Many of our offices use Comcast copper for primary Internet connectivity and use their Connection Pro, which is a cellular backup modem.  WAN1 from the MX plugs into the coper modem, WAN2 into the cellular backup.  We do not have connectivity between the two modems, otherwise we would have no visibility to failover events.   One of our sites barely has a strong enough 4G signal - about 10 Mbps with low jitter, but connectivity apparently drops several times per day, long enough to cause the site-to-site VPN connection to go down.   It would be nice if Meraki could at least include the public IP addresses involved in the connection, or the WAN port, or both, so that Outlook inbox rules can be created to ignore some of these alerts.  I only care if the connection goes down if it happens while I am in a failover.   I could for this one particular network just not use WAN2 and have the copper modem connected to the cellular modem like Comcast suggests.  The only way we would know of a failover event is if someone at the remote office complains about bandwidth or maybe there is another alert about a site-to-site route change.   Or, if someone has a better idea, I would be open to some suggestions.  I doubt there is some magic setting that just keeps the tunnel open when a connection is down for several minutes.  DNS has to happen across the tunnel, so even if I could turn off the VPN for WAN2, it would not be too helpful.   ... View more

I have a script that I have always used to copy the L3 firewall rules from one network to another.  This has worked until recently, and the only change I can see is that Security & SD-WAN > Firewall had a bit of an overhaul.  I am wondering if this broke the API, or if I just need to change something.  I did have to refine how I get the rules a bit as the output changed from getting the rules from a source network.   This is a PowerShell script, however using the Curl template as an example I am using Invoke-RestMethod to PUT the data into Meraki.   Recently, this started throwing (403) Forbidden.   What is actually happening with the above code: #PowerShell: $header = @{"X-Cisco-Meraki-API-Key" = $secured_api_key "Content-Type" = 'application/json'} #I have also tried adding "Accept" = 'application/json' to the above $header $body = @{ rules = $FirewallRules } | ConvertTo-Json $uri = https://api.meraki.com/api/v1/networks/L_123456789012345678/appliance/firewall/l3FirewallRules $request = Invoke-RestMethod -Method Put -Uri $uri -Headers $header -Body $body return $request   #This is what is stored in the $body variable from above, with IP addresses modified for use as an example. The format still matches what is in the examples in the Developer Hub. { "rules": [ { "comment": "Deny Guest to Internal VLANS", "policy": "deny", "protocol": "any", "srcPort": "Any", "srcCidr": "172.24.25.0/24", "destPort": "Any", "destCidr": "172.24.24.0/25,172.24.24.128/26,172.24.26.0/23,172.24.25.0/24,172.24.30.0/24,172.24.28.0/23,172.24.24.192/26", "syslogEnabled": false }, { "comment": "Deny Outside to Internal VLANS except itself", "policy": "deny", "protocol": "any", "srcPort": "Any", "srcCidr": "172.24.24.192/26", "destPort": "Any", "destCidr": "172.24.24.0/25,172.24.24.128/26,172.24.26.0/23,172.24.25.0/24,172.24.30.0/24,172.24.28.0/23", "syslogEnabled": false } ] } The account used with the API has full access. I am wondering if the format of $body needs to change to accommodate changes made to the dashboard, considering that Inbound and Cellular rules have been added.   I am sort of at a loss of what to do to fix this.  I am sure I can switch to using CURL from within PowerShell if anyone who wants to take a stab at it has trouble with PowerShell programming and the Invoke-RestMethod way I was doing it.  I got really deep in the weeds programming that way before realizing I could have used curl commands all along in PS (and at the time I was new with API programming). ... View more

When I look at "Other SSIDs" in the Air Marshal, all signal strengths are reported as positive values - probably because the unit of measure is dB, and not dBm.  So, it is a ratio.  A ratio to what?  Why would I see 33 dB when I turn on the hotspot on my cell phone, and see -67dBm when reported by my UniFi dashboard?     I was asking on another forum about a neighbor who was showing up with 50+ devices at >90dB signal strength, hosing my own WiFi, and they insisted that it should be a non-issue because that is essentially zero.  But, -90dBm would be essentially nothing - not positive 93dB as I see in the dashboard.     ... View more

I am interested in turning on Policy Objects, but I am wondering if it is even worth it yet for how we are managing our networks.  Below is a simple set of firewall rules from a template covering 350 sites.  I have another 50 sites that just cannot be part of a template, and I have to use a more lengthy set of rules, all with CIDR notation.  I would love to just plug in my VLAN names and other objects using defined names instead.  VLAN names, like Management, Users, Wireless, Guests, etc. are going to be the same names at every site, but different IP ranges per network.   Can I have a policy object named "Management" that for Network A that covers 10.0.0.0/24, then another one called "Management" for Network B that covers 10.0.1.0/24, etc.?  Or would I be stuck with "Network A Management" and "Network B Management" when I start creating these?  I would love to just use the API to dump in firewall settings and not have to manipulate the data before it is uploaded.     ... View more