About RomanMD

RomanMD · ‎05-15-2023

I would not say it is massive effort, except the fact it was 01:00 AM 🙂 and that I had to come up with a solution to run the certbot on the Synology which is behind the MX appliance, which is miles away.

RomanMD · ‎05-15-2023

You can't skip the root certificate, as it is the required piece of information to validate the device certificate, but now when I looked once more at both certificates I think I have another bit of explanation. The previously posted root certificate is self-signed, while the one generated by Certbot is signed by another authority, and therefore we are missing it in the chain. If one were to add Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3 in the chain, most probably it would have worked. Also, a little bit of nonsense what is active and what is retired can be found here: https://letsencrypt.org/certificates/ Here is the non-working root cert: -----BEGIN CERTIFICATE----- MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK 4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5 bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4 FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1 c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx +tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC 5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW 9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5 -----END CERTIFICATE-----

RomanMD · ‎05-15-2023

Although I don't have any explanations for the behavior of the Certbot, here's the workaround. Meraki expects two certificates: device certificate and certificate chain in device-intermediate-root order. After generating the Lets Encrypt certificate I got the three files and tried different ways to combine them but always had the same problem until I have decided to go extra mile. I realized that I use Letsencrypt for my Synology NAS and decided to analyze the difference between the certs issued for by Certbot manual step and the Synology automatic process and I have notice that while the intermediate certificates are the same, the root certificate are different 😱. After extracting the Letsencrypt root certificate from the Synology certificate and using it to create the chain for Meraki - it worked like charm. 🕺 I suspect "--preferred-chain" parameter would solve the issue, but I let others to continue the testing. Meanwhile, here is the working root certificate. -----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ 0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ 3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq 4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= -----END CERTIFICATE-----

RomanMD · ‎03-30-2023

I don't really understand the question but if I'll answer it as I understand then - No! Meraki API backend is managed by Cisco and Cisco controls the certificate. There are no security reasons why one would want to use a custom certificate! Can you provide more context around the question?

RomanMD · ‎10-21-2022

Once upon a time, there were network devices which had CLI interface ... 😬 The peoples administrating them were called Network admins... then a Merakle happened and all those admins left without a job 🤣

RomanMD · ‎10-06-2022

I only know the following regarding NTP. So, MX will use public NTP to sync time and is heavily dependent on it. If the MX will not be able to reach any NTP server it uses, it will reboot (don't ask me how I know this). So, I am not sure how you can perform audit stuff but whats I want to say is that as long as the MX is working then it reaches NTP and most probably is synced. I also don't know why would you really need it - since all events in Dashboard will most probably use cloud time instead of device time. Roman

RomanMD · ‎10-06-2022

Much appreciated! Thanks! Although this is not a competition but just a community where peoples are helping each other, it is nice to see some recognition for the effort. Thanks Roman

RomanMD · ‎09-14-2022

In a hell of an enterprise this is not easy doable. That's the long term goal, but not for the near future.

RomanMD · ‎09-14-2022

It depends about which Client VPN you are talking - IPsec VPN or Anyconnect? Meraki doesn't support it natively, but it is possible to integrate with 3rd party authentication solution which will provide another factor auth. (https://documentation.meraki.com/General_Administration/Other_Topics/Two-Factor_Authentication)

