Meraki

RaphaelL · ‎Jul 6 2022

Hi , https://developer.cisco.com/meraki/api-v1/#!get-network-events Is the endpoint that includes 'all' logs/Events from your network. On the dashboard it is : Network-Wide -> Event log https://developer.cisco.com/meraki/api-v1/#!get-organization-devices-statuses Is a more detailed and noticeably new 'network health page'. It shows recent warnings on the network. Eg : CRC errors on ports , Recent 802.1X failures , recent dashboard connectivities issues. On the dashboard it is the 'bell' icon on the upper right of your screen when navigating in a Network : Hope that helps !

RaphaelL · ‎Jul 6 2022

Can this 'privilege' be assigned to a SAML administrator roles ? That would be ideal ! And by the way, thanks for the quick and detailed replies ! love it

RaphaelL · ‎Jul 6 2022

We are a big company splitted in multiple teams. So our network teams manage , configure and monitor our Meraki environnement , but some teams would like to be able to do packet captures but the network team do not want "random" people being Org admins Our real world example : SOC would like to have the rights to do packet captures in cases of forensic investigation but the NOC doesn't allow people from SOC to be Org admins / Net admins. At the moment the SOC has to contact the NOC for every packet capture that they want to do. Thanks 🙂

RaphaelL · ‎Jul 6 2022

Is it confirmed that only MX16.16 contains the fix ? Not 15.44.3 or anything else

RaphaelL · ‎Jul 6 2022

Do we know if the packet capture role will ever be available to network operators that are not Org Admin or Net Admin ?

RaphaelL · ‎Jul 5 2022

So , just a little heads up. It seems that the portID is based on the MAC ( from the lowest MAC to the highest MAC ) and not from the order of the stack : Which then messes up my topology ( the flow is not optimal ) : I'm aware that transfering the root to the stack on the right 'would' solve the issue. Setting the portID from the physical order of the switch ( from sw#1 to sw#X ) would also solve the issue and I'm pretty sure that is how the rest of the industry is handling the portID ( to confirm )

RaphaelL · ‎Jul 4 2022

To my knowledge , there is no endpoint for Dashboard Throughput and you shouldn't use that value at all. It is unpredictable and unreliable. You should be using the Speed Test from Insight ( if available ) which is also available via the API ( beta )

RaphaelL · ‎Jul 4 2022

Hi , I would really go with the API. There is an endpoint for the firmware versions but it is kinda ''bugged'' or not giving the desired info. I have a ticket opened about it. ( https://developer.cisco.com/meraki/api-latest/#!get-network-firmware-upgrades ) Anyway , you can pull the device status and you will get the firmware version. Hope that helps !

RaphaelL · ‎Jul 3 2022

I think you are refering to the DDNS adress ? ( since you left a comment on a different post regarding DDNS ). If so , you need to use the endpoint : {0}/devices/{1}/managementInterface

RaphaelL · ‎Jun 30 2022

You are correct with that endpoint the documentation or atleast the examples are not taking in account the Parameters. But the curl query is correct : curl -L --request GET \ --url https://api.meraki.com/api/v1/networks/{networkId}/wireless/clients/{clientId}/connectivityEvents?includedSeverities=good \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'X-Cisco-Meraki-API-Key: XXXXXXX'

RaphaelL · ‎Jun 30 2022

Hi , I was reviewing the firewall info page and I was confused about the part of Insight Data collection , there is no destination nor fqdn listed. My security team is not going to allow ''any'' as an answer since the data is probably sent to Meraki. Also there is a dupplicate of the radius accounting firewall entry. Thanks !

RaphaelL · ‎Jun 29 2022

Will this fix our invalid_pmkid with IOS devices : AP may not sync PMKs on WPA3 Enterprise SSIDs configured with OKC (Wi-Fi 5 Wave 2, Wi-Fi 6, and Wi-Fi 6E APs) Fingers crossed !

RaphaelL · ‎Jun 24 2022

You won't get the status via API. You will get the device status which will be ''alerting''. You will then need to find what kind of alert since it is not specified via API. This is the only way at the moment.

RaphaelL · ‎Jun 24 2022

I have encounted this bug many time. I'm pretty sure we have a case open on that and a fix is confirmed. We are on a holiday , I will try to confirm next sunday !

RaphaelL · ‎Jun 21 2022

Thanks Phil ! Lots of bedtime reading 🙂

RaphaelL · ‎Jun 21 2022

MX do not support link aggregation. You can still plug 2 links , but 1 of them will be in the blocking state

RaphaelL · ‎Jun 21 2022

Let's say our branch look like that : (Branch A ) MS390 -> MX250 ( Internet ) -> MX450 ( HUB ) -> ( internet ) -> MX250 -> MS390 ( Branch B ) Does the MX need to support SGT ? Or only the access layer ? So you don't think that the SGT are coming to existing models , they will need to release new models to support it ?

RaphaelL · ‎Jun 20 2022

Hi , After hearing couple sessions about SGT and TrustSec at Cisco Live , we are now interested to try SGT/Adaptive Policy on our Meraki environement. We already have tons of MS350 and a working Cisco ISE. 1- Do you really need a MS390 to make SGT work ? I don't get that part : Without this configured on Peer to Peer links, the SGT value will not be propagated on packets. This configuration is ONLY for inline SGT capable devices and will not work with MS switches previous to the MS390 https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy/Adaptive_Policy_MS_Configuration_Guide We obviously don't want to do static assignement to ports. All dynamic via ISE. Has anyone tried that yet ? What was your experience and setup ? EDIT : then found the more detailed doc : https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy/Adaptive_Policy_Configuration_Guide Which explained some of my questions. Silly me Thanks 🙂

RaphaelL · ‎Jun 8 2022

Hi , Please refer to the official API documentation : https://developer.cisco.com/meraki/api-latest/#!get-network-clients It should be something like : dashboard.networks.getNetworkClients( network_id, total_pages='all' )

RaphaelL · ‎Jun 7 2022

I think this is more related to vulnerabilities. Let's say you find a bug with their implementation of a feature that doesn't involve a security issue ( or a vuln ) you won't get paid. Don't quote me on that !

RaphaelL · ‎Jun 1 2022

To your knowledge , does this affect all the APs under 28.X code ?

RaphaelL · ‎Jun 1 2022

Great post and great explanation ! MTU , MSS can always be a nightmare to troubleshoot 🙂

RaphaelL · ‎Jun 1 2022

Hi , This is one of the options : either check the syslogs for that event ( link below ) , or get the devices that are alerting via API : https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Alert_-_Recent_802.1X_Failure

RaphaelL · ‎May 31 2022

Just tried it and works like a charm ! Are you sure that the provided ip=X.X.X.X has been configured on your MX ? ( SD-WAN & Trafic shaping ) :

RaphaelL · ‎May 31 2022

Good idea ! However , Meraki has stated that the re-auth timer is a fixed 1h because of hardware limitation. I would be great to adapt the firmware to reprocess the auth either on a timer like you suggested or via the dashboard ( eg : re-auth all clients in the ''Tools'' tab or something like that )

About RaphaelL

RaphaelL

Raphael Letourneau

Community Record

Badges