So this is the correct syntax for a specific data/time range.  You have to use startingAfter and startingBefore vs occurred.  But even then it doesn't return that specific event log and Meraki  support has gone back to their engineering team to figure out why.       https://api.meraki.com/api/v1/networks/L_609111849601866880/events?productType=wireless&includedEventTypes[]=8021x_eap_success&startingAfter=2025-10-28T23:08:00Z&startingBefore=2025-10-28T23:13:00Z     ... View more

It works for a majority of the time.  Meaning if a user logs into one of our SSIDs via RADIUS/EAP successfully it generates an event log in Meraki.  We have other sources of truth that we use to correlate that data and it works, but less than ideal.   I just want to make sure that if that specific event log is generated than our Meraki API calls will return it correctly and that simply doesn't always happen and that is why I am here.    Does windows NPS support API calls?  ... View more

It works and returns just those event types, but again only 5 or 6 of them and all from today.  I feel like something is missing or broken with their API that is simply not allowing this to work right. ... View more

Yeah that worked, but returned only 6 or 7 random results and only from 10/30, nothing between 27th and the 28th so not sure its interpreting the date range correctly?  None of the events returned were for 8021x_eap_success either.   What would be the correct syntax for exact date and time and only 8021x_eap_success?  IE 10/28/25 16:08:13 PDT. Starting to wonder if I need to search for event type description?  Meaning Successful authentication (EAP success) vs the event type?   I really just want to see what querying for this exact log entry will return:       ... View more

I would if I could get the syntax right...I can't even get the CURL command to run successfully (in windows) without specifying a date range or specific event type.  Runs fine in Linux though.    Can you help me with the right syntax for date/time?     curl -L -H 'X-Cisco-Meraki-API-Key: <meAPIKEY>' -X GET -H 'Content-Type: application/json' 'https://api.meraki.com/api/v1/networks/L_609111849601866880/events?productType=wireless' curl: (6) Could not resolve host: application curl: (3) URL rejected: Port number was not a decimal number between 0 and 65535   ... View more

