Questions[meraki](server)

I am trying to set up a Meraki Mesh network(Mesh1) at a small remote office. I have 1 MX65W and 3 MR36's, 1 acting as the gateway and the other 2 as repeaters. The SSID I'm broadcasting is set to operate in bridge mode, and it's connected to a VLAN that is connected to a VPN tunnel back to the main office network(Corp1). From my laptop on Corp1, I can ping devices that are connected directly to the MX65 via a wired connection, and I can ping devices that are connected wirelessly to the Gateway AP. However, I can't ping devices that are connected to either of the 2 repeaters.

The 3 AP's appear to have Meshed successfully and devices connected to the repeaters can still access the internet and are getting IP's in the correct subnet, they just can't seem to communicate with anything on Corp1. Is there some kind of security setting I'm missing? How do I get the repeaters to communicate with the corporate network like the Gateway is already doing?

I am trying to automate a weekly process where I download a CSV copy from the Client page on the Meraki website.

Before I lose you I am aware there is an API and it works very well. However there in a device attribute that is not exposed in the API. I got this from their support:

At this point, the "Owner" field is not accessible through the API, and it is currently in development.

I need the Owner as that is how I associate devices to people in our organization.

Using PowerShell I am able to successfully log into the website and get a 200 response for a basic page. My problem comes when I try to use the same session to get to the data I want I keep getting a page with just breadcrumbs and no actual data.

# Browse the Meraki website
$response = Invoke-WebRequest -Uri "https://n116.meraki.com/login/dashboard_login" -SessionVariable meraki

# Form Credentials
$formFields = @{
    email = "my address"
    password = "my password"
}

# Authenticate to the site
Invoke-WebRequest -Uri $response.Forms.Action -WebSession $meraki -Body $formFields -Method Post
# Get the client list
Invoke-WebRequest -Uri "https://n116.meraki.com/my-company/n/_-tSGb0b/manage/pcc/list" -WebSession $meraki -Method Get

Worst case is I am hoping to get the parsedHtml of the Client List table so I can work with its contents. I can't seem to get any useful data no matter what page. I am not sure if the issue is working with Meraki or my PowerShell approach. I have only done simple scraping up until this point.

I realize this is a very specific request but I am curious to know if someone that has Meraki is able or has been able to get this information using these means.

I have one really odd project to pull out. I am replacing entire infrastructure on one of our customers. They requirements are quite easy until they decided to put something else. 3 WAN addresses that are assigned like this: 1x WAN for plain internet connection which is distributed via HP E-MSM720 controller and HP MSM460 access points (default VLAN and VSC), now the fun part. 2x WAN to be assigned for one server inside clients network VLAN 6 subnet 192.168.x.x/23. This is also quite simple to pull. What I am having trouble, most likely because I have never played with HP controllers, is to set additional VSC with VLAN 6 and stream content from that server via Wireless. Now I must assume that on Meraki switch I need 2 ports as assign VLAN 6 on them (untagged). On Controller same thing. I need configure new VLAN 6 using "Network"->"Network Profiles", and under "Network"-> "VLANs" select new created profile and assign port as untagged. Since from some strange reason I cannot use "Automated Workflow" as I am getting an error, I need to create new VSC and bind it with that VLAN/Network profile that I would like to create. Creating profile should be easy by selecting "Controller"->"VSCs"-> "Add New VSC Profile". There I would set all the parameters such as SSID, Authentication, broadcasting, hiding SSID, etc, etc.

Can somebody confirm if the binding of VSC with new VLAN 6 using "VSC bindings" interfere with default VSC or disrupt current wireless link which is already configured? Manual procedure that I would use would be: - Select new "Controller"->"VSC"->"VSC Bindings" -> "Add New Binding"-> Check option "Egress Network - Network Profile: VLAN 6" and Save.

Will this in any way drop connection for current default VSC which uses default VLAN?

Also one additional question which I don't know if anyone knows, and I definitely need clarification:

If the VLAN is going to be set as IGMP (multicast), how can you set VSC to support IGMP? There is an option of IGMP proxy but is related to an interface. I assume that this interface that is facing switches/access points, if configured with IGMP proxy, might disrupt wireless internet connection for default VSC and default VLAN correct? (normal internet connection is unicast, while video stream is using multicast)...

Please refer from the schematic below, how it should look like. Clients network schematic

I have a virtual appliance running Ubuntu 14 that I would like to connect to a remote network via Meraki Client VPN.

