yes - set to basic. I just changed it to detailed but not sure that will help? ... View more

so events seem to be flowing in now - however I don't seem to be receiving anything from the security appliance (all roles have been selected in syslog settings). I can see flows, urls, switch event log - but nothing from the appliance (specifically content filtering). I checked in meraki event log and can see that there are filter events all the time. Do I have to enable something like I did for the firewall rules? ... View more

im using their shiny new "next generation" version 🎉 which significantly simplifies the interface and config. Iv already gone through their documentation and made sure the default rule is enabled and all that jazz. ill try another logserver 😕   ta  ... View more

ah mint cheers. I saw someone mention that before and I looked and couldn't find the boxes. Must have been blind cos on second look there they are lol. ... View more

mmm i thought about that, but there really isnt much to configure. You just enable inbound UDP messages and tell it what port to listen to. And its clearly working to some extent as its received 113 messages - but only from 13 APs out of 80 😞 ... View more

I haven't used it but I assume because it returns data from the entire organization then you need org wide privilege. ... View more

so, just as a follow up in case anyone is following and interested - turns out the extra logic wasn't as much of a headache as I expected... using static routes as an example- Initialize an actions list Read the backup file and pull in the data Do a GET call to get current data Iterate through backup data and create a list of the route IDs also, for each iteration, take the id and look through the current route data to try and find a match if id doesn't exist in current config, append a create action to the action list elseif there is an id match - compare dictionaries to see if there are discrepancies. If yes, append update action to action list then do a iteration through current routes data. if current route id not in the list of ids we created in the backup data iterations - then append a destroy action. I think this covers all eventualities. Need to do a lot of testing but im quite hopeful 🙂 ... View more

I can think of at least 1 example where a network that was supposed to be removed was confused with one that was not. Devices were removed, network was deleted. Luckily it wasn't a very big site and someone had screenshots of the bits of config that got wiped. Network deletion is an extreme example but the point is, **** happens and we need an bullet proof response to any possible situation. If something happens to one of our production sites, we hemorrhage serious money every hour we don't get it back up and running. So I'll sleep better at night knowing I can click 3 buttons and fully restore any kind of config in seconds, even if I never need to use it. ... View more

what happens if someone accidentally deletes a switch, or a whole network?  Yea, thinking about it more i think a config comparison might be best. Ill compare and create an action depending on the differences ... View more

" I'd probably just make the decision that "my backup is the one backup to rule them all", and decide that whatever is configured on the dashboard will be overruled by my backup. It's a backup of a working system, afterall." yup - that is exactly what I want. I dont want to get into details about precise changes - I just want to completely replace all of what is there with what is in my backup file. Revert to a previous snapshot in time. comparing current config to the backup file in order to decide what to do is interesting, but I cant quite see how to use it. I think sticking witht eh wipe everything first idea is the way forward. I need to just identify which cases it will be a problem, like the routing interfaces where DHCP is enabled. Will just leave those out for now and focus on the low hanging fruit. I'm also going to have to figure out some process flow to try and avoid a situation where the wipe happens but then something stops the restore working and user is left with no config at all. *EDIT* Action batches are all or nothing arnt they? perhaps I could put the destroy and create actions in a single batch file to avoid that issue? ... View more

this hurts my head a bit....but what about if the script just tries a update operation first, and then if it recieves a certain error code, it then tried a create? ... View more

ah, didnt know that - thats going to be a headache 😛 ... View more

firewall rules are easier because it doesnt treat rules as individual items, its the rule table as a whole. So I just send the backed up list and it overwrites the existing table with the new one. To deal the with default rule, the script just removes that rule when its creating the backup, so its never written to the Json. ... View more

but if the code is just using a post request (well, a batch create to be precise) and the thing they are restoring already exists, it will fail.   The code kinda needs to know if it needs to do a post or a put. If it was going to be tailored for each and every item/interface etc then it would be very messy, both to code and to use i think. The idea is to just be able to quickly and easily revert to a previous state. The more I think about it, the more I think doing a wipe first is the only option - although its quite scary...what if the wipe operation works but the restore doesnt!!! 😥 ... View more

