The error indicates the source IP you are running the call from is blocked on the destination organization. Unfortunately the API call is terminated by 403 from that organization preventing the other organizations from populating.  The IP restriction needs to be lifted.    However, if it is intermittent as you suggested then more investigation needs to be done to determine while IP the API call is coming from when it succeeds and fails.  ... View more

Hi,   From Cisco Meraki Events via REST API:    The Cisco Meraki Events via REST API solution for Microsoft Sentinel enables you to easily ingest the following events from Cisco Meraki MX security appliance to Microsoft Sentinel using Cisco Meraki API: 1. Organization Appliance Security Events 2. Organization Api Requests 3. Organization Configuration Changes   1. Based on the information above I would expect this to use most GET organization level API calls.  - when clicking this link type "/organization" into the first search box.    2. It also specifically calls out the Organization Appliance Security Events which is probably this call: getOrganizationApplianceSecurityEvents.   3. Refers to the changelog found under Organization > Changelog. This seems to refer to this API endpoint: getOrganizationConfigurationChanges.    But as you stated, it's always good to get confirmation from Microsoft.    Feel free to reach back out should you need anything else.  ... View more

Hi,   I'm not familiar with using Microsoft Sentinel for the API. Are you looking at something like Cisco Meraki Events via REST API? Or like Cisco Meraki connector for Microsoft Sentinel   1) Not from individual Meraki devices. However, depending on the API endpoint you are using you may need to enter information such as a VLAN ID, serial number, port, etc. Those are just parameters of some API endpoints.    2) Yes, if using one of these endpoints: getOrganizationApplianceSecurityEvents or getNetworkApplianceSecurityEvents.    3) This depends on how everything is formatted with Microsoft Sentinel. What comes to mind is how the information will be processed and if formatting is important. Lastly, keep your API key safe.    Let me know if you have any questions.  ... View more

Hi,    Hope you are having a good day!   Is the application's IP within the Organization's allowed IPs? You stated you have access to the organization, but you cannot change those settings. Is that an administrative barrier or do you not have organization access to change the IP restrictions? 403: Forbidden - You don't have permission to do that Read only administrators will only be allowed to make GET requests. Any other requests will result in 403: Forbidden    I restricted access from my IP to my organization and ran getOrganizationNetworks and getOrganizations, it does return a 403 Forbidden. However it also returns an error message stating the following:    getOrganizations: "errors": [ "Your client IP address <IP> is not within an approved subnet for organization <org_name> - <org_id>" ]   getOrganizationNetworks:  "errors": [ "Your client IP address <IP> is not within an approved subnet for organization <org_name> - <org_id>" ] Are you receiving an error message at all?  ... View more

Hi Kavy,    @Arthamon is correct regarding the Dashboard uptime visibility and the API. Uptime statistics from the dashboard at this point in time are relatively limited.  For statistics on uptime you can use the Organization > Overview page. This won't provide you with the specific uptime of the device unfortunately.    The other option is to manually view each MR and MS to check the uptime (MS needs to be on firmware 15.21.1+ and MR on 30.x+).  Options: 1. Go to Organization > Overview. Then select the tab that says "Devices". You can see each of the connectivity bars there. Unfortunately it does not give you an uptime metric, but it does give you the dates of when the device was connected to the Cloud or not.  2. Go to Organization > Overview. Select the "Networks tab". Click on the "+" sign next to the CSV button. Select "network health" and "% offline" from the "+" dropdown.      3. Go to Switching > Switches and select your switch and view the uptime there.   4. Go to Wireless > Access points and select your AP and view the uptime there.    ... View more

Hi Kavy,  Just to clarify, when you say Service Availability do we mean the uptime of the MX in a particular timeframe?  i.e. Uptime of MX for a period of 7 days.  ... View more

To advertise a subnet over IPsec VPN go to Security & SD-WAN > Site to site VPN.  A "VPN settings" section will be there, then you will see the "local networks". This section permits/restricts subnets to be advertised over AutoVPN and IPsec VPN. If the subnet is "disabled" it will not be able to access or use the VPN as it will not be advertised over VPN. If "enabled" that subnet will be advertised to AutoVPN and IPsec VPN peers.   If you want all your local subnets to be able to pass traffic through the IPsec tunnel, then enable all of them.   Local networks example:  Only the default VLAN subnet of 192.168.128.1/24 is advertised over the IPsec tunnel since it's the only one that is "enabled". If I want 10.10.1.0/24 to be advertised to my IPsec VPN peer, then I will "enable" it.    Do you need all of your traffic to go across the IPsec tunnel? That's what adding a 0.0.0.0/0 in the private subnets of the Non-Meraki VPN peer configuration on the dashboard will do. It overrides the default route out the WAN interface.  Will internet be possible with 0.0.0.0/0 with an IPsec peer? Sure, if the tunnel establishes properly as the MX will be using your peer for internet connectivity.    I am still a little lost on what you are trying to configure.  ... View more

Hi Paul,    Troubleshooting slow VPN connections can be tricky and usually requires a lot of information gathering.    What applications experience slowness? Is it all applications? Are these TCP or UDP based applications? Or Both?  i.e Are file transfers slow but streaming is ok? Are VoIP applications have issues but loading webpages are unaffected?  How many users are typically in during those slow days? Does that number decrease a lot during days where the connection is fine? What times of the day is the connection usually slow?    What bandwidth is the router in India providing and the MX75 in the UK? This way we can determine if one of them is a bottleneck.  Are specific users affected? Are all users affected? What is the speed when running a speedtest?  The last tip is to run speedtests when the network has less users to see if the issue persists. If it does not persist it may be related to congestion/link saturation. Regards, Maria   ... View more

Hi Tyler,  1. OWE is part of WPA3 authentication which requires client devices to use data encryption upon associating to the AP.   2. After association the client will be redirected to the AD Logon Splash Page where they will have to enter a username and password to authenticate to the AD server.   3. The client will enter their username and password. The AP will receive that information and then send that off to your server.   4. Your server will accept or deny the credentials. If denied the server will indicate that to the AP and the AP will deny you access to the network. If your credentials are accepted your server will send a message to the AP telling it to allow you into the network.  5. If you have your captive portal strength set to "block all access until sign-on is complete" then until users complete their sign-on they will not be allowed to access anything in the network (save for what is in your walled garden). Additional Resources:  802.11 Process Explained - Note: If WPA/WPA2 or 802.1X authentication is required on the wireless network, the mobile station will not be able to send data until dynamic keying and authentication have taken place after the 802.11 Association is complete.   In our documentation we state the following, "To associate to a wireless network, a client must have the correct encryption keys (association requirements). Once associated the wireless client may need to enter information (network sign-on method) before accessing resources on the wireless network." More on OWE from our documentation.   Hopefully this answers your question 🙂  ... View more