Please stop. I've already received 4 notifications from the thread, I didn't need an additional private message to know that you've responded here. ... View more

So is the answer that I don't have the option to configure it? Or that I need to open a support case? Sorry, but unless you have a definitive answer, I'd like to hear from anyone who actually knows. ... View more

Hey just a heads up, I went back and cleaned this up and removed syslog-ng altogether as I didn't want to have to maintain a different application just to collect the Meraki logs. I might re-install it if I need to push other logs to this server but for the time being, I'm only sending Cisco FP and Meraki logs.    In order to do this, I downloaded and installed the Sumo Logic Installed Collector on my Linux server. With the collector installed, you simply need to configure the sources (your Meraki devices) in the Sumo Logic dashboard with the corresponding IP and port numbers.   Use these docs to get things going: 1. https://help.sumologic.com/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki/Collect_logs_for_the_Cisco_Meraki_App   2. https://help.sumologic.com/03Send-Data/Sources/01Sources-for-Installed-Collectors/Syslog-Source From this article, this was the important piece for me --    For multiple syslog collections, set up a separate Source for each and set a separate port number for each.   Hope that helps. I'm now able to ingest the Meraki logs without configuring a whole bunch of overhead for syslog-ng. ... View more

They still need to connect to the VPN when they work from home. I think you may have misunderstood my question.   Users will work from home a majority of the time. Occasionally, they will come into the office and connect either via ethernet or wireless. At that time, we don't need them to use the Meraki Client VPN. Hope that clears things up.  ... View more

Hey @Sumo_int9898 , I would have loved to have pushed it to an S3 bucket but they are going to the EC2 instance itself. Once Sumo ingests the log, the data in the log file itself is no longer required. You should also be able to set a retention policy on the Sumo Logic side for compliance purposes. You could theoretically set a cron job on the EC2 instance to clear out the files on a daily basis as they would not be needed for any considerable period. ... View more

Just following up to provide some snippets of my actual config file, here's how I have it configured (generalized for privacy). Also, if there's any way to clean this all up, any input is much appreciated. I am a novice with Linux and even more-so with syslog-ng.     #define syslog source -- a.b.c.d in this section referring to the syslog server. #source s_net { udp(ip(0.0.0.0) port(514)); }; #source s_net { tcp(ip(0.0.0.0) port(514) max-connections (5000)); udp(); }; source s_net { udp(ip(a.b.c.d) port(514)); }; source s_meraki_flfw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_cafw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_cofw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_gafw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_mnfw { udp(ip(a.b.c.d) port (514)); };   #filtering filter f_meraki_vmx100_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_vmx100_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_flfw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_flfw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_cafw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_cafw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_cofw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_cofw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_gafw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_gafw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_mnfw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_mnfw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); };   #destination files destination df_meraki_vmx100_urls { file("/var/log/meraki_urls.log"); }; destination df_meraki_vmx100_flows { file("/var/log/meraki_flows.log"); }; destination meraki_flfw_flows {file("/var/log/firewalls/meraki/flfw/mx_flows.log"); }; destination meraki_flfw_urls {file("/var/log/firewalls/meraki/flfw/mx_urls.log"); }; destination meraki_cafw_flows {file("/var/log/firewalls/meraki/cafw/mx_flows.log"); }; destination meraki_cafw_urls {file("/var/log/firewalls/meraki/cafw/mx_urls.log"); }; destination meraki_cofw_flows {file("/var/log/firewalls/meraki/cofw/mx_flows.log"); }; destination meraki_cofw_urls {file("/var/log/firewalls/meraki/cofw/mx_urls.log"); }; destination meraki_gafw_flows {file("/var/log/firewalls/meraki/gafw/mx_flows.log"); }; destination meraki_gafw_urls {file("/var/log/firewalls/meraki/gafw/mx_urls.log"); }; destination meraki_mnfw_flows {file("/var/log/firewalls/meraki/mnfw/mx_flows.log"); }; destination meraki_mnfw_urls {file("/var/log/firewalls/meraki/mnfw/mx_urls.log"); };   #bundle source, filter & destination rules log { source ( s_net ); filter( f_meraki_vmx100_urls ); destination ( df_meraki_vmx100_urls ); }; log { source ( s_net ); filter( f_meraki_vmx100_flows ); destination ( df_meraki_vmx100_flows ); }; log { source ( s_meraki_flfw); filter( f_meraki_flfw_flows); destination ( meraki_flfw_flows ); }; log { source ( s_meraki_flfw); filter( f_meraki_flfw_urls); destination ( meraki_flfw_urls ); }; log { source ( s_meraki_cafw); filter( f_meraki_cafw_flows); destination ( meraki_cafw_flows ); }; log { source ( s_meraki_cafw); filter( f_meraki_cafw_urls); destination ( meraki_cafw_urls ); }; log { source ( s_meraki_cofw); filter( f_meraki_cofw_flows); destination ( meraki_cofw_flows ); }; log { source ( s_meraki_cofw); filter( f_meraki_cofw_urls); destination ( meraki_cofw_urls ); }; log { source ( s_meraki_gafw); filter( f_meraki_gafw_flows); destination ( meraki_gafw_flows ); }; log { source ( s_meraki_gafw); filter( f_meraki_gafw_urls); destination ( meraki_gafw_urls ); }; log { source ( s_meraki_mnfw); filter( f_meraki_mnfw_flows); destination ( meraki_mnfw_flows ); }; log { source ( s_meraki_mnfw); filter( f_meraki_mnfw_urls); destination ( meraki_mnfw_urls ); }; ... View more

