Meraki

Jason-907 · ‎May 20 2021

I remember after getting my first modem, I'd call a BBS in Fargo, ND rather than any in my home state due to long distance charges (no local BBS in my hometown). My first experience with the Internet was exchanging email with my high school girlfriend was we went to colleges in different states. My first experience with a LAN came a few months after a started my first adult job in the mid-90s. I was an engineering technician and we used to toss floppy discs over the cubicle wall to share data. Came into the office one Monday morning and found that we'd upgraded to Windows for Workgroups and had 10base-t cards installed in our computers. While finding broken connections in the coaxial network became a new frustration, it was worth it to end the game of floppy disk tennis.

Jason-907 · ‎Jun 16 2020

The DNS option only shows up if you are using "Custom DNS" for your content filtering.

Jason-907 · ‎Jun 15 2020

Trying to standardize settings on several SSIDs on a couple dozen networks. I want to make sure we are using the same Custom DNS as defined by "content filtering" on the access control page. I'm not seeing any API calls that would return this information. Is there a way to get this or do I need to just open up 100 tabs and figure this out manually?

Jason-907 · ‎Jun 9 2020

I'm using the v0 of the meraki.py API. I'm trying to create a new network in my organization and populate the VLANs, I saw a post stating that I could bind the new network to a template that had VLANs enabled, but I get ['VLANs cannot be added to bound networks'] and if I unbind the network, it loses the VLAN enabled flag. As the API is used to simplify the deployment of networks, surely there is a way to do this without having to manually intervene, right? I'm hoping there is a simple answer that doesn't involve me having to learn a new framework. I wear several hats and am working this little time saver project on the side and if I have to learn something other than the Python/Meraki API, it will likely be months before I can work on this again. Thanks for any help you can offer!

Jason-907 · ‎Feb 11 2020

Thanks guys. I hit the easy button--enabled the VLANs and hoped that didn't break anything. It doesn't seem like it should break anything, but right after I did that our monitoring software stopped being able to ping the device. It was only after digging through the dashboard for a while that we figured out that the change broke the VPN mesh. I had to enable it for VLAN 1.

Jason-907 · ‎Feb 7 2020

Normally I can do the call: myvlans = meraki.getvlans(apikey, networkid, suppressprint=False) And then I can modify DHCP reservations to my heart's content. Today I needed to have my script do this for a small branch office with a flat network. It's small enough that I'm not using VLANs, so my getvlans call is returning ['VLANs are not enabled for this network'] So, is there a workaround? How do I get to the DHCP info for this network? Do I have to enable VLANs to access this information through the API? Sorry if I've totally missed something that has developed recently. I split my time between firewall, LAN, and server admin. Sometimes I can go for months without touching the meraki API.

Jason-907 · ‎Oct 10 2019

I found that anything less than a 30 second delay was sketchy. It might toggle the PoE or it might not. I think it depends on timing and latency. The ping idea is clever and I'm disappointed in myself for not thinking of it myself. I guess I'll need to make a get-client type call to grab the IP address, but that should be easy enough. This should speed up the script considerably. Thanks for the idea!

Jason-907 · ‎Oct 9 2019

Unfortunately, the API just queries the status that the dashboard is reporting as what the config should be rather than reporting the cached status until a successfully sync has been reported. That's why I was hoping there was an API call to check if the "CONFIG" on the appliance status is reporting "Up to date" or not. I've yank the loops and set pause=60 until I figure out a better way to do this. It just means the script will take longer to complete, but as I'll be doing it at night, that shouldn't be too big of an issue since we have several cameras covering the same area and with the delays, we shouldn't have more than one camera offline at a time.

