Meraki

kmcgaugh · ‎Aug 9 2024

Aug 9, 2024 Posting this here for anyone who is studying post-2022 when the Cisco Meraki dashboard went through significant changes. The correct answer would be c. The navigation path has updated. Network-wide > configure > group policies - this menu will allow you to create a systems manager sentry policy. See documentation: https://documentation.meraki.com/SM/Other_Topics/Configuring_Sentry_Policies

kmcgaugh · ‎Aug 8 2024

Hey guys, I am running into some problems this morning with trying to get my python scripts working. Any functions or API calls I try to make to the Cisco Meraki API seem to be timing out. Is anyone else experiencing this problem? Anyone know of a workaround? I am trying to automate switch configurations this morning. 2024-08-08 09:03:28 meraki: INFO > GET https://api.meraki.com/api/v1/organizations 2024-08-08 09:03:58 meraki: WARNING > organizations, getOrganizations - HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by NameResolutionError("<urllib3.connection.HTTPSConnection object at 0x1033e4080>: Failed to resolve 'api.meraki.com' ([Errno 8] nodename nor servname provided, or not known)")), retrying in 1 second Traceback (most recent call last): File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connection.py", line 196, in _new_conn sock = connection.create_connection( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/util/connection.py", line 60, in create_connection for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/socket.py", line 976, in getaddrinfo for res in _socket.getaddrinfo(host, port, family, type, proto, flags): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ socket.gaierror: [Errno 8] nodename nor servname provided, or not known The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connectionpool.py", line 789, in urlopen response = self._make_request( ^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connectionpool.py", line 490, in _make_request raise new_e File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connectionpool.py", line 466, in _make_request self._validate_conn(conn) File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connectionpool.py", line 1095, in _validate_conn conn.connect() File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connection.py", line 615, in connect self.sock = sock = self._new_conn() ^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connection.py", line 203, in _new_conn raise NameResolutionError(self.host, self, e) from e urllib3.exceptions.NameResolutionError: <urllib3.connection.HTTPSConnection object at 0x1033e4080>: Failed to resolve 'api.meraki.com' ([Errno 8] nodename nor servname provided, or not known) The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/requests/adapters.py", line 667, in send resp = conn.urlopen( ^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/connectionpool.py", line 843, in urlopen retries = retries.increment( ^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/urllib3/util/retry.py", line 519, in increment raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by NameResolutionError("<urllib3.connection.HTTPSConnection object at 0x1033e4080>: Failed to resolve 'api.meraki.com' ([Errno 8] nodename nor servname provided, or not known)")) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/meraki/rest_session.py", line 183, in request response = self._req_session.request(method, abs_url, allow_redirects=False, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/requests/sessions.py", line 589, in request resp = self.send(prep, **send_kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/requests/sessions.py", line 703, in send r = adapter.send(request, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/requests/adapters.py", line 700, in send raise ConnectionError(e, request=request) requests.exceptions.ConnectionError: HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by NameResolutionError("<urllib3.connection.HTTPSConnection object at 0x1033e4080>: Failed to resolve 'api.meraki.com' ([Errno 8] nodename nor servname provided, or not known)")) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/Users/kalebmohr/Work/BHC/cisco.py", line 9, in <module> response = dashboard.organizations.getOrganizations() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/meraki/api/organizations.py", line 34, in getOrganizations return self._session.get_pages(metadata, resource, params, total_pages, direction) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/meraki/rest_session.py", line 402, in _get_pages_legacy response = self.request(metadata, 'GET', url, params=params) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/kalebmohr/Work/.venv/lib/python3.12/site-packages/meraki/rest_session.py", line 197, in request raise APIError(metadata, APIResponseError(e.__class__.__name__, 503, str(e))) meraki.exceptions.APIError: organizations, getOrganizations - 503 HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by NameResolutionError("<urllib3.connection.HTTPSConnection object at 0x1033e4080>: Failed to resolve 'api.meraki.com' ([Errno 8] nodename nor servname provided, or not known)")), {'error': 'HTTPSConnectionPool(host=\'api.meraki.com\', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by NameResolutionError("<urllib3.connection.HTTPSConnection object at 0x1033e4080>: Failed to resolve \'api.meraki.com\' ([Errno 8] nodename nor servname provided, or not known)"))', 'status_code': 503} Notice above I am getting tons of 503 errors, which is the HTTP code for service unavailable... Is anyone else having issues? Thanks, Kaleb

