Exciting 😁 ... View more

Its easy to terminate tunnel with the networks inside one organization using Auto vpn features but in your case that you want organization to organization vpn you need to manually configure it just like a classic way of vpn configuration. Here:   Non-Meraki VPN peers You can create Site-to-site VPN tunnels between the MX appliance and a Non-Meraki VPN endpoint device under the Non-Meraki VPN peers section on the Security & SD-WAN > Configure > Site-to-site VPN page. Simply click "Add a peer" and enter the following information: A name for the remote device or VPN tunnel. The public IP address of the remote device. The subnets behind the third-party device that you wish to connect to over the VPN. 0.0.0.0/0 can also be specified to define a default route to this peer. The IPsec policy to use. The preshared secret key (PSK). Availability settings to determine which appliances in your Dashboard Organization will connect to the peer. Note that if an MX is configured with a default route (0.0.0.0/0) to a Non-Meraki VPN peer, traffic will not fail over to the WAN, even if the connection goes down. IPsec policies There are three preset IPsec policies available. Default: Uses the Meraki default IPsec settings for connection to a non-Meraki device AWS: Uses default settings for connecting to an Amazon VPC Azure: Uses default settings for connecting to a Microsoft Azure instance If none of these presets are appropriate, the Custom option allows you to manually configure the IPsec policy parameters. These parameters are divided into Phase 1 and Phase 2. Phase 1 Encryption: Select between AES-128, AES-192, AES-256, and 3DES encryption Authentication: Select MD5 or SHA1 authentication Diffie-Hellman group: Select between Diffie-Hellman (DH) groups 1, 2, and 5 Lifetime (seconds): Enter the phase 1 lifetime in seconds   Phase 2 Encryption: Select between AES-128, AES-192, AES-256, and 3DES encryption (multiple options can be selected) Authentication: Select between MD5 and SHA1 authentication (both options can be selected) PFS group: Select the Off option to disable Perfect Forward Secrecy (PFS). Select group 1, 2, or 5 to enable PFS using that Diffie Hellman group. Lifetime (seconds): Enter the phase 2 lifetime in seconds On May 8th 2018, changes were introduced to deprecate DES for encryption. Click here for more information.  Peer availability By default, a non-Meraki peer configuration applies to all MX-Z appliances in your Dashboard Organization. Since it is not always desirable for every appliance you control to form tunnels to a particular non-Meraki peer, the Availability column allows you to control which appliances within your Organization will connect to each peer. This control is based on network tags, which are labels you can apply to your Dashboard networks. When "All networks" is selected for a peer, all MX-Z appliances in the organization will connect to that peer. When a specific network tag or set of tags is selected, only networks that have one or more of the specified tags will connect to that peer. More information on network tags can be found here. VPN Firewall Rules You can add firewall rules to control what traffic is allowed to pass through the VPN tunnel. These rules will apply to outbound VPN traffic to/from from all MX appliances in the Organization that participate in site-to-site VPN. These rules are configured in the same manner as the Layer 3 firewall rules described on the Firewall Settings page of this documentation. Note that VPN Firewall rules will not apply to inbound traffic or to traffic that is not passing through the VPN.  Monitoring site-to-site VPN You can monitor the status of the site-to-site VPN tunnels between your Meraki devices by clicking Security & SD-WAN > Monitor > VPN Status. This page provides real-time status for the configured Meraki site-to-site VPN tunnels. It lists the subnet(s) being exported over the VPN, connectivity information between the MX appliance and the Meraki VPN registry, NAT Traversal information, and the encryption type being used for all tunnels. Additionally, the Site connectivity list provides the following information for remote Meraki VPN peers: Name of the remote Meraki VPN peer. Subnets that are being advertised over the VPN by the remote peer device. Status (whether the peer is currently reachable). Round-trip packet latency over the VPN (in milliseconds). Last time a heartbeat packet was sent to determine the status of the VPN tunnel (in seconds).             ... View more

wow !!! exciting prize 🙂 #bringiton ... View more

@Mr_IT_Guythank sir. It works. ... View more

I am on the same version as you mention but it doesn't work. ... View more

yes I tried /32 and /24 but it is the same error. ... View more

yeah its the version of the mx. Anyway thanks sir. ... View more

I also try it with ip address only without cidr but it shows error. ... View more

Ive added it too "google.com.ph" and then it can access but still of those sub domains are necessary to add in the whitelisting. I am trying here both my mx64 and mx65w.   ... View more