RomanMD · ‎09-14-2022

Hi everyone, recently I had the need to configure Meraki AnyConnect for a prof-of-concept project and I ran into some merakian issues. So, this post is meant to help others if they encounter the same problems. Let's start with the requirements: The main requirement was that users should authenticate with SAML, so that we can leverage 2FA. However, our SAML IdP is on-prem Active Directory Federation Services. The problem: Meraki does not have any specific guide on how to configure the SAML Authentication with ADFS. 👎 I went ahead and asked my ADFS team to configure the IdP as close as possible to what was described in the guide for Azure AD SAML configuration. However, this did not work properly. 😢 The user was prompted with the Authentication window to enter the username, password and the OTP, but then AnyConnect client returned some errors🤬: I did not know why it wasn't working, because I have no access😤 to our ADFS environment. According to the AnyConnect troubleshooting guide and the error from Event log - it said to contact Meraki support, therefore I decided to engage Meraki support 🫡. After few ping-pongs 😴 with the support, I was very "surprised" 🤨 to hear that ADFS is not supported as Identity provider for AnyConnect. This was the message from development team which was relayed by the support engineer to me. But it was just another non-sense🖕 from Meraki guys, since the ADFS or Azure AD would both use SAML 2.0 SSO which, by the way, the Meraki documentation says it is supported. I've decided not to rely on support anymore and go forward with my own testing 🥸💪. I spun up my own AD + ADFS Lab environment and figured out settings Btw: it was piece of cake to make it work. 🫢🥳 So, here we go: For this tutorial we will asume the network dynamic DNS is your-network-name.dynamic-m.com, however, for a production environment a custom DNS is recommended. In the Meraki Anyconnect setting we have to configure the following: 1. Upload ADFS Metadata XML file. 2. Configure the AnyConnect server URL: this is basically the network Hostname. You should add the port at the end, if you're not using port 443 for AnyConnect. This is all that has to be configured in the Dashboard. 🤪 The next part is to configure a new Relying Party trust on ADFS as following: (only significant settings will be shown ) The Claims should be configured as following: This are the basic settings that should be configured for the authentication to work. All other settings are either default or according to your needs.🙃 Keep in mind, Meraki does not check any ADFS claim in order to allow or deny access, therefore if one has the need to only allow a set of users based on AD Security Group, this should be configured on ADFS side. Hopefully, Meraki will put up a nicer guide on how to configure the AnyConnect SAML authentication with ADFS 🤞😈.

RomanMD · ‎09-14-2022

Because the MXes in China and the one in Azure are in different organizations, you are totally right - Non-Meraki VPN would be the solution. This is working fine, it is just some considerations that you need to have in mind. 1. The non-meraki VPN will use standard VPN ports 500 and 4500. Those might be blocked by Chinese provider or Great Firewall. 2. Using AutoVPN should bypass the Great Firewall, because of the high ports which are usually not blocked. 3. Any of those solutions might break the law.

RomanMD · ‎09-06-2022

Hi, while this make sense as a request, Meraki says not to rely on the Dashboard Speed test, since it is there just for having some idea, not for really getting correct figures. This task has to be accomplished by installing a test-point in the network which will do this.That way you not only test the Internet line itself, but also the devices in between... Cisco has this feature with Thousand Eyes and there are rumours that Thousand Eyes will have a "Meraki" version... On the other hand, read here: https://community.meraki.com/t5/API-Early-Access-Discussions/SpeedTest-Endpoint-not-working-as-expected/m-p/147120#M535

RomanMD · ‎08-13-2022

Most of the time you talk to providers and they say the problem is not on their side. I see the need of more troubleshooting... I would do a trace to see how many providers are involved and would check what MTU is allowed end-to-end... the first step. I would also do a packet capture on both ends and see if I receive the packets from remote device...

RomanMD · ‎08-12-2022

Where would the MX know the user? If the MX is not the one to authenticate the user...

RomanMD · ‎08-11-2022

Now that you said "encryption domain" I recall having a problem, and the problem was the way the subnets were defined in the encryption domain. I had to define the subnets as they were configured, and not supernet them. Maybe you have changed the configuration here...

RomanMD · ‎08-11-2022

https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior

RomanMD · ‎08-10-2022

In the routing, the most specific route takes precedence, so you can have a route: 10.10.10.0/24 next-hop 10.9.9.1 -> route for the subnet 10.10.10.5/32 next-hop 10.9.9.2 -> route for the host

RomanMD · ‎08-10-2022

It is not supported. The first recommendation applies. For instance, if your MX is participating with other MX in AutoVPN and with Fortinet in IPSec, the devices behind IPsec tunnel can't talk to devices behind AutoVPN tunnel. What you report here, is very much similar to what I've described, therefore I would assume this is the reason, but I would open a case to confirm it. This is why I pretty much like to have dedicated hardware for different services....