kmcgaugh · ‎Jul 23 2024

What are you trying to set up? It ultimately depends. If you need to carry multiple SSIDs with different VLAN tags, then yes, the port on the switch needs to be configured as a trunk. If not, then you can set it to access and the AP should get a DHCP address automatically. Confirm that there is nothing wrong with the DHCP server, the switch port is enabled, assigned to the VLAN you want the AP to be on (preferably management VLAN which should be the native VLAN if its a trunk), and ensure DHCP traffic can pass through that VLAN.

kmcgaugh · ‎Jul 23 2024

Did you claim the device to your dashboard? You need to do so by going to Organization > Inventory > Claim and enter the serial number of both devices. Once that is done, add them to the networks you want.

kmcgaugh · ‎Jul 23 2024

@Sebast Contact Cisco Meraki technical support. You may have defective devices that need RMA. Have them diagnose the issue with you further and they'll determine what the next steps are.

kmcgaugh · ‎Jul 23 2024

If you want to pass multiple VLANs through your Cisco Meraki MR36, then you should configure the port its connected to as a trunk and allow the specified VLANs you want tagged on the trunk. The MR36 should use the native VLAN for IP connectivity. Make sure you have configured the native VLAN on your trunk to be what you plan your MR36 to sit on. Make sure that native VLAN is configured upstream on the network and your management VLAN is assigned that VLAN ID.

kmcgaugh · ‎Jul 23 2024

Thank you so much! This will definitely help. I knew that Cisco has a hardware selector, but I never knew that Cisco Meraki did. I will use this to narrow it down for the future.

kmcgaugh · ‎Jul 22 2024

Hey all, I am brainstorming right now and thought I'd post here to get others ideas. I'm scoping a switch replacement project for a big multi-building campus. Most of the network is all Cisco Meraki switches and access points, but there is one last switch stack that I am trying to replace on campus with a Cisco Meraki switch stack. Currently, both are Cisco Catalyst WS-C3750G-12S-S. This switch stack is acting as a fiber distribution for 5 MS220-8Ps and 1 MS220-24P. I'm thinking if it's 2 12 port fiber switches stack together, then it makes sense to go with an MS425-32. What do you guys think? I look forward to hearing y'alls recommendations. Thanks!

kmcgaugh · ‎Jul 16 2024

This is caused by your MR and MS appliances being unable to resolve domain names over the configured DNS servers. Try setting DNS to a public IP such as 1.1.1.1 or 8.8.4.4.

kmcgaugh · ‎Jul 15 2024

Custom network firewall and traffic shaping rules are not merged with global firewall rules and are stateless firewall rules that apply on a per-VLAN basis. What ever VLAN is assigned the group policy, it will be enforced with the custom firewall rules you define in your group policy.

kmcgaugh · ‎Jul 15 2024

@PhilipDAth Good to see you around! Thanks for the response. Switch is configured to be in the stack/is a member of the stack, so I'll assume no issues. Thanks! 🙂

kmcgaugh · ‎Jul 15 2024

There is a way to see the login credentials for the local status page of all Cisco Meraki appliances from your dashboard network settings. Go to Network-wide > Configure > General and you will locate the local device status page configuration section. Now, you could remotely access them with a jumpbox. Some of my customer sites have Windows and Linux NUCs and Raspberry Pi boxes that I can use as jumpbox machines. I have been successful at remotely accessing the local status pages by having a jumpbox connected to the appliance in question, then going to the web browser and typing in http://switch.meraki.com or http://ap.meraki.com. and it successfully give me access; however, this is only dependent upon if the jumpbox is connected to the appliance you want to access. If it's not, then it will only resolve the local status page to the device it is directly connected to.

kmcgaugh · ‎Jul 15 2024

@Adrian4 I have a trick for you, this has worked great for me personally, aside from this tool I have never used but seen which I'll recommend to you as I am personally gonna try it... When you mount a network switch, if you have something below the switch - take a long piece of foam; perhaps the foam that came in the box of your MS250, and cut it down to length. Put the foam in between the bottom of the switch and the next thing below it, and it will hold it up for you to free up your arm. Next, try this tool. It should help you with the pain of having to deal with cage nuts. I know, cage nuts are horrible, but I've seen some colleagues use this tool and its kept them from getting cuts and soars in their fingers. I am personally going to give it a try myself: Cage nut tool Good luck with the install!