dont think you're missing anything - I can't find anything either. ... View more

I was thinking of that, but I only have one test computer and I'm worried if installing python does fix the issue, I then wont be able to revert it easily to its previous state to continue testing. At first (just in pycharm, before trying exe) my scripts were all using verify=f"{root_path}/Cisco Umbrella Root CA.crt"     which is a cert I got from the Meraki Dashboard I think? That worked for months until one day it stopped, so I went to the Dashboard again and found the cert was now DigiCert Global Root G2.crt - so I swapped it and it worked fine. DigiCert was the one I was using when I first tried to package into exe. When it didn't work I also tried Digicert TLS RSA etc etc. Then I tried just relying on Certifi - didnt work for the exe but I noticed my pycharm code was using it ok (didnt work a year ago when I first started coding) - so I have now changed the api calls in every script to just remove the verify bit.             script_path = sys.argv[0] root_path = os.path.dirname(os.path.abspath(script_path)) def get_network_names(): logging_config.log_function_start() retry_count = 3 timeout = 1 networks_url = f"https://api.meraki.com/api/v1/organizations/{org_id}/networks" for attempt in range(retry_count): try: networks = requests.get(networks_url, headers=headers, timeout=timeout) logging_config.log_API_CALL(f"GET 1: {networks_url} {networks}") time.sleep(DELAY) network_data = networks.json() print(network_data) if networks.status_code not in [200, 201]: logging_config.log_info(f"Error! HTTP status code: {networks.status_code}, Response text: {networks.text}") messagebox.showerror("Error", (f"Error! HTTP status code: {networks.status_code}, Response text: {networks.text}")) return [] # Return an empty list to indicate failure for network in networks.json(): network_name_to_id[network["name"].lower()] = network["id"] network_names = sorted([network["name"].lower() for network in networks.json()]) break except requests.exceptions.Timeout: logging_config.log_exception(f"Request timed out. Retrying... Attempt {attempt + 1}/{retry_count}") time.sleep(DELAY) except requests.exceptions.HTTPError as e: logging_config.log_exception(f"HTTP Error occurred: {e}") messagebox.showerror("Error", str(e)) return [] except requests.exceptions.RequestException as e: logging_config.log_exception(f"Request Exception occurred: {e}") messagebox.showerror("Error", str(e)) return [] except Exception as e: logging_config.log_exception(f"Unhandled Exception occurred: {e}") messagebox.showerror("Error", str(e)) return [] logging_config.log_function_finish() return network_names, network_name_to_id, network_data ... View more

I'm not sure what endpoint that is (with the mac address in it), but have you tried this one? /devices/{serial}/clients the serial is the serial of the AP you are interested in. Get Device Clients - Meraki Dashboard API v1 - Cisco Meraki Developer Hub ... View more

Not sure how you would get the "critical" status. You would somehow need to define what critical etc is, which would require getting a lsit of all available firmware and then comparing your devices firmware and deciding how many out of date is which category. Get org devices will give you all your devices and firmware in one easy call. Get Organization Devices - Meraki Dashboard API v1 - Cisco Meraki Developer Hub Not sure where to get the info about available firmware tho 😕 ... View more

Hi,   iv never done that before, would have to find out how to do it. But I'm struggling to understand what the actual issue is. Its not like the code cant find the certificate because if i remove the cert it changes error and complains about cant find cert. And its not like the code somehow isn't handling the SSL ok because it works on my own computer. The only significant difference between the laptop that works and all the others that dont, is that I have python installed - so maybe its something to do with how auto-py-to-exe is packaging the exe? But then when i change the code to verify=False, it works ok - so if it is a packaging issue it must be something to do specifically with the SSL module? ... View more

sry, yes its outbound firewall rules. I want to block anything from 192.168.0.0/24   172.16.0.0/16    10.0.0.0/8 going to a particular VLAN. I have those 3 private ranges in a Group.  All our sites use 1 or more of those private ranges. I just want to have the same rule on every site. The rule works fine on most sites, but I dont know why. One example of a working site has 2 VLANs configured using ips in the 10.0 range, but none of the others. It does also advertise a static route in the 172 range. But it doesnt have anything 192 whatsoever - yet it let me create the rule using the private address Group we made that contains all three private subnets. If it was behaving consistently, I would expect it to not allow the rule because of the 192 subnet in the group that is set as the source. ... View more

sorry, dont quite understand. If im creating a rule to block all traffic FROM all private address ranges, TO vlan subnet - how does that work? ... View more