Jason-907 · ‎Oct 9 2019

I'm currently having an issue where I need to reboot a PoE device. As we don't have access to the "cycle power" button via the API, I am disabling and re-enabling PoE on the device. The problem I'm having is that if I don't wait long enough, between turning off the PoE and turning it back on, then nothing happens. Is there a way to check if a change has been pushed to the device? Since these are security cameras, I don't want them all going down at the same time. for myport in myswitch: print(myport['number']) if((myport['tags'] == tag) and (myport['enabled'] == True) ): print("Cycling port tagged " + myport['tags'] + " on " + mydevice['name'] + " port: ", myport['number']) meraki.updateswitchport(apikey, serialnum, myport['number'], name=None, tags=None, enabled=None, porttype=None, vlan=None,voicevlan=None, allowedvlans=None, poe=False, isolation=None, rstp=None, stpguard=None, accesspolicynum=None, suppressprint=True) print("\tTuring off") status=meraki.getswitchportdetail(apikey, serialnum, myport['number'], suppressprint=True) time.sleep(pause) # because loop below doesn't work as intended while (meraki.getswitchportdetail(apikey, serialnum, myport['number'], suppressprint=True))['poeEnabled']: print(".", end = '') # visual queue that script hasn't hung time.sleep(pause) meraki.updateswitchport(apikey, serialnum, myport['number'], name=None, tags=None, enabled=None, porttype=None, vlan=None,voicevlan=None, allowedvlans=None, poe=True, isolation=None, rstp=None, stpguard=None, accesspolicynum=None, suppressprint=True) print("\n\tTurning back on") time.sleep(pause * 2) # because loop below doesn't work as intended while (meraki.getswitchportdetail(apikey, serialnum, portnum, suppressprint=True))['poeEnabled'] == False: time.sleep(pause) print(".", end = '') # visual queue that script hasn't hung As you can see, I tried to have the wait time based on checking if the status had changed via the API, but as this is just checking what the config in Meraki Dashboard says, it immediately reports that the criteria is met, so I had to throw pauses in before the loop. Is there a way to see how long ago the last change was pushed to the device or if config changes are still in queue? It's something the dashboard reports, so I'm hopeful its in the API and I just overlooked it. I'm trying to minimize downtime, but it;s starting to look like I might have deal with a fixed amount of downtime. Not the end of the world, but I figured if any of you had solved this issue, it'd be good to know how you did it.

Jason-907 · ‎Sep 12 2019

@Raphael_M wrote: Since the API endpoint doesn't seem to exist, have you tried adapting your script to: Disable the email alert that is triggered by the port status change Disable the port Enable the port Enable the email alert again Of course you'll need to get the network ID for each switch but that shouldn't be a big problem. That is a clever solution, but the alerts are set for configuration changes, not port status changes, so this wouldn't actually solve this one for me.

Jason-907 · ‎Sep 11 2019

@PhilipDAth wrote: > It seems like this method would require the port to be down for 1/2 an hour at a minimum. Correct. You can't do it at a horrible time of the day like 2am? No--Security cameras. What's happening is if we use the most efficient format, the cameras will lose communication with the server and ends up buffering everything until the server or camera reboots. Our camera guy just does it manually, but he was hoping we could automate. I'll test it out and just deal with the spam.

Jason-907 · ‎Sep 11 2019

@PhilipDAth wrote: If this is a Meraki Switch (MS) then configure a port schedule instead. I'll take a look at it, but I want it go off and back on immediately. It seems like this method would require the port to be down for 1/2 an hour at a minimum.

Jason-907 · ‎Sep 11 2019

I've found that looking at sample code helps more than the sparse documentation. A good resource would be very helpful. In the meantime, I'd focus on something small and get to understand it, then build from there. Is there anything specific that you are wanting to do?

Jason-907 · ‎Sep 11 2019

We are having an issue with a PoE device that only seems to crop up every few days. It appears that the devices have an inherent problem that the vendor needs to fix with a firmware update. In the meantime, the workaround is to go into the switch and click the "cycle port" button. I'll end up writing a python script that will loop through the switches in my organization and cycle to ports that have a tag for the problem devices. Is there a way to cycle a port through the API? I know I could disable and enable the port using: meraki.updateswitchport(apikey, serialnum, portnum, name=None, tags=None, enabled=False, porttype=None, vlan=None,voicevlan=None, allowedvlans=None, poe=None, isolation=None, rstp=None, stpguard=None, accesspolicynum=None, suppressprint=False) meraki.updateswitchport(apikey, serialnum, portnum, name=None, tags=None, enabled=True, porttype=None, vlan=None,voicevlan=None, allowedvlans=None, poe=None, isolation=None, rstp=None, stpguard=None, accesspolicynum=None, suppressprint=False) However, this sends alerts of changes to the switch ports whereas the "cycle port" button doesn't send any alerts. I'd like to cut down on the spam if possible as I would end up with alerts from all of our networks every morning.