kmcgaugh · ‎Jul 15 2024

Don't use the RackStuds. Despite it may hold the MS250's weight, for your best interests - you should use the mounting hardware that came with the switch. Plastic is fragile and can snap, shatter, or bend, and yes, plastic does weaken over time. Just stick to the cage nuts and mounting screws to avoid any issues with your install. Good luck.

kmcgaugh · ‎Jul 15 2024

Just to give a background. I have 4 MS350s in a stack. The last MS350 needs to be connected to the top of rack MS350. I just acquired a longer stacking cable that will reach from the last MS350 to the top MS350. All other switches in the stack are connected successfully. If I add this last switch in the bottom of the rack into the stack, will that cause the whole switch stack to reboot?

kmcgaugh · ‎Feb 27 2024

I have a billing team who I want to have notifications from my client's organizations when upcoming license expirations occur. I know that, by default, a notification is sent 30 days prior, to all administrators listed on the account. I want the billing team to be notified when a license is expiring in the next 30 days. Nothing else. Is there a way that I can add a custom email address such as billing@company.com to a network's alerts, but they're only notified of licensing issues? I don't want the email address to receive unnecessary noise.

kmcgaugh · ‎Feb 27 2024

Any Meraki device that is already claimed by another organization cannot be used unless the original organization unclaims it from their organization. You should contact the seller on eBay to see if they are the organization administrator and ask them to unclaim it from their organization. If they can't help you, then unfortunately, you're out of luck. My advice: do not buy Meraki appliances from eBay, and try to avoid buying refurbished MX, MR, and MS appliances if at all possible. If you decide to buy the hardware, check with the seller to ensure that the device is unclaimed.

kmcgaugh · ‎Feb 8 2024

Please disregard the post. I located where to find what I'm looking for. Early morning, still waking up, haha. To anyone who may be wondering: Organization > Monitor > Firmware upgrades

kmcgaugh · ‎Feb 8 2024

Hello, I received an alert from one of my organizations regarding IP conflict detection, and the provided MAC addresses in the alert are MAC addresses of access points and switches. I have already ruled out the IP conflict issue, but I see that, in my change log, somebody set an access point firmware and switch firmware upgrade window. I cannot tell if the firmware actually upgraded on the switches and access points, but the alert came in shortly after the specified window, so I believe there was some sort of system glitch during the firmware update process (if it even did happen). What I am trying to do is determine if the switches and access points actually updated their firmware. Is there a way to check to see if or when a devices' firmware was updated? Thanks for the help.

kmcgaugh · ‎Jan 20 2024

I understand that you can't access the Meraki MX appliance belonging to Toast, but have you considered the possibility that the ERX router and MX appliance are using the same WAN IP address? If so, there could be a conflicting connection. You would have to change the static WAN IP address of the ERX router to test this. It doesn't really make sense your ISP is telling you you don't have a limit to multiple public IP addresses - they will normally hand you a block (i.e. if you have multiple static IP addresses, you could get a /29 block), there will always be a limit. The biggest thing I would consider, given you don't have insight into the Toast Meraki MX appliance, is the possibility of a WAN IP conflict between the ERX router and the Meraki MX. If applicable, I would consider changing the ERX's WAN IP address to a different public IP in the range your ISP provided, and see if this makes a difference. Finally, you mention using a managed switch to eliminate "crosstalk" between the Meraki MX and the ERX device; a managed switch will not inherently do this unless you configure separate layer 2 VLANs for each switch port, and because this switch sits on the internet edge - that configuration will not suffice unless the ISP modem has an 802.1q trunk configuration on the other end of the connection and you can match what ever VLANs are allowed on its trunking interface. In some of my client environments, we have run the data network separate from the voice network, and I've used an unmanaged Cisco switch to split internet traffic between the Meraki MX, and a proprietary voice gateway, and we had no issues with crosstalk for the devices. The Meraki MX is a stateful firewall and will by default block all inbound traffic from the internet, so you shouldn't need to worry about crosstalk from your network to the Meraki Toast network. If you want to put a managed switch in to have visibility into the traffic, that is a great option; however, it is not a solution to preventing crosstalk between your network and the Meraki Toast network.

