I have a replication of Cisco WLC controllers infra in few locations and it is exactly like you said. Except, I am doing exactly like WW suggested - on the switch I have a trunk port with native vlan for management, and other vlans to tunnel different type of clients, including Guests. ... View more

I'll agree with the OP. Changing a mode of a device is something important. And since they can offer a double confirmation for s2s route overlap, they can offer also a double confirmation for changing the mode.   I'll disagree with UCert regarding the rights, especially with the lack of access rights granularity (full or readonly only) Meraki offers. ... View more

in Python:  when Radius is enabled on SSID the result dict will have a key "radiusServers" which will contain a list of dicts, for every radius server, however, if the SSID does not have Radius active then the key will not exist and you can't address it via [""]. Use dict get() method to check if the key exists.   {'authMode': '8021x-radius', 'availabilityTags': [], 'availableOnAllAps': True, 'bandSelection': 'Dual band operation with Band Steering', 'concentratorNetworkId': 'N_111111111111111111', 'dot11r': {'adaptive': False, 'enabled': False}, 'dot11w': {'enabled': True, 'required': False}, 'enabled': True, 'encryptionMode': 'wpa-eap', 'ipAssignmentMode': 'VPN', 'mandatoryDhcpEnabled': True, 'minBitrate': 12, 'name': 'thisismyssidname', 'number': 2, 'perClientBandwidthLimitDown': 0, 'perClientBandwidthLimitUp': 0, 'perSsidBandwidthLimitDown': 0, 'perSsidBandwidthLimitUp': 0, 'radiusAccountingEnabled': False, 'radiusAttributeForGroupPolicies': 'Filter-Id', 'radiusAuthenticationNasId': '$NODE_MAC$:$VAP_NUM$', #this seems to be future settings in MR28 'radiusCalledStationId': '$NODE_MAC$:$VAP_NAME$', #this seems to be future settings in MR28 'radiusCoaEnabled': True, 'radiusFailoverPolicy': None, 'radiusLoadBalancingPolicy': None, 'radiusOverride': False, 'radiusProxyEnabled': False, 'radiusServers': [{'host': '10.10.10.10', 'id': 111111111111111111, 'port': 1812}, {'host': '11.11.11.11', 'id': 222222222222222222, 'port': 1812}], 'radiusTestingEnabled': False, 'splashPage': 'None', 'ssidAdminAccessible': False, 'visible': True, 'vlanId': 888, 'wpaEncryptionMode': 'WPA1 and WPA2'}         ssids = dashboard.wireless.getNetworkWirelessSsids(networkId) for ssid in ssids: radius_server_list = [] if ssid.get("radiusServers"): #Only execute if radiusServers key exists for server in ssid.get("radiusServers"): radius_server_list.append(server["host"]) print(radius_server_list)     ... View more

This is my guess, because I don't use PDL licensing: "claimDate" : "2019-08-29T12:40:10Z" , "activationDate" : "2019-09-01T15:01:46Z" , "expirationDate" : "2020-10-30T15:01:46Z"   state : 'active',   --- description ??? -> the license is assigned to a device. This is expected state of the license in the org. 'expired',--- description ??? -> the license is expired. expirationDate is in the past. 'expiring',--- description ??? -> the license expirationDate is less than 30 days from now. 'unused',--- description ??? -> License was claimed in the Organization but was not assigned to any device. 90 days have not passed yet, so activationDate has not yet started. 'unusedActive'--- description ??? -> License is not assigned to any device but activationDate is in the past. or 'recentlyQueued'--- description ??? -> can't imagine what this could be. ... View more

As an admin of more than 10 Meraki Organizations, I've created a scrip using the all-mighty API's, to send me each  morning the Change log for yesterday, so that I can see what my peers or junior admins have changed in the Organizations and to act accordingly. So I start my day by scrolling thru the change log. ... View more

With all due respect, I am quite skeptical to fill in a form which is not hosted on Meraki/Cisco domain.  ... View more

