Meraki Community

RaphaelL · ‎Feb 10 2022

Since Templates are not returned when using the call Get Orgs Network , I doubt that you could update them as a network.

RaphaelL · ‎Feb 9 2022

Even worse , you can't even read the value from the API. At the moment none of these 2 calls can't help you : PUT /organizations/{organizationId}/configTemplates/{configTemplateId} GET /organizations/{organizationId}/configTemplates Sorry.

RaphaelL · ‎Feb 9 2022

No , you would not have to do any modification to the DHCP relays. The DHCP process* is a broadcast ( D-O-R-A ). As long as your broadcasts from your VM are reaching vlan10 , you should be fine. Without knowing anything more in your setup , you VM would only need to be bridged on vlan10.

RaphaelL · ‎Feb 9 2022

Just to make sure , you are talking about this in the UI : Select the template , Network-Wide -> General , Network Notes ?

RaphaelL · ‎Feb 9 2022

Unfortunately, no. It is indeed frustrating because you have to test individual calls to know the expected values that are returned. Eg : Event Logs ( /networks/{networkId}/events ) . Parameter : includedEventTypesArray A list of event types. A yes a list. A list of what values? You now have to filter thousands lines of logs to find it.

RaphaelL · ‎Feb 9 2022

However, when I add the organizationId( or the organizationId/networks) I get a 404 error. I tested the method with the other networks and only one network returned with 200. I'm not sure I'm following you. The call https://api.meraki.com/api/v1/organizations/{organizationId}/networks It needs a OrgID not a NetworkID. You should be able to list all the networks from that given Org. If it still fails for the same Org , I would open a ticket.

RaphaelL · ‎Feb 9 2022

Has the Org API settings been enabled ? :

RaphaelL · ‎Feb 9 2022

Then the queries would be simply : https://api.meraki.com/api/v1/organizations/ ( with a valid API key ) https://api.meraki.com/api/v1/organizations/{organizationId}/networks ( with a valid Org ID obtained from the previous call ) Simply log into any Org that you have a API key in your browser and paste the urls in the url bar : This is how I test my calls before scripting.

RaphaelL · ‎Feb 9 2022

All networks from the same Org are on the same shard. Do not mix shards ID and Orgs. That is why it is recommended to use the mega proxy api.meraki.com instead of the shard. If you really want to use the shard , you have to make sure that it is the right one.

RaphaelL · ‎Feb 9 2022

So you are trying to Get https://api.meraki.com/api/v1/organizations/ which should return you a list of Orgs that you have access. Then you will be able to retrieve the ''id'' ( which is the OrgID ) and try https://api.meraki.com/api/v1/organizations/{organizationId}/networks with the correct ID. My favorite way to test these API calls , is by using Chrome and logging to the desired Org and then typing the API url in the url bar.

RaphaelL · ‎Feb 9 2022

Could you precise what API call you using ?

RaphaelL · ‎Feb 9 2022

Simply take a packet capture on the WAN interface , you will see that the MX is sourcing the traffic with a ephemeral port and a destination port of 443 as stated. It has nothing to do with your port forwarding rules and your firewall rules ( unless you have another firewall between your MX and your WAN ).

RaphaelL · ‎Feb 9 2022

I feel like the whole product line is missing so many basic features... The MX being the worst in that category. But indeed , that feature would be relevant in some cases.

RaphaelL · ‎Feb 2 2022

Yes it is possible .Here is the logs : <134>1 1643828967.485148461 XXXXXXXXXXXX flows src=XXXXXX dst=XXXXXX mac=XXXXX protocol=tcp sport=50568 dport=443 pattern: deny tcp

RaphaelL · ‎Feb 2 2022

Yes all traffic that has the logging enabled will be sent to the syslog server. Inside the syslog the rule is identified via the ''pattern'' eg : pattern: allow tcp && (dst 20.0.0.0/8 || dst 30.0.0.0/8 dst port 1234) Adding a rule ID or rule name would have been way simplier , but hey 🙄

RaphaelL · ‎Feb 2 2022

Yes you can. I'm assuming you are trying to achieve this on a MX. Go to Security & SD-WAN -> Firewall , then simply create a deny rule and check ''logging enabled'' :

RaphaelL · ‎Jan 31 2022

that was also my guess. It seems that it is 1 month on the first seen : firstSeen UTC : 2021-12-07 17:45:44 lastSeen UTC : 2022-01-13 11:39:20 Since I have a ''first seen'' > 30 days, It should be on the last seen

RaphaelL · ‎Jan 31 2022

Hi , Does anyone know how far back can this API call go ?: /organizations/{organizationId}/clients/search https://developer.cisco.com/meraki/api-v1/#!get-organization-clients-search I have found a Client from a month ago ( first seen in december , last seen 2 days ago ) but I was wondering what was the limit. It is usually documented in the API documentation , but it is not. Thanks ,

RaphaelL · ‎Jan 28 2022

Confirmed by Meraki : Unfortunately at this time only the MX64/65(W), MX67/68(C/W), and Z3 models of security appliance support 802.1X auth on the local LAN ports

RaphaelL · ‎Jan 27 2022

Yes , we already have hybrid auth on our MX64, 65 , 68 . This page lists these devices : MX64/65(W) and MX67/68(C/W) and Security Appliances, as well as Z3(C) but not the 250 and 450. I would be surprised to learn that it is not supported since the cheap hardware on a MX64 can do it.

RaphaelL · ‎Jan 27 2022

Hi , Does anyone know if MX250 / 450 ( on any firmware versions ) are supporting 802.1X / Hybrid Auth ? I don't see the option on the adressing and vlans page. It might be restricted in the backend. Thanks ,

RaphaelL · ‎Jan 25 2022

Hi , I might be wrong , but the only way ( that I'm aware ) would be to check via the syslogs. If you users are going through a proxy that would also be a good place to check.

RaphaelL · ‎Jan 20 2022

Or this : https://community.meraki.com/t5/Security-SD-WAN/Meraki-MX-Inbound-Firewall-Rules/m-p/84204 ? If I'm understanding this issue correctly

RaphaelL · ‎Jan 20 2022

Just to make sure . When both the client and the server are on MR56 it's not working , but when using an other AP ( google mesh ) it's working ? I would make sure that client to client traffic is set to allowed under the firewall page. See below Reference : https://community.cisco.com/t5/wireless/meraki-cannot-ping-client-to-client/td-p/3878100

RaphaelL · ‎Jan 20 2022

I have multiple users also reporting this issue. Following this thread.

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges