Meraki MX ThousandEyes Configuration Guide

Firmware and Hardware

• Minimum Firmware: MX 18.104.
  • Recommended Firmware: MX 18.107.2 or higher is strongly recommended.
• MX Models: MX67, MX67W, MX67C, MX68, MX68W, MX68CW, MX75, MX85, MX95, MX105, MX250, MX450.
• MX in NAT Mode. Devices running in Concentrator mode are not supported
• Connectivity to the ThousandEyes Platform cloud infrastructure. For a full list of required ports and subnets please refer to the Firewall Configuration for Enterprise Agents document in ThousandEyes documentation.

Meraki Licensing

Coterm Licensing

• SD-WAN+ or,
• Per Network SD-WAN+ or,
• Advanced Security

The full feature mapping for your licensing tier can be seen below:

	Advanced Security-only	Advanced Security + MI	SDW+	Per Network SDW+
Agent Deployment	Yes	Yes	Yes	Yes
Test Templates	No	Yes	Yes	Yes
Free ThousandEyes Tests	No	No	Yes (Up to 50)	Yes (Up to 50)
Test Results Visualization	ThousandEyes	ThousandEyes	ThousandEyes	ThousandEyes

 

Subscription Licensing

• Essentials Tier: Not available.
• Advantage Tier: Same features as SDW+ licensing but no Free Tests available at this time.

For more information on Subscriptions licensing and the Meraki MX Appliance please refer to the Meraki MX Subscription Licensing document.

 

Per-Device Licensing

PDL (Per-Device Licensing) is not officially supported.

ThousandEyes Licensing

• Available Units in the ThousandEyes Account.

Changing the Configuration of Free Tests / Impact on ThousandEyes Units

Each Free Test (5-minute interval Web Server - HTTP tests) equals 22 monthly Thousandeyes Units. Under this offer, you may only receive a maximum of 1100 ThousandEyes Units per month per Cisco HQID, which is calculated as 50 Free Tests × 22 units per test. If you change the configuration of the Free Test(s) via the ThousandEyes platform, the Free Test(s) may consume more or less ThousandEyes Units, depending on your configuration.   Such changes will impact the number of Free Tests available to you, as the maximum of 1100 monthly ThousandEyes Units per Cisco HQID will still apply. However, you may increase the number of ThousandEyes Units through a separate purchase of more ThousandEyes Units.

Meraki and ThousandEyes Accounts

• Meraki Dashboard account:
  • At least two Full-Org admins are needed in the Meraki Dashboard.
  • SSO/SAML is not supported for account linkage or agent onboarding.
• ThousandEyes account:
  • At least the Account Admin role privilege.
  • A New ThousandEyes account can be created as part of a Free Trial option via the Meraki Dashboard.

The ThousandEyes Integration is currently supported in the following regions:

• North America
• Europe, Middle East and Africa
• Asia Pacific and Japan

Since Meraki and ThousandEyes are not all available in the same regions, the following account linkage restrictions are enforced:

Meraki Region	ThousandEyes Region
North America	North America
Europe, Middle East and Africa	Europe, Middle East and Africa
Asia Pacific and Japan	North America

This means that a Meraki Dashboard, located in North America, can only be linked with a ThousandEyes account hosted in North America.

ThousandEyes Enterprise Agent Routing Considerations

The routing behavior for the Enterprise Agent running on an MX Appliance is similar to other MX Services, such as our Syslog implementation. Details can be found below:

• The agent networking stack is internal to the MX Appliance and does not interfere with Data Plane traffic
• The Agent is assigned an internal 198.51.x.x IP address. This subnet cannot be modified.
• The Agent traffic strictly follows the MX routing table, meaning no local breakout support exists.
• If the destination to monitor is across an AutoVPN tunnel, the source IP will be the IP address of the highest allowed VLAN in the tunnel.
• For route overlaps, it uses the MX Route Priority

For Advanced Security Licensing

Step 1: Select the “Active Application Monitoring” page under Meraki Insight. An educational page about the integration will be presented. The user clicks the Try it button to initiate the deployment. To view the onboarding video separately, please click here.

