Cloud Monitoring Detailed Device Configurations

System Services

Enable NETCONF.

netconf-yang

Enable LLDP for Dashboard Network Topology.
 

lldp run

Configure SSH v2 with publickey authentication for cloud authentication.

ip ssh version 2
ip ssh server algorithm authentication publickey password keyboard

Secure Cloud Access

Configure a Null static IP route for destination cloud IP address to prevent traffic that should be in the tunnel from falling back to default route when the tunnel is down.

ip route <cloud ip address> 255.255.255.255 Null 0

Create local authentication group for Dashboard device access for SSH CLI and NETCONF through the TLS tunnel.

aaa authentication login MERAKI local
aaa authorization exec MERAKI local

Create ACL for cloud ingress VTY access via SSH and allow only port 2222 for SSH.

ip access-list extended MERAKI_VTY_IN
10 permit tcp host <cloud ip address> any eq 2222
20 deny   tcp any any

Create ACL for cloud telemetry egress. Allow only port 2022 for SFTP to the cloud.

ip access-list extended MERAKI_VTY_OUT
10 permit tcp any host <cloud ip address> eq 2022
20 deny   tcp any any

Configure a SSH rotary for the Dashboard VTY lines to listen on port 2222 for Dashboard initiated SSH sessions.

ip ssh port 2222 rotary 50

Create 4 VTY lines dedicated to device access from Dashboard and enable SSH to those VTY lines. Use the ACL and AAA groups configured to secure Dashboard  connections.

line vty 32 35
 access-class MERAKI_VTY_IN in
 access-class MERAKI_VTY_OUT out
 authorization exec MERAKI
 login authentication MERAKI
 rotary 50
 transport input ssh
 exit

Local User for Cloud Access

Configure a local Meraki user with SSH Keys for SSH and NETCONF access from Dashboard over the encrypted TLS tunnel.

username meraki-user privilege 15 secret 9 < unique hashed secret password >

ip ssh pubkey-chain
 username meraki-user
  key-string <string>

TLS Tunnel

Import the Dashboard TLS tunnel endpoint certificate authority for SSL certificate verification.

crypto pki trustpoint MERAKI_TLSGW_CA
enrollment terminal
crypto pki authenticate MERAKI_TLSGW_CA

-----BEGIN CERTIFICATE-----
MIIEvjCCA6agAwIBAgIQBtjZBNVYQ0b2ii+nVCJ+xDANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0yMTA0MTQwMDAwMDBaFw0zMTA0MTMyMzU5NTlaME8xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxKTAnBgNVBAMTIERpZ2lDZXJ0IFRMUyBS
U0EgU0hBMjU2IDIwMjAgQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAwUuzZUdwvN1PWNvsnO3DZuUfMRNUrUpmRh8sCuxkB+Uu3Ny5CiDt3+PE0J6a
qXodgojlEVbbHp9YwlHnLDQNLtKS4VbL8Xlfs7uHyiUDe5pSQWYQYE9XE0nw6Ddn
g9/n00tnTCJRpt8OmRDtV1F0JuJ9x8piLhMbfyOIJVNvwTRYAIuE//i+p1hJInuW
raKImxW8oHzf6VGo1bDtN+I2tIJLYrVJmuzHZ9bjPvXj1hJeRPG/cUJ9WIQDgLGB
Afr5yjK7tI4nhyfFK3TUqNaX3sNk+crOU6JWvHgXjkkDKa77SU+kFbnO8lwZV21r
eacroicgE7XQPUDTITAHk+qZ9QIDAQABo4IBgjCCAX4wEgYDVR0TAQH/BAgwBgEB
/wIBADAdBgNVHQ4EFgQUt2ui6qiqhIx56rTaD5iyxZV2ufQwHwYDVR0jBBgwFoAU
A95QNVbRTLtm8KPiGxvDl7I90VUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQG
CCsGAQUFBwMBBggrBgEFBQcDAjB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGG
GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBABggrBgEFBQcwAoY0aHR0cDovL2Nh
Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNydDBCBgNV
HR8EOzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRH
bG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwCwYJYIZIAYb9bAIBMAcGBWeBDAEB
MAgGBmeBDAECATAIBgZngQwBAgIwCAYGZ4EMAQIDMA0GCSqGSIb3DQEBCwUAA4IB
AQCAMs5eC91uWg0Kr+HWhMvAjvqFcO3aXbMM9yt1QP6FCvrzMXi3cEsaiVi6gL3z
ax3pfs8LulicWdSQ0/1s/dCYbbdxglvPbQtaCdB73sRD2Cqk3p5BJl+7j5nL3a7h
qG+fh/50tx8bIKuxT8b1Z11dmzzp/2n3YWzW2fP9NsarA4h20ksudYbj/NhVfSbC
EXffPgK2fPOre3qGNm+499iTcc+G33Mw+nur7SpZyEKEOxEXGlLzyQ4UfaJbcme6
ce1XR2bFuAJKZTRei9AqPCCcUZlM51Ke92sRKw2Sfh3oius2FkOH6ipjv3U/697E
A7sKPPcw7+uvTPyLNhBzPvOk
-----END CERTIFICATE-----
quit
yes

View the certificate details of the TLS Root Certificate Authority here.