I don't think that is the issue.  But something appears to be different from the GUI to what the API can return.   In an effort to slim this down I added logic to search for a specific username, on a specific network as well as debug to show a match which works, but no match no data.  And that is the problem I cannot get it to match and pull every single EAP success for a 24 hour period for some users and no idea why.       Matched Event: {'occurredAt': '2025-10-28T23:47:45.480374Z', 'networkId': 'L_609111849601866880', 'type': '8021x_eap_success', 'description': 'Successful authentication (EAP success)', 'clientId': 'k1e8554', 'clientDescription': 'devicename', 'clientMac': '56:0a:ab:1c:e1:2f', 'category': '8021x', 'deviceSerial': 'xxxxxxx', 'deviceName': 'ap1', 'ssidNumber': 0, 'ssidName': 'wireless', 'eventData': {'radio': '1', 'vap': '0', 'client_mac': '56:0A:AB:1C:E1:2F', 'identity': 'user1'}}   If I have 2 log entries for 2 different users 1 after the other the script finds the first one user1 but not the second user2 when its clear as day there are entries for both.     :~/meraki-automation$ python3 meraki-eap-v1.py Enter the date to run (YYYY-MM-DD): 2025-10-28 Enter the identity to search for (e.g., user or user@domain.com): user1 Enter the network name to search in (or part of it): hq Searching HQ... Matches found in HQ: 1 Saved 1 matching events to auth-user1-2025-10-28.csv :~/meraki-automation$ python3 meraki-eap-v1.py Enter the date to run (YYYY-MM-DD): 2025-10-28 Enter the identity to search for (e.g., user or user@domain.com): user2 Enter the network name to search in (or part of it): hq Searching HQ... Matches found in HQ: 0 Saved 0 matching events to auth-user2-2025-10-28.csv     import requests import csv from datetime import datetime, timedelta, timezone import re API_KEY = 'MY-API-KEY' BASE_URL = 'https://api.meraki.com/api/v1' headers = { 'X-Cisco-Meraki-API-Key': API_KEY, 'Content-Type': 'application/json' } def main(): # Prompt for date, identity, and network name filter date_input = input("Enter the date to run (YYYY-MM-DD): ") identity_input = input("Enter the identity to search for (e.g., user or user@domain.com): ") network_filter = input("Enter the network name to search in (or part of it): ").lower() try: target_date = datetime.strptime(date_input, "%Y-%m-%d").date() except ValueError: print("Invalid date format. Please use YYYY-MM-DD.") return normalized_target_identity = identity_input.split('@')[0].lower() start_time = datetime.combine(target_date, datetime.min.time()).replace(tzinfo=timezone.utc) end_time = start_time + timedelta(days=1) orgs = requests.get(f'{BASE_URL}/organizations', headers=headers).json() org_id = orgs[0]['id'] networks = requests.get(f'{BASE_URL}/organizations/{org_id}/networks', headers=headers).json() # Filter networks based on user input filtered_networks = [net for net in networks if network_filter in net['name'].lower()] if not filtered_networks: print(f"No networks found matching '{network_filter}'.") return matching_events = [] for network in filtered_networks: network_id = network['id'] network_name = network['name'] print(f"\nSearching {network_name}...") url = f'{BASE_URL}/networks/{network_id}/events' params = { 'productType': 'wireless', 'includedEventTypes[]': '8021x_eap_success', 'occurredAfter': start_time.isoformat().replace('+00:00', 'Z'), 'occurredBefore': end_time.isoformat().replace('+00:00', 'Z'), 'perPage': 1000 } match_count = 0 while url: response = requests.get(url, headers=headers, params=params) response.raise_for_status() data = response.json() events = data.get('events', []) for event in events: occurred_at_str = event.get('occurredAt', '') try: occurred_at = datetime.fromisoformat(occurred_at_str.replace('Z', '+00:00')) except ValueError: continue if not (start_time <= occurred_at < end_time): continue client_mac = event.get('clientMac', '') identity_raw = event.get('eventData', {}).get('identity', 'N/A') normalized_identity = identity_raw.split('@')[0].lower() if normalized_identity != normalized_target_identity: continue matching_events.append([network_name, occurred_at.isoformat(), client_mac, identity_raw]) match_count += 1 # Check for rel="next" in Link header link_header = response.headers.get('Link', '') match = re.search(r'<([^>]+)>;\s*rel="next"', link_header) url = match.group(1) if match else None params = None # Clear params for next URL print(f" Matches found in {network_name}: {match_count}") filename = f"Meraki-auth-{normalized_target_identity}-{target_date.isoformat()}.csv" with open(filename, 'w', newline='', encoding='utf-8') as file: writer = csv.writer(file) writer.writerow(['Network Name', 'Occurred At', 'Client MAC', 'Identity']) writer.writerows(matching_events) print(f"\nSaved {len(matching_events)} matching events to {filename}") if __name__ == '__main__': main()   ... View more

Meraki would be a lot cooler if they did.      ... View more

Is it though? 99% of our MacBook's are identified as the exact same thing (MAC OSX 10.15) and don't get blocked.  So the portal is reporting it as a device that shouldn't get blocked but blocking it regardless.   ... View more

Are you saying to specifically allow MAC OS X on the device type filter?  Like so?  Also what is odd is that we have 0 clients on anything older than 15.3 in our environment.  But the majority of our MacBook clients are being identified as MAC OSX 10.15 which I am assuming Meraki just uses it as a catch all for MacBook's if it can't accurately identify what version or device it is?      ... View more

I get that but Mac OS X 10.15 is not something we block, but it is an option to block under policies by device type:       So if we aren't blocking it, why would Meraki report/identify the client as Mac OS X 10.15 and still block it?  That is what I am not understanding.  Its not like it reported it as an iPhone or any of the 3 other types show above.  Just seems like something changed within Meraki's backend to break this. ... View more

See this on our MR36s running 30.7.1 as well and no changes on our side and no way all the cables are bad for all the APs reporting the issue. Tried shut/no-shut and hardcoding to 1000 but neither worked.  APs com back up at 100Mbps.    No way all of us, all of the sudden, have bad cabling, it is surely an issue with the AP firmware.     Doesn't seem to be an issue for our MR56s.     GigabitEthernet1/0/26 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is b44c.90c4.7a9a (bia b44c.90c4.7a9a) Description: Meraki AP-M36 MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX       ... View more

