Ah, OK.  Makes sense.  Just create a network with a name, tags, time zone, blah blah blah and then get the NetId for the newly created network and bind to the ConfigTemplateId of the desired template.  Right? ... View more

Thanks.  Quick question.  If I create a new network by cloning an existing network do I clone the template and then bind the new network to that template.  Or do I clone another network container (not the template) and then bind to the template? ... View more

I'm specifically asking about API.  I need to know whether or not it's a two-step operation or a one-step operation     ... View more

Our Meraki account engineer helped me come up with a workaround so now I've got it as close to 100% automated as I can get it while I wait for Meraki to expand their API to support General->Netflow and Firewall->Port Forwarding settings. ... View more

It looks like the MR33 is misidentifying a WLCCP packet as the start of an IP flow and it's pulling src/dst IP address and protocol number information from the data stream to build the syslog msg.     The fields seem to line up quite nicely.  Protocol number byte two bytes in front of the "src ip". ... View more

Yes ... View more

I just ended up creating a small program using Visual Basic that transforms all of the mac addresses from the 11:22:33:44:55:66 format to the 11-22-33-44-55-66 format after the JSON file download is complete.  Took me all of about 15 minutes to build.  Adds about 1 seconds of time to my process.  Makes the data WAY easier to work with when I need to work with it on the fly. ... View more

Thanks! ... View more

@PhilipDAth wrote: If you are going to use that argument you would say you can't use "-" because someone will interpret it as subtraction and you can't use "." because someone will interpret it as a decimal point. It's easy to distinguish text from number in JSON isn't it?  For instance a VLAN looks like this "blah":30.  Not even considering the fact that it's not enclosed in quotes I already know that 30 is a number and not a string because I know that VLANs are what I asked for and VLANs are what I received.  When I parse JSON from the command line I store it in the variable type of my choosing.  II'm just saying that if there's a choice to avoid a special character in a string (and there clearly is with the representation of a mac address) then why not make the best choice possible (or at least avoid the worst choice possible)?  With "." and "-" characters in numbers there really isn't a practical choice to make.  By using a delimiter in a string it turns an extremely simple parsing task into an extremely difficult parsing task without adding any value.  How is 11:22:33:44:55:66 better than 11-22-33-44-55-66 or 1122.3344.5566?  At the end of the day all three are strings and should be enclosed in quotes in JSON.  None of them would be confused with a number by a person requesting them because that person should clearly understand what a mac address is and how it should be processed. ... View more

Thanks! ... View more

I'm a bit surprised at how much is missing from the API compared to what can be done via the Web UI.  One thing that really disappointed me was discovering, today, that there's a rate limit on the API calls (5 per second per organization) and that it apparently cannot be tuned.  That was like a kick to the gut.  That's not going to scale very well.  We have thousands of network containers and polling that information in serial fashion takes way too long.   I was already working on scripting that would run dozens of threads concurrently but that's way down the priority list now.  One thing that would be really nice to see is a object returned by the Networks pull that includes a time/date stamp for the last time any configurable attribute of the parent container or any child container (such as a device) changed.  99% of my iteration work would disappear immediately (unless somebody made bulk changes). ... View more

Thanks.  I curious about the Netflow configuration on the General page of the Network-wide section.  This doesn't appear to be an option that I can configure via the API and it doesn't seem to be something that survives the clone from template process.  This seems weird to me.  Am I missing something or is this really not available to be configured via the API? ... View more

@MerakiDavewrote: Unfortunately no, not today, the API call passes a single data structure for a single static route, so unfortunately it will require one API call per route today.  Certainly easy enough to set up a for loop in your script, but it will be individual API calls.  Make a wish and I'll do the same, I recently had to create some networks with about 2 dozen statics, and ran into this, cannot do it from a single call, unlike L3 FW rules for example, where you could place dozens or hundreds of FW rules with a single API call.  Just not there today for statics. My kingdom to only have to create a couple of dozen statics.  I'm looking at between 500 and 1000.  While we're wishing for stuff, how about policy-based routing?  It's only been a common thing for about a decade or more.  Would absolutely solve all of my problems right now. ... View more

@Uberseehandelwrote: @Steven   Have you considered using a list structure and iterating through it  . . .    route_dest = ['static_1', 'static_2', . . . ] for route in route_dest:        . . . .        . . . . For now this is what I've done (in my own backwards way) due to the limitation I seem to be running into.  It's slow but as long as it's automated it shouldn't be a problem. ... View more

@PhilipDAth wrote: By default AutoVPN traffic permits all traffic.  The firewall for this are located: Security Appliance/Site to Site VPN/[scroll down to Organization-wide settings]   There's a wrinkle to the way this is being deployed that might have an impact on this recommendation.  The MX65 is in the path of a DMVPN solution but is only providing encryption.  In other words, the GRE tunnels are based on Cisco routers and terminate on ASR head end routers in each of our data centers.  Traffic to/from the Meraki mgmt network trombone on the 2921 at the branch.  For instance, traffic inbound to the branch (from the DC) would follow this path to get the Meraki MGMT network:   DC -> HE (GRE) -> MX600 -> Internet (IPsec) -> MX65 -> (GRE) -> 2921 -> MX65 (native IP) -> MGMT_Net.  The only network in the tunnel is a /30 between the MX65 and the router and effects only the GRE traffic.   ... View more

@PhilipDAth wrote: Does operations connect via a WAN port or an internal vlan?    If they connect via a WAN port is it via  AutoVPN ?  The MX65 is in NAT mode and performing AutoVPN functions and Ops is reaching the Mgmt network via the IPsec tunnel. ... View more