Configure a trustpoint for SSL verification of the Dashboard TLS tunnel endpoint.

crypto pki trustpoint MERAKI_TLSGW_CA
 enrollment url flash:// MERAKI_TLSGW_CA
 revocation-check none

Create a Loopback interface for the crypto TLS tunnel overlay connection.

interface Loopback1000
 description Meraki TLS Connection
 ip address <cloud assigned local device ip address> 255.255.255.255

Configure the TLS tunnel for Cloud Connectivity to Dashboard. Selecting the local source interface based on the current next-hop interface of the default route.

crypto tls-tunnel MERAKI-PRIMARY
 server url <cloud tls tunnel fully qualified DNS hostname> port 443
 overlay interface Loopback1000
 local-interface <source interface> priority 1
 pki trustpoint CISCO_IDEVID_SUDI sign
 pki trustpoint MERAKI_TLSGW_CA verify
 no shut
 exit

 

SNMP

Add Dashboard as an SNMP server to receive traps from the device.

snmp-server enable traps smart-license
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps config-ctid
snmp-server host <cloud ip address> version 2c public

Logging

Add Dashboard as a logging server.

logging host <cloud ip address>

Device Tracking

The device tracking policy is applied to all interfaces on the device to provide connected client data (MAC address, IP Address)

device-tracking policy MERAKI_POLICY
 security-level glean
 no protocol udp
 tracking enable

Netflow

Flow record, monitor, and exporter configurations are set on the device to enable traffic analytics. The flow monitor is applied to all interfaces.

flow record MERAKI_AVC_HTTP_SSL_IPV4
 match application name
 match connection client ipv4 address
 match connection server ipv4 address
 match connection server transport port
 match flow observation point
 match ipv4 protocol
 match ipv4 version
 collect application http host
 collect application ssl common-name
 collect connection client counter bytes network long
 collect connection client counter packets long
 collect connection initiator
 collect connection new-connections
 collect connection server counter bytes network long
 collect connection server counter packets long
 collect datalink mac source address input
 collect datalink mac source address output
 collect flow direction
 collect timestamp absolute first
 collect timestamp absolute last

flow record MERAKI_AVC_HTTP_SSL_IPV6
 match application name
 match connection client ipv6 address
 match connection server ipv6 address
 match connection server transport port
 match flow observation point
 match ipv6 protocol
 match ipv6 version
 collect application http host
 collect application ssl common-name
 collect connection client counter bytes network long
 collect connection client counter packets long
 collect connection initiator
 collect connection new-connections
 collect connection server counter bytes network long
 collect connection server counter packets long
 collect datalink mac source address input
 collect datalink mac source address output
 collect flow direction
 collect timestamp absolute first
 collect timestamp absolute last

flow exporter MERAKI_AVC
 destination local file-export default
 export-protocol ipfix
 option interface-table timeout 300
 option application-table
 option application-attributes

flow monitor MERAKI_AVC_IPV4
 exporter MERAKI_AVC
 cache timeout inactive 60
 cache timeout active 300
 cache entries 65536
 record MERAKI_AVC_HTTP_SSL_IPV4

flow monitor MERAKI_AVC_IPV6
 exporter MERAKI_AVC
 cache timeout inactive 60
 cache timeout active 300
 cache entries 65536
 record MERAKI_AVC_HTTP_SSL_IPV6

flow file-export default
 destination <cloud ip address> transport http dest-port 18088 upload-path api/ipfixfilecollector/path/post_file
 file max-size 10
 file max-count 2
 file max-create-interval 5

Interfaces

The device tacking policy and flow monitors are applied to all interfaces on the device.

interface Gx/x/x
 device-tracking attach-policy MERAKI_POLICY
 ip flow monitor MERAKI_AVC_IPV4 input
 ip flow monitor MERAKI_AVC_IPV4 output
 ipv6 flow monitor MERAKI_AVC_IPV6 input
 ipv6 flow monitor MERAKI_AVC_IPV6 output

interface PoXXX
 device-tracking attach-policy MERAKI_POLICY
 ip flow monitor MERAKI_AVC_IPV4 input
 ip flow monitor MERAKI_AVC_IPV4 output
 ipv6 flow monitor MERAKI_AVC_IPV6 input
 ipv6 flow monitor MERAKI_AVC_IPV6 output

 

Model Driven Telemetry

Telemetry subscriptions required to send data to Dashboard. For a full configuration of device telemetry Full Telemetry Configuration 

Telemetry subscription brief

ID Type State Filter type 
--------------------------------------------------------
1001 Configured Valid tdl-uri 
1002 Configured Valid transform-name 
1003 Configured Valid tdl-uri 
1004 Configured Valid nested-uri 
1007 Configured Valid tdl-uri 
1011 Configured Valid tdl-uri 
1012 Configured Valid tdl-uri 
1013 Configured Valid tdl-uri 
1014 Configured Valid tdl-uri 
1015 Configured Valid tdl-uri 
1016 Configured Valid tdl-uri 
1018 Configured Valid tdl-uri 
1020 Configured Valid tdl-uri 
1021 Configured Valid tdl-uri 
1024 Configured Valid tdl-uri 
1031 Configured Valid tdl-uri 
2002 Configured Valid transform-name