Jason-907 · ‎Aug 27 2019

Thank! I don't know how I overlooked that. I think in most of my scripts I'd grabbed the list of devices in the org and used that for my list of networks. Since the SM network doesn't have hardware, it didn't show up in the list.

Jason-907 · ‎Aug 26 2019

I'm writing a script to see if DHCP reservations are for devices still on the network. It is simple enough to call client = meraki.getclient(apikey, networkid, mac, suppressprint=True) But if the device is on an extended trip and hasn't been back in the office in 30 days, I may still want to keep the reservation. I could create a loop to cycle through all of my networks to see if the device is on any of the networks, but that isn't very efficient. It seems like I should be able to query Systems Manager for the information. I see documentation for the API that suggests that I should be able to find something from meraki.getsmdevices but I'm not sure what the network_id for my Systems Manager network would be. Can anyone point me to where I can find that?

Jason-907 · ‎Aug 26 2019

What do you classify as a developer? I've never had a job doing development, but I have a computer science degree, so have coding experience from college. Since college, I mainly just write scripts to simplify monotonous tasks and it isn't what I was hired to do.

Jason-907 · ‎Aug 13 2019

The workhorse for gathering the information will be the following command. myvlans = meraki.getvlans(apikey, networkid, suppressprint=False) You'll want it to loop through the networks you have and then loop through the VLANs that this command pulls. The reservations you have set are based on MAC rather than IP, which can introduce some interesting issues depending on what you are doing with this data. Why Meraki (who allow you to upload reservations via CSV file) don't allow you to download existing reservations via a CSV file is beyond me. Good luck!

Jason-907 · ‎Aug 1 2019

I spend most of my day using powershell, but I found it more desirable to brush up on my Python skills than figure out how to tackle the Meraki API with powershell. I'll have to check this out, because it might streamline the way I do things if I can use add API calls to powershell scripts I already have. Thanks for the example.

Jason-907 · ‎Jul 25 2019

We didn't use templates for our wireless networks, so when I want to change the PSK for an SSID in our organization, I have to go into each network. Here's a snippet of the python code I use to make that crawl. import meraki suppressprint = True templateid = None apikey = input("Enter API key: ") orgs = meraki.myorgaccess(apikey,suppressprint) # All accessible OrgIDs from API Key for org in orgs: # crawl through your orgs if you have more than one myorg = org['id'] networks = meraki.getnetworklist(apikey, myorg, templateid, suppressprint) if network: # test that networks actually exist for net in networks: # crawl each network # insert your code here Anyway, that should crawl through things for you. You'd just need to add your code for what you want to do. Having never played with group policy via the API this is about as far as I can get you. Hope this helps, Jason

Jason-907 · ‎Jul 18 2019

Thanks for all the help! Here's what I came up with. myvlans = meraki.getvlans(apikey, networkid, suppressprint=False) vlanid = 100 myipassignments = {newmac: {'ip': myip, 'name': name}} for vlan in myvlans: if vlan['id'] == vlanid: vlan['fixedIpAssignments'].pop(oldmac) vlan['fixedIpAssignments'][newmac] ={'name': name, 'ip': myip} meraki.updatevlan(apikey, networkid, vlanid, name=None, subnet=None, mxip=None, fixedipassignments=vlan['fixedIpAssignments'], reservedipranges=None, vpnnatsubnet=None, dnsnameservers=None, suppressprint=False) It works great, but while I was testing I noticed a slight quirk. I was swapping old mac and new mac back and forth, but changing the name so I could be sure things were changing, but the UpdateVLAN function doesn't change the name. It will set the name if it's a new MAC, but if you are recycling a MAC it will retain the name it had originally. You have to use the dashboard to actually change the name. Shouldn't *really* be an issue, but it could be a quirk if you are trying to write a script that adds more description to reservation names. (I like to use CompName-Username, but previous admins didn't follow this method, so I wouldn't be able to write a script to normalize this naming scheme.) Also, it seems like sometimes it will change the name and other times it won't...can't really figure out what the reason is behind it.

Jason-907 · ‎Jul 13 2019

Oh, this looks very interesting--thanks! I'll start investigating next week when I get back to the office.

