So, basically, another device like an ASA has to be doing the IPSec tunnel, and then a static route on the Hub MX would be then be advertised in the Auto VPN?  Could it be another MX in VPN Concentrator mode?   ... View more

We are looking at different naming styles, and, like you, we are thinking of moving away from the names with "two digit codes" buried in them, that only make sense if you know what you are looking at.    We are also looking at making the device names much more readable and descriptive.  It isn't like there is a real limit on the length of the name, and we are looking at where we'd use the names and who would need to read the names of the devices.  I'm thinking of all the various email alerts and dashboard pages that show the description of the device (wireless health reports, client connection pages, drop-down menus, etc...). ... View more

Thanks...the documentation doesn't specify the WAN interfaces, which is why I was a bit confused....MX Firewall Settings - Cisco Meraki   Just trying to get some clarity while we update our network setting standards.   ... View more

For my purposes right now, Network tags.     But, according to that link above, there should be this:  Organization > Configure > Manage Tags   But I don't see that in my Dashboard.  And I don't see how I can delete a network Tag that is no longer used.   ... View more

Oh, that's a great MS doc...thanks for that link.  Something to discuss with my company's O365 guys to see if they even knew about this for Teams. ... View more

I just looked this up, and for some reason, Teams is a category to use in Layer 7 Deny rules in the MX firewall settings (under VoIP/VideoConferencing), but isn't an option when updating a Group Policy object.  Very odd.       https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide  This is the page that lists all of the FQDN and IP's used for O365 services, including Teams.  You can use Group Policy to block the IP ranges for Teams.    In your Group Policy Object, I would suggest testing a Custom Layer 7 Deny rule that blocks traffic to the Remote IP ranges needed for Teams use.   These seem to be the IP ranges needed for Teams use:  13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14, 52.238.119.141/32, 52.244.160.207/32,   Hope this helps... ... View more

This is the scenario I'm in now.   We just standardized all MX's worldwide with standard L3 Firewall rules on all VLANs (thanks Python and the API!), but now we have a Deny All rule as the rule above the Allow All built-in rule.     I would love it if I could quickly see what is being blocked by this Deny All rule right in the dashboard, or even via an API script that I could pump to an Excel spreadsheet.     Now I have to start a new project to find and configure a Syslog server to monitor blocked traffic whenever someone claims to have an issue with the firewall.   ... View more

And no idea why the pic got uploaded sideways! ... View more

You can just see the sprouts popping up! ... View more

My planter is finally showing some sprouts from the included seeds! ... View more

https://developer.cisco.com/meraki/api-v1/#!get-device-management-interface   You just need to know the serial number of the device...which you get a couple of different ways...   https://developer.cisco.com/meraki/api-v1/#!get-network-devices   or    https://developer.cisco.com/meraki/api-v1/#!get-organization-devices   You can search the model or a device tag to look for the AP's.   ... View more

Are you adding the parameter total_pages='all' if you are using Python and v1 of the API?   Click on "Templates" on that link you posted and look at the Meraki Python Library example.     Here is some info on Pages and the API:   Pagination - Meraki-Dashboard-API-v1-Documentation - Document - Cisco DevNet     ... View more

https://developer.cisco.com/meraki/api-v1/#!reboot-device    There is a Meraki Python API call now for rebooting an individual device.  You just need the device's serial number.     We wrote a quick script using this API call to do an overnight reboot of our MG devices every weekend.  We were finding if we didn't do a weekly reboot on some of the MG's, they'd need manual power cycles (popping the power on the PoE adapter) every couple of weeks after they randomly would drop offline.   ... View more

Could you post an example of your code to see what's going on?  I've updated L3 firewall rules via API in Python before with no issue, and have had IP, FQDN, and even a mixture of two as the Destination string value.   ... View more

We actually found another way to handle this via Azure.   Our Azure engineer didn't like the environmental variable option...felt it was still too insecure to keep passwords/keys.   We ended up using Azure Key Vault and an Azure VM.   So, we created an Azure 2019 server VM, installed all the Python programs and modules needed on it.   Then, we created an Azure Key Vault to store the various passwords and secrets (The VM and the KeyVault are all in the same Resource Group for simpler management).     We use a hybrid on-prem AD and Azure environment, so this setup was easier because of that.   We ended up giving our AD accounts access to the KeyVault AND we gave the Azure VM itself access to the KeyVault via RBAC (basically, via Managed Identity).     On the VM and on your local laptop, you need to install the Azure-KeyVault-Secrets and Azure-Identity modules.     azure · PyPI   azure-identity · PyPI     This website gives a great breakdown on how the Azure Identity module connects your code to Azure.   Authenticate to Azure from Python | Thomas Stringer (trstringer.com)   Example code:   import os  #to use for the KeyVault name from azure.keyvault.secrets import SecretClient from azure.identity import DefaultAzureCredential   #Code that needs to be in your script to connect to the KeyVault   azureCredentials = DefaultAzureCredential()   keyVaultName = os.environ.get('KeyVault') #we put the KeyVault Name as an environmental variable on the local machine   KVUri = f'https://{keyVaultName}.vault.azure.net'  #the KeyVault URI from its Azure settings   global client #makes the client variable a global variable in the script in case you need to call it from anywhere in your code   #connects to the Key Vault client = SecretClient(vault_url=KVUri, credential=azureCredentials)   #You can then retrieve secrets from the KeyVault to use when connecting to various systems.   retrievedSecret = client.get_secret('SECRETNAME')   password = retrievedSecret.value   On the Azure VM, it will use managed identity to connect to Azure.  On your local laptop, it will use your local user credentials to connect to Azure, which is usually a GUI pop-up.     We were then able to use a local admin account to run our scheduled scripts on the Azure VM via Task Scheduler.   And because of the way the Azure-Identity module works, we don't have to modify our code a single bit to connect to Azure and Key Vault, whether it is running on my local laptop, or on the Azure VM with a local non-domain admin account.     If you use VS Code, there is an Azure Account extension you can use to connect your VS Code program to Azure to use the Azure-Identity module.       Hope this helps some folks out there.   ... View more