Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Become a member of the Cisco Meraki Community today
Get answers from our community of experts in record time.
Join nowAbout Pached
Pached
Here to help
Member since Apr 17, 2025
yesterday
Community Record
11
Posts
2
Kudos
1
Solution
Badges
2 weeks ago
you are correct, it is an oauth doc. However, I believe that parameter is still applicable in SAML.
... View more
2 weeks ago
Hi Philip, I get what you are saying but I am using Meraki's SSO less for single sign on and more for Centralized Identify and Access Management (IAM) purposes. i.e. employee gets fired today, his access will be immediately centrally revoked in Entra ID, SSO is the way to make that happen.
... View more
2 weeks ago
Good Day I have integrated Meraki into Azure EntraID (SAML SSO SP initiated.) My Azure User account (login for many employee apps) is firstname.lastname@parl.gc.ca. My Azure Admin account (login for Meraki Dashboard) is azure.firstname.lastname@org.com. When authenticating to most employee apps they prompt asking me to sign-in, Meraki Dashboard SSO does not. It automatically tries my user account which fails. The sign-in box prompt works when using incognito/private browser. It also works if I login to something else with my Azure Admin account because it is cached. How do I ensure the sign-in prompt always prompts? According to Microsoft this can be achieved by appending “&prompt=select_account” parameter in the URL. Here is the reference article: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. If I go to https://org-name.sso.meraki.com I get redirected to https://n1.meraki.com/login/dashboard_login/org-name?eid=JYDZDc9wb&sso=true The “Log in with SSO” link is: https://login.microsoftonline.com/d35fe7ad-abdf-4422-8ef9-8234b7a904/saml2?SAMLRequest=fZFLS8QwFIX%2FSndZpe1k%2BgxtoTgIAyqi4sKNpEnqBPOouSnqv7ftIOhCN1kk38k599wGmNET7edwsnfybZYQosNyKMuCcrZFpxAmoEmi3YuysVHcO3BjcFYrK2PuTCL2%2BShLJjAbxIizjBBcybHGFdlnQ8ZLVqdZstoQFB0PLXpm9a4q62rBqpLhrJAjroQYcCEGwvK8ElzUCwowy6OFwGxoEUlJjtMck%2FphV9A8o2nxhKJH6WFLSeIURR9GW6CrU4tmb6ljoIBaZiTQwOl9f31FF5AyAOnX6X5Kpv81k3fBcadR16w03dL57rud5Vngk%2BMxgIuN9OxVrd00yU%2B4OXd9s3x%2BPNw6rfhn1Gvt3i%2B8ZEG2KPhZoujSecPC33F28W67UQKPG0qlYUr3QngJgJLu7Pp7qd0X If I manually append “&prompt=select_account” after the “SAMLRequest=value” it works, I get the sign-in prompt: https://login.microsoftonline.com/d35fe7ad-abdf-4422-8ef9-8234b4c7a904/saml2?SAMLRequest=fZFLS8QwFIX%2FSndZpe1k%2BgxtoTgIAyqi4sKNpEnqBPOouSnqv7ftIOhCN1kk38k599wGmNET7edwsnfybZYQosNyKMuCcrZFpxAmoEmi3YuysVHcO3BjcFYrK2PuTCL2%2BShLJjAbxIizjBBcybHGFdlnQ8ZLVqdZstoQFB0PLXpm9a4q62rBqpLhrJAjroQYcCEGwvK8ElzUCwowy6OFwGxoEUlJjtMck%2FphV9A8o2nxhKJH6WFLSeIURR9GW6CrU4tmb6ljoIBaZiTQwOl9f31FF5AyAOnX6X5Kpv81k3fBcadR16w03dL57rud5Vngk%2BMxgIuN9OxVrd00yU%2B4OXd9s3x%2BPNw6rfhn1Gvt3i%2B8ZEG2KPhZoujSecPC33F28W67UQKPG0qlYUr3QngJgJLu7Pp7qd0X&prompt=select_account Is there a way that we can set the “&prompt=select_account” after the “SAMLRequest=value” ? Thanks,
... View more
3 weeks ago
1 Kudo
Yep, that did the trick. Thanks a bunch Ryan
... View more
3 weeks ago