Update to all this, it seems OSX clients won't tag ZOOM traffic over a Meraki SSID, but the AP will tag that traffic once it sees it.  I assume this is due to fast lane on OSX but I really don't have any way to confirm that.  Can you disable fast lane via Meraki?    At the end of the day we have it working mostly for what we want and these are the traffic shaping rules we ended up with.  We see the tags from the client or the wired side of the AP if the client isn't tagging it.       ... View more

@GIdenJoe    These are the default rules you are referring to?  If so have you had good results using them? I can set ZOOM to use whatever I want and can go as far as to match those default rules.       ... View more

The reason I did is because 56/CS7 is what Cisco recommended and ZOOM defaults to.  I am not seeing the right tags from the client connected to the AP when it reaches the firewall.  So it’s either all traffic is being tagged as CS7 or none of it.  Versus outside the office where my voice and video are being tagged correctly.   I can change CS7 to something else once I have this working correctly.   ... View more

Yeah so that is from my house, so the only rules applying there are ZOOM marking them which it is doing.  In the office doing a packet capture from the firewall for wireless clients I don't see any tags or I see all (CS7) 56 which is just odd.  So I figured Meraki must be doing something nefarious because on the backbone we are just trusting the tags and prioritizing traffic based on them.     Below is from the firewall for a wireless client at the office and all their traffic towards the internet. You can see all this users traffic is tagged as CS7 and we see the complete opposite from other users with 0 tags whatsoever.       I wanted to be sure that if Meraki does see those tags it doesn't limit bandwidth to them.  So that is where the traffic shaping rules came into play and how to best ensure we had them configured correctly.  When checking all the moving parts we are seeing odd behavior and not sure what is causing it.      Make a long story short we are tagging traffic from ZOOM and we aren't seeing those tags applied correctly to wireless clients.  We know those clients can send/receive those tags because we see them outside the office, why inside the office we don't see the same behavior is the unknown.     Do you know if I specify a localsubnet on a rule will Meraki tag all packets on that subnet that match the ports I have defined on that same rule?  Its just not clear on what exactly those definitions are doing.    Let me see if I can decipher what wired office clients are doing.       ... View more

I have no MX, I have PAN firewalls at the office.   At home, outside of my network and sans Meraki I get the correct tags via my ZOOM client installed via the MSI file.  I want the same behavior in the office but again something is not translating.  Sometimes clients get all CS7 (56) and sometimes they get none at all.  All of them share the same wireless/core/firewall which is prioritizing traffic, but why some get tagged with 1 tag and others get no tags is the problem I am having.  And since this is only deployed on our wireless I am looking at the APs as part of the problem.     But traffic that is tagged is being influenced and given priority, I can see that.     ZOOM admin console: Packet capture from my home office, so the only influence here is ZOOM sending DSCP tags 56 and 40 to my client and vice versa so I know ZOOM can tag its traffic correctly on both windows and OSX.         What I don't fully understand is the correlation of ZOOM sending tags and Meraki honoring them if seen, adding them if not seen and or stripping them?         ... View more

Good point, so to be clear, we have ZOOM configured to push DSCP tags but our windows clients aren't honoring them along with some OSX clients in the office.   So to get around that we are trying to enforce them via Meraki as well as no bandwidth limits for traffic matching those DSCP markings.  But what does it matter if ZOOM is enforcing them and as well as Meraki? I mean if the tag is there no harm no foul, if it isn't then Meraki should apply it right?  ... View more

I am NOT specifying destination ZOOM CIDRs in the shaping rules in Meraki.  Are you saying don't specify 443/80 on the traffic shaping rules?  The only place I am specifying them on the firewall and I have to in order to be sure the FW is only prioritizing traffic to and from those specific IPs.     On my PAN FW We are matching ports/destination IPs and DSCP tags to prioritize traffic so what I am trying to accomplish is to ensure the tags we are prioritizing are being sent from ZOOM, honored/applied if not already by Meraki and then prioritized accordingly.  ... View more

Yeah man, we have done all that.  I am more focused on the Meraki side as to what is the best way to enforce/apply those tags on the AP/wireless side.   ... View more

Great thanks all! ... View more