kmcgaugh · ‎Jan 18 2024

Hello @Karan_Meraki You just purchased this MX67? First off, are you using the LAN/patch cables that came shipped with the MX67? Or are you using one that you already had? Can you test that cable to ensure it is not an issue with the cable? Second off, the LED status of the MX67 will remain solid orange because it has no connection to the Meraki cloud. Since you state your ISP gave you a static IP, I assume your internet circuit does not have a DHCP failback, but you could try to connect your MX67 to the internet without the static IP, reboot it, and see if the status LED goes to rainbowing. Don't forget to license and register the MX67 to your Meraki dashboard. Finally, by default - out of the box, Meraki MX67s will handout DHCP upon plugging a device into its LAN port. You are getting an APIPA address because there is no associated link. Do you have link lights on your laptop's NIC when trying to connect the cable? If not, go back to testing the ethernet cable you're trying to use/try another cable first. If that fails, factory reset the device, and if that fails, try another laptop if you can or double check its NIC is enabled, and if it is, and you've exhausted everything else mentioned - I would contact Meraki support.

kmcgaugh · ‎Jan 18 2024

If you do not see the 2 roles 'IDS Alerts' and 'Security events' from your dashboard, then you cannot leverage them in the API as roles. I am able to use the Security events role in my syslog settings through the API across several branch locations for one of my clients, all which consist of combined networks (wireless/switch/security). It is unusual that 'Security events' is not a selectable role, so I would open a case with Meraki support to have them check out what could be going on; I am unsure on the 'IDS alerts' role as I've never seen that as an option in the dashboard, and in the current API library, I do not see that as a role option either.

kmcgaugh · ‎Jan 18 2024

Thank you! I look forward to being a part of the community!

kmcgaugh · ‎Jan 18 2024

Thanks! I am based out of Midlothian, Virginia, in the United States. 🙂

kmcgaugh · ‎Jan 18 2024

Hello, Meraki Community! My name is Kaleb Mohr, I am a Sr. Network Administrator, and I've been working with Cisco Meraki products for over a year now. I recently decided to engage in the Meraki community as I have developed a great interest for the platform! I have a passion for automation and have been using the Meraki Dashboard API to automate a lot of client configurations: from switching, to wireless, to security and access policies. All using Python! In the future I hope to obtain the Cisco Meraki Solutions Specialist certification. Finally, when I'm not doing work...I like nature and will go out and enjoy nature whenever I can. 🙂 Thank you for reading my introduction! I look forward to being involved in the Meraki community.

Meraki

Community

About kmcgaugh

kmcgaugh

Kaleb Mohr

Community Record

Badges

Re: ECMS Practice Question - Feb 19th

Issues with the Meraki API this morning (East US)?

Re: Meraki MR36

Re: Meraki Devices doesn't appear on Dashboard

Re: MX67 & MG21 several unknown reboot

Re: Multiple VLAN on Meraki 36

Re: Recommended switch replacement

Recommended switch replacement

Re: DNS is misconfigured AP-SW

Re: Group Policy / FW & Traffic Shaping

Re: Will MS350 switches reboot when stacking connection plugged in?

Re: Local Admin Credentials for MS250 Switches

Re: Using RackStuds

Re: Using RackStuds

Will MS350 switches reboot when stacking connection plugged in?

License Notification Question

Re: eBay purchase - already claimed. Any options?

Re: Check when a Meraki appliance updated firmware?

Check when a Meraki appliance updated firmware?

Re: Splitting ISP connection between basic router and managed meraki router

Re: MX 67 Ethernet light not working when connected with LAN for setup.mera...

Re: Valid Role options for syslog servers

Re: Hello, I am Kaleb!

Re: Hello, I am Kaleb!

Hello, I am Kaleb!

Re: Check when a Meraki appliance updated firmware?

Re: ECMS Practice Question - Feb 19th

Re: Splitting ISP connection between basic router and managed meraki router

Re: Recommended switch replacement

Re: Will MS350 switches reboot when stacking connection plugged in?

Re: Using RackStuds