I have found instructions for installing and configuring strongswan and xl2tpd on Ubuntu 16 which get me most of the way there, but after establishing the VPN I cannot seem to establish a route.

The goal is allow traffic from this single Ubuntu VM to a subnet on the remote LAN via the VPN.

(Ubuntu 192.168.5.99/32) =VPN> (Meraki appliance 20.20.20.20) => (Subnet 192.168.1.0/24)

https://gist.github.com/psanford/42c550a1a6ad3cb70b13e4aaa94ddb1c http://www.jasonernst.com/2016/06/21/l2tp-ipsec-vpn-on-ubuntu-16-04/

/etc/ipsec.conf:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
        # strictcrlpolicy=yes
        # uniqueids = no

# Add connections here.

# Sample VPN connections

conn %default
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev1
        authby=secret
        ike=aes128-sha1-modp1024,3des-sha1-modp1024!
        esp=aes128-sha1-modp1024,3des-sha1-modp1024!

conn meraki-vpn
     keyexchange=ikev1
     left=%defaultroute
     auto=add
     authby=secret
     type=transport
     leftprotoport=17/1701
     rightprotoport=17/1701
     # set this to the ip address of your meraki vpn
     right=20.20.20.20

/etc/xl2tpd/xl2tpd.conf :

[lac meraki]
lns = 20.20.20.20
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

I can bring up the VPN:

root@zzz:~# ipsec up meraki-vpn
...
connection 'meraki-vpn' established successfully

Login:

echo "c meraki [email protected] mypassword" > /var/run/xl2tpd/l2tp-control

But I cannot get a route setup. Attempting to follow the magic recipes result errors. I can't figure if this is some xl2tpd config problem, or if I just can't figure the correct syntax to add the route. Any insight would be appreciated.

root@zzz:~# ip route add 192.168.1.0/24 dev ppp0
Cannot find device "ppp0"

ipsec statusall :

Status of IKE charon daemon (strongSwan 5.1.2, Linux 4.2.0-42-generic, x86_64):
  uptime: 20 hours, since Oct 19 19:30:38 2016
  malloc: sbrk 2433024, mmap 0, used 352240, free 2080784
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4
  loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 rdrand random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default stroke updown eap-identity addrblock
Listening IP addresses:
  192.168.5.99
Connections:
  meraki-vpn:  %any...20.20.20.20  IKEv1
  meraki-vpn:   local:  [192.168.5.99] uses pre-shared key authentication
  meraki-vpn:   remote: [20.20.20.20] uses pre-shared key authentication
  meraki-vpn:   child:  dynamic[udp/l2f] === dynamic[udp/l2f] TRANSPORT
Security Associations (1 up, 0 connecting):
  meraki-vpn[4]: ESTABLISHED 8 minutes ago, 192.168.5.99[192.168.5.99]...20.20.20.20[20.20.20.20]
  meraki-vpn[4]: IKEv1 SPIs: 2121ded4dc4dc94e_i* 3d5d1cc8bf935f19_r, pre-shared key reauthentication in 48 minutes
  meraki-vpn[4]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
  meraki-vpn{5}:  INSTALLED, TRANSPORT, ESP in UDP SPIs: c330d0b3_i 06749ffa_o
  meraki-vpn{5}:  3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 8 minutes
  meraki-vpn{5}:   192.168.5.99/32[udp/l2f] === 20.20.20.20/32[udp/l2f]

ifconfig :

eth0      Link encap:Ethernet  HWaddr 00:0c:29:5f:9c:73  
          inet addr:192.168.5.99  Bcast:192.168.5.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe5f:9c73/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:459939 errors:0 dropped:0 overruns:0 frame:0
          TX packets:362145 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:78969068 (78.9 MB)  TX bytes:52179997 (52.1 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:427152 errors:0 dropped:0 overruns:0 frame:0
          TX packets:427152 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:25278435 (25.2 MB)  TX bytes:25278435 (25.2 MB) 

Thanks!

we have multiple locations with Meraki Firewalls that are using the Meraki Site-to-site VPN connection in a Hub configuration.

We would like to add our VPC to our Site-to-Site VPN so that if any location goes down, other branches will have a connection. I'm not sure what the best way to do this. It appears that we'd need a literal VPN connection to each and every location, which I assume would be $0.05/hr/connection... That would be extremely cost prohibitive.

I was able to get the location I'm at to connect to the VPC with no issues, however, other branches were not able to ping our EC2 server nor were they (obviously) connecting to the VPN directly.

What are your thoughts? What would be the best method for bringing our VPC to all of our branches?