I have never tried with NSXv but I have tried to setup vpn between two mx in different organizations, so had to use 3rd party vpn.  I had quite a challenge to make it work, until I have found that the Private subnets advertised by Meraki has to be specified exactly as it is configured on the box.    If you have configured two /24 networks, you should specify in the "Private subnets" the same two networks, you can't supernet them as one /23.   Maybe this helps.   ... View more

I never tried Duo, but I would assume that the same workaround as described by me above, would do the trick for Duo too. ... View more

If you have your AP ports configured as Trunk, make sure you have a native vlan and that you have DHCP in that vlan. Afterwards you can confirm that the AP is getting an IP address from DHCP. And last but not least, why wouldn't you check the firewall logs for any drops with the source address of AP?  ... View more

@Saralyn I have also opened a case regarding Camera roles but feel like I should write here ... It would be great that Meraki try to follow a standard concept over all functionalities in the dashboard. One such concept would be - what characters can contain a role name.    Standard SAML roles can have spaces - so I have designed all my roles (40+ roles across 10+ orgs) with spaces and had some magic filtering in ADFS. Now when Camera roles were introduced - they don't allow spaces, which makes them useless for me, unless I redesign the naming concept and remove spaces from all role names.    So, please look into this and try to follow a standard in the dashboard...  ... View more

What you are trying to accomplish is achievable as I am doing the same thing.  I have setup more than 10 Meraki organizations (another 20 to come) and needed to integrate them with SAML Authentication (ADFS).  The IdP Entity ID should be unique in ADFS, therefore the problem comes when the meraki organizations are located on different shards (different dashboard links). You cannot setup different IdP in ADFS for each organizations.    So, as a king of workarounds, this is the design I made: 1. I have created a Dummy organization set for SAML authentication with a single Dummy network.  2. Gave ReadOnly access to all my Meraki roles to the dummy network. All Meraki Roles are linked to the AD groups with the same name. 3. Configured ADFS IdP Assertion Consumer Service (ACS) URL with the URL from dummy organization. 4. Configured rest of the organizations with the same fingerprint for SAML authentication. 6. Added each needed role in the respective aorganization with needed rights for that organization.   Now, when my user logins via ADFS page, the ADFS will redirect the user to the URL of the Dummy org - but since the role has rights in different organizations, meraki will allow user to select the organization from MSP portal.    This approach works perfect for me since 1 year, but there are few downsides which has to be accepted: 1. The user will see a Dummy organization. That does not impact the functionality, it is just an inconvenience. 2. You should plan your roles very carefully in advance, since one user cannot have more than 1 (one) role assigned. If the user will be part of two AD groups - then only the first group in the list will be sent to meraki.  So, if you want one user to be able to have read only access to one network in one org, and read write access to another network in another org - you cannot define separate roles for both organizations and add the user to both roles. Instead you have to created a common role for both organizations where you will give different permissions in dashboard.  3. The SAML login information will be only visible in the Dummy organization, instead of being visible in organization for which he meant to login. The "change log" will be visible in each organization separately.  4. Camera roles were deployed after my implementation, and strange enough, they don't allow "space" in the name. In the ADFS we have some automation for the role to send - so we have already a filter which includes a space, and I cannot change it - otherwise I have to change the name for 50 AD groups. This might not be the case for you, when you will add each role in Azure manually. We just wanted to avoid touching ADFS every time we want to add new role - since these are two different teams. But still, if you like to follow some naming concepts, be sure to design the AD groups (role names) without spaces, otherwise you will not be able to use camera roles.   Have fun... Roman   ... View more

I've done some Python scripting to move all a list of networks to another organization (due to a mistake made by Meraki Support). So, I had also to configure the site-2-vpn, also.  Via the API I had to specify the HUB Network Id for the spokes, no the ID of the devices them-self. Therefore, I want to assume that as long as you will not create a new network for MX450, but will just remove the MX100 and claim MX450 - everything should stay as it is.      ... View more