Jason-907 · ‎Jul 13 2019

@AlexC , thanks so much for replying. That API is what I was looking at using. I was just trying to figure out is how to remove a reservation. Say I have 22:33:44:55:66:77 assigned to 10.12.1.50, but now I want to remove that reservation or change things so 00:11:22:AA:DD:FF assigned to 10.12.1.50? I don't see a way to do this, but I admit that I'm a python novice. Would I do something like this? "fixedIpAssignments": { "22:33:44:55:66:77": { "ip": "", "name": "" } }, "fixedIpAssignments": { "00:11:22:AA:DD:FF": { "ip": "10.12.1.50", "name": "Some client name" } }, Thanks, Jason

Jason-907 · ‎Jul 12 2019

The lease time isn't the problem. It's a manager who doesn't want contractor machines to get onto our network. So, if they "accidently" plug into our workstation VLAN instead of their contractor VLAN, he doesn't want them to get an IP address...so they realize they are plugged into the wrong port. (Mind you, in the three years that we've had this location, the contractor has *NEVER* been the one causing the problem.) My manager's solution was to exclude all the IPs from DHCP and setup reservations for every device on the LAN. We actually do have some open IP addresses. The problem is, it won't take long to fill up what we have, so I need to be able to remove the reservation. This whole issue would go away if we could implement 802.1x. Then if the machine were allowed to be on our network, it would get the workstation VLAN and if it wasn't it would get the contractor VLAN. We just aren't ready to pull the trigger on that right now and I was hoping I could set something up with the API to automate what we are doing manually until we can implement the proper solution. Thanks, @Nash. I wonder if @AlexC knows how to remove a reservation via the API.

Jason-907 · ‎Jul 12 2019

Background: For reasons outside of my control, management has decided that we should reserve the entire subnet at a few of our remote sites and use reserved/fixed DHCP addresses. (I'm pushing for 802.1x to replace this, but we aren't there yet.) Meraki, in their infinite wisdom, decided that when a DHCP scope has exhausted all its leases it should send you alert every single time the PC attempts to grab an IP. Due to recent increases in business in this area, we have a several people traveling to one of these location location. Even though they should be just fine on the wireless network, they seem to always plug into the wired LAN resulting in dozens of alerts before we can create a new lease. Proposed solution: I want to create a script that will check the log for DHCP exhaustion, grab the MAC, see if it is a known client, and create a reservation if it is a known client. I also need to clean out reservations that are no longer in use. Issues: The API doesn't appear to have a hook into log files. Any ideas on how to work around this? Perhaps I need a syslog server, but that seems like overkill. I haven't seen how one goes about deleting a DHCP reservation. The JSON data appears to key off of the MAC rather than the IP address. How do I delete an old reservation? I'm assuming if I create a new reservation with a unique MAC and an IP already in use, I'm going to get an error.

Meraki

Community

About Jason-907

Jason-907

Community Record

Badges

Re: Share your nostalgic networking stories. Win swag!

Re: Check & Update Access Control -> Content Filtering -> Custom DNS

Check & Update Access Control -> Content Filtering -> Custom DNS

Creating a New Network with VLANs

Re: DHCP Reservations on Network with No VLANs

DHCP Reservations on Network with No VLANs

Re: Checking if device is up-to-date

Re: Checking if device is up-to-date

Checking if device is up-to-date

Re: Cycle Port

Re: Cycle Port

Re: Cycle Port

Re: Not a "developer," but using APIs?

Cycle Port

Re: Grabbing Client Info from Systems Manager

Grabbing Client Info from Systems Manager

Re: Not a "developer," but using APIs?

Re: DHCP Scopes in Meraki

Re: powershell script for importing/exporting devices, switchport configs, ...

Re: Meraki API Noob - Adding a client to a group policy in multiple MR netw...

Re: Detecting Lease Exhaustion and Freeing Up an Address

Re: Detecting Lease Exhaustion and Freeing Up an Address

Re: Detecting Lease Exhaustion and Freeing Up an Address

Re: Detecting Lease Exhaustion and Freeing Up an Address

Detecting Lease Exhaustion and Freeing Up an Address

Re: Detecting Lease Exhaustion and Freeing Up an Address

Re: DHCP Scopes in Meraki

Re: Share your nostalgic networking stories. Win swag!

Re: DHCP Reservations on Network with No VLANs

Re: Checking if device is up-to-date

Re: Checking if device is up-to-date