Hi @cmr,   Its an Amazon Linux 2 AMI (AWS) and I'm running syslog-ng as I found recommended by various sources. I set up the sources as separate "lines" for each office so something like:   s_meraki_vmx100 s_meraki_office01 s_meraki_office02 s_meraki_office03   and so on, trying to stay close to the Meraki documentation shown below   #define syslog source source s_net { udp(ip(192.168.10.241) port(514)); }; #create individual filters to match each of the role categories filter f_meraki_urls { host( "192.168.10.1" ) and match("urls" value ("MESSAGE")); }; filter f_meraki_events { host( "192.168.10.1" ) and match("events" value ("MESSAGE")); }; filter f_meraki_ids-alerts { host( "192.168.10.1" ) and match("ids_alerted" value ("MESSAGE")); }; filter f_meraki_flows { host( "192.168.10.1" ) and match("flows" value ("MESSAGE")); }; #define individual destinations for each of the role categories destination df_meraki_urls { file("/var/log/meraki_urls.log"); }; destination df_meraki_events { file("/var/log/meraki_events.log"); }; destination df_meraki_ids-alerts { file("/var/log/meraki_ids-alerts.log"); }; destination df_meraki_flows { file("/var/log/meraki_flows.log"); }; #bundle the source, filter, and destination rules together with a logging rule for each role category log { source ( s_net ); filter( f_meraki_urls ); destination ( df_meraki_urls ); }; log { source ( s_net ); filter( f_meraki_events ); destination ( df_meraki_events ); }; log { source ( s_net ); filter( f_meraki_ids-alerts ); destination ( df_meraki_ids-alerts ); }; log { source ( s_net ); filter( f_meraki_flows ); destination ( df_meraki_flows ); };   ... View more

Thanks for your help! Looks like I had misconfigured the security group and set it for TCP instead of UDP. I configured my other firewall correctly for UDP but wasn't testing with that device just yet. Recreated the security group and I'm now receiving data to my flows and urls log files! BTW, I am still using port 514 and did not have to switch to 1514 (will keep this in mind, though, if we run into issues in the future).   I'm now working on trying to get these log files ingested by a SIEM solution (Sumo Logic) we're looking to implement so this has been a really good learning lesson for me. I may continue to post here rather than open up a new thread just to keep things organized in case anyone else runs into issues configuring syslog-ng on an AWS Linux 2 EC2 instance. ... View more

@PhilipDAth wrote: I don't know the answer.   I believe the s_net is the interface on the syslog service that will be used to listen to incoming messages - not the IP address of the VMX. Try:   source s_net { tcp(ip(0.0.0.0) port(514) max-connections (5000)); udp(); };       That was totally my fault. I had misread that particular line in the documentation and entered the source s_net as the IP address of the VMX.    I've corrected that and the service is no longer failing with the IP address of the syslog service. However, I'm not seeing it listening. Any ideas if I need to manually set it to listen or should it be listening by default once configured?       ... View more

Thanks for your reply, @PhilipDAth. Based on the documentation here: https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration   Is there any issue with that initial part of the statement that shows "tcp" since the document linked above shows that Meraki sends syslog over UDP?   I'll give this a shot. ... View more

Figured out what was going on here. Google requests would routinely get routed to servers in Mexico. Our L7 firewall rules are currently set to only allow communication to/from certain countries and Mexico is not one of them. When the searches would time out, I could go into the search bar and change it to .co.uk and it would immediately return the search result. nslookup helped pinpoint this issue if anyone runs into this in the future.   Meraki uses MaxMind for their GeoIP lookups so it all makes more sense now. My question now is, is there a way to prevent our network users from resolving to Google's servers in Mexico?    ... View more

I'll give it a shot. If anyone else has any ideas, I'm all ears. ... View more

We have CarbonBlack installed as our AV/endpoint protection. As far as DNS, we use AWS' Managed Active Directory solution so I noticed when I do an nslookup it is using one of the two servers. For instance if I say nslookup google.com, it shows me the AWS Managed AD IP address and finally the non-auth answer for google.com. ... View more

Unfortunately, we don't have Web search filtering under Content Filter. Would have been nice if that were the case then I could just disable that. We actually don't have AMP enabled at the moment (although I thought we did). We do have IDS set to Prevention and Security. ... View more

From the VPN Status page, right around the time this was happening between the two offices. However, the peer that is listed isn't one of the two offices that fired off the alerts. ... View more

Thanks @PhilipDAth, That answers my question. I appreciate you replying to this old thread! Hopefully this info is helpful to others looking for this info as well.   Quick edit: If RADIUS doesn't get computer information, what mechanism would make it possible to authenticate the computer/device the user is logging in from? Would we have to use something different altogether? ... View more

Hi @PhilipDAth,   Can you elaborate on why this isn't possible? We're looking to implement this (we already have RADIUS configured to authenticate based on a specific user group) but it sounds like it wouldn't work. NPS in Windows Server 2012 has the option to do both user and computer via Windows Group (which says it does both?), or, one or the other meaning you can select Machine Groups or User Groups.   Is this a limitation on the Meraki side? ... View more

Yeah, unfortunately we're not using SM.. we're using Microsoft's Intune MDM solution. I should note that we are already using RADIUS for authentication. The piece that's missing here is the ability to deploy the VPN connection either with the PSK already defined so that information does not need to be disseminated to the user, OR use a certificate in place of PSK. I've always used PSK so configuring the VPN connection to use a certificate would be new to me. Lastly would be the mass deployment part. I have a number of users who require the use of the VPN and configuring this on an individual basis would be cumbersome and inefficient. I believe it can be done through GPO but not 100% sure on that. I just want to get an idea for how others out there deploy the Client VPN solution to their users. ... View more