The site2site vpn with two MX'es in different organizations is considered as Non-Meraki VPN.   To build the site-2-site VPN with MX'es in two organizations is easy enough. One just must note that he needs to specify the subnets he's advertising, and have to match the IPsec policies on both ends.    If the MX'es are the only site-2-site appliances in the organization, they must be set as HUB. ... View more

I like the PDL model, but indeed I've seen a lot of bugs.  As already stated, calling the Support is only solution. ... View more

The same happens to me.    For local status page: Enable or disable access to the local device status pages at my.meraki.com, switch.meraki.com, wired.meraki.com. For MX's, this disables access from the LAN. Configure MX remote access here .   Since site-to-site VPN has a different virtual interface, it make a lot of sense that the page is still accessible from VPN.    However, for a VPN concentrator which only acts as Wireless concentrator, disabling local status page works as expected.  ... View more

Task 1: We are looking for a radio station. Switch Eddie's geographic location (address). Answer: Broadcasting House, Peel Wing, Portland Pl, London W1A 1AA, United Kingdom   Task 2: We are looking for a date. Have a look at VLAN 1525 in the MX. It'll provide hints. Answer: Towel Day = Tuesday, May 25   Task 3: We're looking for a well known attack used by hackers. A hint can be found in the raspberrypi client's notes. Hint: So long, and thanks for all the phishing. Answer: Phishing   Task 4: We're looking for a motto, and even a rule. Don't ... SSID 15's name says the rest. Answer: Don't Panic   Task 5: This question can be found on the splash page settings for the same SSID. Answer: What is the answer to the ultimate question of life the universe and everything   Task 6: We're looking for one of my favorite characters. The Total Perspective Vortex MV camera's tags are all hints. Hints: alan rickman and warwick davis, ambition makes you look pretty ugly, looney tunes martian, recently-added, Answer: Marvin the Paranoid Android   Task 7: We're looking for some kind of big calculator. Port 6 on switch Eddie links up to it. Hint: Deep Thought Uplink Answer: Deep Thought   Task 8: We're looking for the artist of a song. You'll need to use the snapshot API to know which one. Make a snapshot of the Total Perspective Vortex camera. I shone some light at the exact timestamp of 18/08/2020 16:12:00 Belgian time (Note that Belgian time is at +02:00 at the moment). If your timestamp is correct, you'll see the title of a song that's also the name of a spaceship, if not you'll see only darkness. Answer: Neil Young   Task 9: Who is informed when someone violates their geofencing policy? Answer: arthur.dent@human.from.earth   Task 10: By now the central theme of the questions should be clear. But the next question isn’t: oaniemmsbuhpvzkbzptgsilyzskjoticnmk? It's Vigenère encoded, the keyword for deciphering it can be found in a pointless MX L3 firewall rule. Question: name the author of this great radio series? Answer: Kirstine Kaern   --------- How to solve via Python Library: x_cisco_meraki_api_key = 'd5d2cc757aab100c3c436883ec35987e5d518cd1' dashboard = meraki.DashboardAPI(x_cisco_meraki_api_key, suppress_logging = True ) network_id = "L_631066897785293452" print ( "Task 1: We are looking for a radio station. Switch Eddie's geographic location (address)." ) devices = dashboard.networks.getNetworkDevices(network_id) for device in devices: if device.get( "name" ) == "Eddie" : print ( "Answer: " + device.get( "address" )) print ( "" ) print ( "Task 2: We are looking for a date. Have a look at VLAN 1525 in the MX. It'll provide hints." ) vlans = dashboard.appliance.getNetworkApplianceVlans(network_id) for vlan in vlans: if vlan.get( "id" ) == 1525 : print ( "Answer: " + vlan.get( "name" ) + " = Tuesday, May 