Hiya, I setup SAML SSO with Azure Active Directory (Entra ID). IDP initiated works fine. Then I followed the steps listed here to configure SP Initiated: https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/SP-Initiated_SAML_SSO_Configuration_Guide#Defining_a_unique_subdomain_for_your_organization However these instructions are not specific to Azure. When I test, I get the following Azure error message: AADSTS700016: Application with identifier 'https://myorghere.sso.meraki.com' was not found in the directory 'CompanyDomain'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. I know I have to link the SP URL in Azure, but not sure where/how. In Azure I tried adding each of these: https://n1.meraki.com/login/dashboard_login/myorghere and myorghere.sso.meraki.com as the Entra ID "Sign on URL (used if you would like to perform service provider-initiated single sign-on. This value is the sign-in page URL for your application), But it didn’t make a difference. Here is my SSO setup: Is there a Meraki Entra IDSAML SSL Service Provider (SP) Initiated doc I can follow? Of can you point me in the right direction. Thanks,
... View more
Labels:
- Labels:
-
Administrators
-
Other
May 9 2025
8:20 AM
Also, I see the MX WAN interface resolving DNS when it is connected to the Internet, but not associated to a template/has no network config.
... View more
May 8 2025
7:24 PM
Hi srwjiwate, Can you replicate this from a source client that is not connected to any Meraki infrastructure or Cisco Umbrella? I suspect the following is happening. The pen testing tool is sourcing from a network that uses Meraki infrastructure that has Cisco Umbrella enabled. When it DNS queries, the Meraki infra hijacks the DNS request and sends to Umbrella. Umbrella resolves and replies to the meraki infras, which re-writes the DNS response to look like it came from the proper name server. Here is an example of me asking non-existent name servers to resolve different names and they work U:\>nslookup abc.com 86.75.30.9 Server: UnKnown Address: 86.75.30.9 Non-authoritative answer: Name: abc.com Addresses: 3.162.3.125 3.162.3.49 3.162.3.100 3.162.3.119 U:\>nslookup cbs.com 1.2.3.4 Server: UnKnown Address: 1.2.3.4 Non-authoritative answer: Name: cbs.com Addresses: 2600:1901:0:626a:: 34.149.41.86 U:\>nslookup nbc.com 7.0.0.56 Server: UnKnown Address: 7.0.0.56 Non-authoritative answer: Name: nbc.com Addresses: 23.223.17.138 23.223.17.140 Here is Umbrella resolving them: if you wireshark capture on your penteset tool everything looks normal, even though it is weird AF. But if you capture on your remote MX WAN interface, you won't see any of these DNS requests get there. It's a tricky one. Let me know if that makes sense.
... View more
Apr 22 2025
5:04 PM
I assume he wants encryption over the dark fiber. Typically I would employ macsec, but I don't think Meraki supports it.
... View more
Apr 22 2025
2:35 PM
Hi Alemabrahao, can you explain why? If the Meraki has internet and is able to route over the dark fibre to the Fortinet, I expect it to work. But I haven't set this up in the past.
... View more
Apr 21 2025
5:02 AM
Hey Roey, The only way to guarantee no IP conflicts is to buy and assign a publicly subnet and route it internally which isn't realistic for most businesses. Alternatively, you can use a reserved block for free, I.e 7.0.0.0/8 is reserved for DOD, but this can lead to other problems in the future. I've setup VPNs in the high 10.x.x.x and rarely encountered IP conflict issues. Also, be aware that with full tunnel, local home printing and other home services won't be available to these clients while the VPN is connected
... View more
Apr 17 2025
1:28 PM
1 Kudo
Hello @Gordon-HoC you mentioned the use of templates. This API call is not supported if you use templates. See output below. { "errors": [ "Unsupported for networks bound to a template" ] }
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 982 | Apr 17 2025 1:28 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 578 | |
| 1 | 982 |
© 2025 Cisco Systems, Inc.