RomanMD · ‎08-04-2022

The tunnel will stay disconnected until there is traffic on the tunnel. Can you generate some traffic with a ping and see if the tunnel goes up?

RomanMD · ‎07-28-2022

No, not on my side. But observed different behavior with the App. It seems that from time to time they have app updates even the newly downloaded app says it is the same version.

RomanMD · ‎07-14-2022

Meraki Dashboard is meant to manage and monitor Meraki devices not other 3rd party devices, regardless of what kind of information your IoT device will send. I don't expect such integration in the future either, at least not for non Cisco devices.

RomanMD · ‎07-14-2022

Name the networks accordingly and you will find the networks at a glance in dashboard. If you have multiple organizations/networks you need to have a well established naming concept.

RomanMD · ‎07-14-2022

Well, when you go to University it is supposed that you already know the alphabet. This is true also about the Meraki - when you embrace a cloud solution like Meraki, you like the fact that you can click in a nice dashboard but then when you scale, you find out that it does not work and also the old way of making excel templates also don't work, and you can only use APIs. And you must be ready to use the APIs. The script is in Python and uses the meraki library. I am sure if you'll search in the community you'll find some video guides of how to get started with Python, and then Meraki APIs. I've posted a xx$ worth script, if you want to use of it.. feel free.

RomanMD · ‎07-14-2022

Because I thought that it might be useful for me in the future. I might have some misses here and there, or not very efficient, but if you're like me and have 40 organizations.. then... dashboard = meraki.DashboardAPI(x_cisco_meraki_api_key, suppress_logging=True) organizations = dashboard.organizations.getOrganizations() SWITCH = True # Set to True if you want to display the vlans from MX APPLIANCE = True # set to True if you want to display the vlans from MS print("Organization,Network,Type,Subnet,Vlan name,Vlan ID") for org in organizations: networks = dashboard.organizations.getOrganizationNetworks(organizationId=org["id"]) devices = dashboard.organizations.getOrganizationDevices(organizationId=org["id"], productTypes=["appliance", "switch"]) for network in networks: if "appliance" in network["productTypes"] and APPLIANCE is True: networkSettings = dashboard.networks.getNetworkSettings(networkId=network["id"]) try: singleVlan = dashboard.appliance.getNetworkApplianceSingleLan(networkId=network["id"]) print(f"{org['name']},{network['name']},MX,{singleVlan['subnet']},,1") except Exception as e: pass try: vlans = dashboard.appliance.getNetworkApplianceVlans(networkId=network["id"]) for vlan in vlans: print(f"{org['name']},{network['name']},MX,{vlan['subnet']},{vlan['name']},{vlan['id']}") except Exception as e: pass if "switch" in network["productTypes"] and SWITCH is True: switchStacks = dashboard.switch.getNetworkSwitchStacks(networkId=network["id"]) switches = [switch for switch in devices if switch["productType"] == "switch" and switch["networkId"] == network["id"]] for stack in switchStacks: for serial in stack['serials']: for index, switch in enumerate(switches): switches.pop(index) stackVlans = dashboard.switch.getNetworkSwitchStackRoutingInterfaces(networkId=network["id"], switchStackId=stack["id"]) for stackVlan in stackVlans: print(f"{org['name']},{network['name']},MS-stack,{stackVlan['subnet']},{stackVlan['name']},{stackVlan['vlanId']}") for switch in switches: switchVlans = dashboard.switch.getDeviceSwitchRoutingInterfaces(serial=switch["serial"]) for switchVlan in switchVlans: print(f"{org['name']},{network['name']},MS-nonstack,{switchVlan['subnet']},{switchVlan['name']},{switchVlan['vlanId']}")

RomanMD · ‎07-12-2022

IP band? Or IP subnet? Are you looking for the IP subnet on the WAN interface or the IP subnets configured as L3 on the MXes (Addresses and VLANs) or maybe on L3 switches? If is one of the above, the information can be easily extracted by leveraging APIs.

RomanMD

Community Record

Badges