cheers ... View more

I am sending the API calls via python script in pycharm ide on Windows 11. I can reach the site with no errors but when I run the scripts I get send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)'))) I am setting verify to false to get around it but Id like to fix it properly. I have tried downloading the cisco umbrella root CA from the dashboard site and import it into my trusted root cert authorities but it hasn't worked. ... View more

I'm having a problem appending the new rule list to the existing list :(| I think its because I have created the existing rule list as a dictionary. However if I try to re-write the dictionary as a list (with square brackets [] ) the code stops working. "Invalid syntax" import requests import security import json # Replace with your Meraki API key and network ID api_key = security.MERAKI_API_KEY organizationId = security.ORG_ID network_id = "xxxxxxxxxxxxxxxxx" url = f"https://api.meraki.com/api/v1/networks/ { network_id } /appliance/firewall/l3FirewallRules" headers = { 'X-Cisco-Meraki-API-Key' : api_key , 'Content-Type' : 'application/json' } response = requests.get(url , headers =headers , verify = False ) existingrules = response.json() print (response.status_code) print (response.text.encode( 'utf8' )) with open ( 'ExistingRules.json' , 'w' ) as json_file: json.dump(response.json() , json_file , indent = 4 ) newrule = '''{ "rules": [ { "comment": "Test RuleNEW.", "policy": "deny", "protocol": "any", "destPort": "any", "destCidr": "192.200.1.0/24", "srcPort": "Any", "srcCidr": "Any", "syslogEnabled": false } ] }''' existingrules.append(newrule) response = requests.put(url , headers =headers , json =existingrules , verify = False ) ... View more

regarding updating the rules and having to get a copy of existing rules and then adding those to the new update request - this is a little terrifying - what if it misses a rule or something, id have no way of checking 😕 I guess I could get it to export a json file after the get request as something I could look at to make sure its all ok right? ... View more

am I going to have to call the existing rules, then add them along with the new rule to the update call and basically re-write all the rules each time? ... View more

Thanks you! This put me on the right track. I changed  data =json.dumps(rule) to  data =rule , and then changed the rule paramater to this rule = '''{ "rules": [ { "comment": "Test Rule.", "policy": "allow", "protocol": "tcp", "destPort": "443", "destCidr": "192.168.1.0/24", "srcPort": "Any", "srcCidr": "Any", "syslogEnabled": false } ] }''' (slight syntax change) just my second issue now - this seems to overwrite all the existing rules rather than just add this to the list. how do I add things without deleting all the others?   ... View more

Yes, as mentioned, moments before i tried the PUT I did a successful GET ... View more

shouldn't the dashboard tell me if there are any required parameters? ... View more

huh - if I try to use the PUT operation from the dashboard - its gets a 404 there too   ... View more

If I run the exact same script as a GET - it works ok. I can also run the get from the dashboard.   I noticed I was using POST rather than PUT so made that change but if I do that I get a 400 error instead 😞 url = f"https://api.meraki.com/api/v1/networks/ { network_id } /appliance/firewall/l3FirewallRules" response = requests.put(url , headers =headers , data =json.dumps(rule) , verify = False ) ... View more

I think your link may be the out of date version 0 Version 1 https://developer.cisco.com/meraki/api-v1/#!update-network-appliance-firewall-l-3-firewall-rules ... View more

Hi, Thanks for the reply, but Im still getting a 404 error 😞 am I getting the url wrong or can something else cause this issue?   url = f"https://api.meraki.com/api/v1/networks/ { network_id } /l3FirewallRules" response = requests.post(url , headers =headers , data =json.dumps(rule) , verify = False ) ... View more

Sorry, one last question - how do you specify if its a source or destination port?   EDIT - nevermind, I see its destination only 😄 ... View more

thanks! ... View more

Thank you for the reply but I am getting a bit lost. I tried asking Meraki support but they have not been ,much help - how exactly do you port match in the traffic shaping rules? When choosing a custom expression the only term I have been able to find is "localhost" to specify a IP. Also - out of interest why do we not use PCP 7 which has the highest priority? Thanks! ... View more

sorry, just one more follow up question.... it looks like you have put your key and org id in a module called "os"? Where do you put modules you make like this? I am trying to use PyCharm but I'm a bit lost with the interface and where things should go, esp if they are modules I want to call in scripts. ... View more

It's not just CS5.... Cisco tagging  Fuze Tagging   also - I just found this; https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Wireless_QoS_and_Fast_Lane " Default Upstream QoS Meraki Access Points honor all upstream QoS sent by the client. Clients have defaults for WMM AC and the DiffServ value for different traffic classes. Please refer to vendor documentation for more details on QoS specifics for traffic sent by the client. The DiffServ field within Ethernet traffic sent from the client will be maintained when the AP forwards it onto the Ethernet network.  If the AP receives traffic with no QoS markings from the client, it will apply DSCP markings according to configured traffic shaping rules before forwarding the traffic onto the Ethernet network. " Does this mean, that assuming Fuze is tagging according to their table, that there is nothing I need to do for the upstream? I assuming that traffic being tagged isnt enough, I at least need a rule to tell Cisco to prioritise the tag right? So would making a rule "all voip and video conferencing" with a PCP of 7 do the job? ... View more

Hello again. We are indeed having issues, one way audio, crackling, delay, audio speeding up and slowing down, audio cutting out - all of it is intermittent, people can go a while without any issues at all. Fuze support have said the application definitely tags the traffic it sends as per the table, so upstream packets arriving at the MR should be tagged. I need to add rules to make sure that traffic is prioritised. Since Fuze is unknown to Meraki I will have to do it based on source port but I dont know how to make the custom expression. On the MX units I will put the same rules on based on destination port to tag the downstream. One other thing that worries me is that Fuze are adamant that their table is correct (proven) but their CS values dont seem to match merakis - for example Fuze say signalling is CS5 and meraki say CS5 is broadcast video. When I make the rules do you think I should stick to Fuzes's version? presumably if that's how they are tagging stuff then it doesnt matter if its wrong so long as my rules match? ... View more

thanks for the reply. We have MX units at the gateway. Do these automatically tag all application traffic? (we seem to just have the default rules enabled). How can I tell if NBAR is recognizing/tagging it correctly? Do I have to capture and inspect the packets with wireshark or is there an easier way in the dashboard? If I have to add custom definitions based on ports - how do I specify a source or destination one? destport /srcport     ? Presumably Id specify destination on downstream at the MX and source on upstream at the AP? Thanks! ... View more

anyone? ... View more

has anyone else come across this before? ... View more

I set the channels but in the settings they are showing the 20mhz channel I set 60 and 100 expecting 62 and 102 😞 and even more weirdly - when I run a wifi scanner I can see the BSSID of these AP's are actually 80Mhz wide!   ... View more

ah ok thanks! how very unintuitive lol ... View more