25" ) print ( "" ) print ( "Task 3: We're looking for a well known attack used by hackers. A hint can be found in the raspberrypi client's notes." ) clients = dashboard.networks.getNetworkClients(network_id) for client in clients: if client.get( "description" ) == "raspberrypi" : print ( "Hint: " + client.get( "notes" )) print ( "Answer: Phishing" ) print ( "" ) print ( "Task 4: We're looking for a motto, and even a rule. Don't ... SSID 15's name says the rest." ) ssids = dashboard.wireless.getNetworkWirelessSsids(network_id) for ssid in ssids: if ssid.get( "number" ) == 14 : print ( "Answer: " + ssid.get( "name" )) print ( "" ) print ( "Task 5: This question can be found on the splash page settings for the same SSID." ) for ssid in ssids: if ssid.get( "number" ) == 14 : question = ssid.get( "adminSplashUrl" )[ 7 : 110 ].replace( "." , " " ) print ( "Answer: " + question) print ( "" ) print ( "Task 6: We're looking for one of my favorite characters. The Total Perspective Vortex MV camera's tags are all hints." ) for device in devices: if device.get( "name" ) == "Total Perspective Vortex" : print ( "Hints: " , end = "" ) for tag in device.get( "tags" 😞 print (tag.replace( "_" , " " ), end = ", " ) print ( " \n\r Answer: Marvin the Paranoid Android" ) print ( "" ) print ( "Task 7: We're looking for some kind of big calculator. Port 6 on switch Eddie links up to it." ) for device in devices: if device.get( "name" ) == "Eddie" : port = dashboard.switch.getDeviceSwitchPort(device.get( "serial" ), 6 ) print ( "Hint: " + port.get( "name" )) print ( "Answer: Deep Thought" ) print ( "" )   print ( "Task 8: We're looking for the artist of a song. You'll need to use the snapshot API to know which one. Make a snapshot of the Total Perspective Vortex camera. I shone some light at the exact timestamp of 18/08/2020 16:12:00 Belgian time (Note that Belgian time is at +02:00 at the moment). If your timestamp is correct, you'll see the title of a song that's also the name of a spaceship, if not you'll see only darkness." ) for device in devices: if device.get( "name" ) == "Total Perspective Vortex" : snapshot = dashboard.camera.generateDeviceCameraSnapshot(device.get( "serial" ), timestamp = "2020-08-18T14:12:00Z" ) print ( "Answer: Neil Young" ) #print("Link to snapshot: " + snapshot.get("url")) print ( "" ) print ( "Task 9: Who is informed when someone violates their geofencing policy?" ) alerts = dashboard.networks.getNetworkAlertsSettings(network_id) for alert in alerts.get( "alerts" 😞 if alert.get( "type" ) == "geofencingOut" : print ( "Answer: " , end = "" ) for email in alert.get( "alertDestinations" ).get( "emails" 😞 print (email) print ( "" ) print ( "Task 10: By now the central theme of the questions should be clear. But the next question isn’t: oaniemmsbuhpvzkbzptgsilyzskjoticnmk? It's Vigenère encoded, the keyword for deciphering it can be found in a pointless MX L3 firewall rule." ) firewallRules = dashboard.appliance.getNetworkApplianceFirewallL3FirewallRules(network_id) for rule in firewallRules.get( "rules" 😞 if rule.get( "comment" ) == "BABELFISH" : print ( "Question: name the author of this great radio series?" ) print ( "Answer: Kirstine Kaern" ) print ( "" ) ... View more

Had the same problem with MX450.  The device showed to be offline. There were no problems with Internet or something else, since the Spare device was on the same internet line with different IP address. Spare device started to send VRRP announcements.    We have rebooted the device, the opened a TAC case.  We were told that the OOB logs have to be collected from the Local Status Page before rebooting the device, otherwise they can't find what was the problem.  What I am not sure, if the status page was accessible at the moment of restart - I believe it wasn't, but can't confirm as we had no access to the device in that period. ... View more