@PhilipDAthi just type google.com ... View more

  The whitelisting for google.com wasn't effective.       ... View more

@PhilipDAthi tried to whitelist only "google.com" and then save it and i also restart the appliance but it seems it didn't take effect. But it work on the other sites like facebook, cisco.com, youtube.com but only in google site. Did you try it already on your side?   ... View more

I have done doing that but it didn't work on my side.   ... View more

@PhilipDAthit works now. Is there a way to put 1 URL to cover all domain of Facebook? Just like now you are recommending to add fbcdn.net for the facebook.   How about in the Google, since google has many sub domain like mail.google.com and more.   How can i address that?   ... View more

@PhilipDAthit works but some of the graphics of website are not visible. Like for example the facebook.com, most of the CSS style are not visible. ... View more

I will try this one. Get back to you once done. @PhilipDAth ... View more

@MerakiDavehow about websites like youtube, google, facebook or even categorize url. Since in the firewall rules, it cannot be done because it used ip addresses for the policy. Anyway, i was trying to use content filtering here, blocking all the category and then i use whitelisting to allow google.com but suddenly it didn't work.   Do you have a suggestion? ... View more

especially allow to access to meraki dashboard. ... View more

Hi @MilesMeraki , Let say i want to allow my local network to access specific website such as google.com, cisco.com and office365. The rest will be block.   Thanks in advance. ... View more

I will check that. ... View more

    I am using python 3.6 ... View more

C:\Users\Lenovo\Desktop>python meraki-backup.py [API-KEY] "Ardent Network Inc" Processing network MY NETWORK Processing network NGKHAI HTTP Status Code: 404 - No returned data Traceback (most recent call last): File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 601, in urlopen chunked=chunked) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 346, in _make_request self._validate_conn(conn) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 850, in _validate_conn conn.connect() File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connection.py", line 326, in connect ssl_context=context) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\util\ssl_.py", line 329, in ssl_wrap_socket return context.wrap_socket(sock, server_hostname=server_hostname) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 407, in wrap_socket _context=self, _session=session) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 814, in __init__ self.do_handshake() File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 1068, in do_handshake self._sslobj.do_handshake() File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 689, in do_handshake self._sslobj.do_handshake() ConnectionAbortedError: [WinError 10053] An established connection was aborted by the software in your host machine During handling of the above exception, another exception occurred: Traceback (most recent call last): File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\adapters.py", line 440, in send timeout=timeout File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 639, in urlopen _stacktrace=sys.exc_info()[2]) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\util\retry.py", line 357, in increment raise six.reraise(type(error), error, _stacktrace) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\packages\six.py", line 685, in reraise raise value.with_traceback(tb) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 601, in urlopen chunked=chunked) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 346, in _make_request self._validate_conn(conn) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connectionpool.py", line 850, in _validate_conn conn.connect() File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\connection.py", line 326, in connect ssl_context=context) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\urllib3\util\ssl_.py", line 329, in ssl_wrap_socket return context.wrap_socket(sock, server_hostname=server_hostname) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 407, in wrap_socket _context=self, _session=session) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 814, in __init__ self.do_handshake() File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 1068, in do_handshake self._sslobj.do_handshake() File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\ssl.py", line 689, in do_handshake self._sslobj.do_handshake() urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionAbortedError(10053, 'An established connection was aborted by the software in your host machine', None, 10053, None)) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "meraki-backup.py", line 184, in <module> write_ssid_settings(file,apikey,row['id'],suppressprint) File "meraki-backup.py", line 121, in write_ssid_settings myRules=meraki.getssidl3fwrules(apikey, networkid, row['number'], suppressprint)[0:-2] File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\meraki\meraki.py", line 1703, in getssidl3fwrules dashboard = requests.get(geturl, headers=headers) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\api.py", line 72, in get return request('get', url, params=params, **kwargs) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\api.py", line 58, in request return session.request(method=method, url=url, **kwargs) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\sessions.py", line 508, in request resp = self.send(prep, **send_kwargs) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\sessions.py", line 640, in send history = [resp for resp in gen] if allow_redirects else [] File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\sessions.py", line 640, in <listcomp> history = [resp for resp in gen] if allow_redirects else [] File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\sessions.py", line 218, in resolve_redirects **adapter_kwargs File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\sessions.py", line 618, in send r = adapter.send(request, **kwargs) File "C:\Users\Lenovo\AppData\Local\Programs\Python\Python36-32\lib\site-packages\requests\adapters.py", line 490, in send raise ConnectionError(err, request=request) requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionAbortedError(10053, 'An established connection was aborted by the software in your host machine', None, 10053, None)) ... View more