is Enterprise with Radius - it has problems. The first error was "encryptionMode' must be one of: 'wep' or 'wpa" I found this that advised just removing that key: https://community.meraki.com/t5/Wireless-LAN/quot-Update-the-attributes-of-an-SSID-quot-AP-endpoint-broken/m-p/61491 Which I did, but then I got another error {'errors': ["'radiusFailoverPolicy' must be a string"]} I don't understand why I am getting these errors, if the fields are correct for the network I copied from, why is the API saying they are wrong when I try to copy to a network? API payload data: { "number": 0, "name": "Redacted", "enabled": true, "splashPage": "None", "ssidAdminAccessible": false, "authMode": "8021x-radius", "dot11w": { "enabled": true, "required": true }, "dot11r": { "enabled": false, "adaptive": false }, "encryptionMode": "wpa-eap", "wpaEncryptionMode": "WPA2 only", "radiusServers": [ { "host": "0.0.0.0", "port": 0000, "id": "000000000000000000", "openRoamingCertificateId": null, "caCertificate": null }, { "host": "0.0.0.0", "port": 0000, "id": "000000000000000000", "openRoamingCertificateId": null, "caCertificate": null } ], "radiusAccountingEnabled": false, "radiusTestingEnabled": false, "radiusServerTimeout": 1, "radiusServerAttemptsLimit": 3, "radiusFallbackEnabled": false, "radiusProxyEnabled": false, "radiusCoaEnabled": false, "radiusCalledStationId": "$NODE_MAC$:$VAP_NAME$", "radiusAuthenticationNasId": "$NODE_MAC$:$VAP_NUM$", "radiusAttributeForGroupPolicies": "Filter-Id", "radiusFailoverPolicy": null, "radiusLoadBalancingPolicy": null, "ipAssignmentMode": "Bridge mode", "useVlanTagging": true, "defaultVlanId": 0000, "radiusOverride": false, "minBitrate": 11, "bandSelection": "Dual band operation", "perClientBandwidthLimitUp": 0, "perClientBandwidthLimitDown": 0, "perSsidBandwidthLimitUp": 0, "perSsidBandwidthLimitDown": 0, "mandatoryDhcpEnabled": false, "lanIsolationEnabled": false, "visible": true, "availableOnAllAps": true, "availabilityTags": [], "speedBurst": { "enabled": false } }

Adrian4 · ‎Jun 5 2023

thanks, can you move licenses across orgs?

About Adrian4

Adrian4

Community Record

Badges