Step 2: Account linkage between Meraki and ThousandEyes

• Log in:
  • ThousandEyes log in with their existing account
  • Select the account group you want to deploy Agents at  from the drop-down menu

• Create a new account:
  • A ThousandEyes login window will allow users to create a new account using the email from their Dashboard account
  • This action will start a Free Trial

Depending on the options chosen, a different menu will be displayed. For Log in, we will request your ThousandEyes username and password. For creating an account, we will request creating a new password.

Step 3: Activate the Agents on the MX

This step will allow you to select the networks where the ThousandEyes monitoring will start. The networks shown comply with the minimum hardware and firmware requirements.

After choosing the desired Network(s), you can click Next. The next screen provides a Summary of the Network(s) to monitor.

Select Start Monitoring to complete the Onboarding process.

Step 4: Viewing the Agents List and Status

After completing the onboarding process, you will be redirected to the Monitored Networks page, where you can perform maintenance actions on the installed agents. This page lets you view the test results under the ThousandEyes Dashboard by clicking the View applications button.

Step 5: To configure tests, please access the ThousandEyes Dashboard by either accessing it directly from your browser or by clicking the View applications button on the Monitored Networks page.

For SDW+ Licensing Licensing

Step 1: Select the “Active Application Monitoring” page under Meraki Insight. An educational page about the integration will be presented. The user clicks the Get Started button to initiate the deployment. To view the onboarding video separately, please click here.

Step 2: Account linkage between Meraki and ThousandEyes

• Log in:
  • ThousandEyes log in with their existing account
  • Select the account group you want to deploy Agents at  from the drop-down menu

• Create a new account:
  • A ThousandEyes login window will allow users to create a new account using the email from their Dashboard account
  • This action will start a Free Trial

Depending on the options chosen, a different menu will be displayed. For Log in, we will request your ThousandEyes username and password. For creating an account, we will request creating a new password.

Step 3: Choose an Application to Monitor. A custom Application or continuing without one can also be selected.

This feature leverages Template Monitoring from ThousandEyes, which creates an Agent Web Server test for the selected application.

Step 4: Activate the Agents on the MX

This step will allow you to select the networks where the ThousandEyes monitoring will start. The networks shown comply with the minimum hardware and firmware requirements.

After choosing the desired Network(s), you can click Next. The next screen provides a Summary of the Network(s) to monitor.

Select Start Monitoring to complete the Onboarding process.

Step 5: If you are entitled to claim free tests,  a popup window will appear asking you to get them now or at a later date. For more information on the Free Test offer, please refer to the Free Test section in this document.

Step 6: Viewing the Results

After completing the onboarding process, you will be redirected to the Monitored Networks page, where you can perform maintenance actions on the installed agents. This page also lets you view the test results under the ThousandEyes Dashboard by clicking the View applications button.

Demo

Free Test Claim Information

The number of free ThousandEyes 5-minute interval Web Server - HTTP Tests (referred to as the “Free Tests” in this document) available to claim on the Meraki Dashboard depends on several factors associated with your organization’s licensing model. (See the ThousandEyes Product Description for the terms and conditions applicable to the use of the ThousandEyes platform, including the Free Tests.) Please be aware that when you deploy a test via the Meraki Dashboard, this results in one ThousandEyes 5-minute interval Web Server - HTTP test being deployed.  The number of Free Tests that you are entitled to receive is calculated as follows:

1. If you have purchased an SD-WAN+ Licensing Entitlement, the number of Free Tests is calculated based on the number of supported licensed devices available on your licensing table. Each supported licensed Cisco Meraki MX device will entitle you to one Free Test.
2. If you have purchased a Per Network SD-WAN Licensing Entitlement, the number of Free Tests is calculated based on the number of claimed per network SDW licenses on the organization license table.  Each per network SDW license will entitle you to one Free Test.

In both licensing models, you may only receive a  maximum of 50 Free Tests  (the “Test Cap”).   Also, in both licensing models, the calculation will start after the most recent new licensing purchase or renewal.

The Free Tests may not be available to you based upon your cloud instance, geography or region - see the Restrictions section below.

Monitored Networks Table

After linking the account, the Monitored Networks table will be available in the Active Application Monitoring section under the Insight menu.

While in the Monitored Networks table, several actions can be performed under two different tabs:

Monitored Networks

• Removing a network: Removes the network from being monitored.
• Enabling/Disabling a network: Allows to pause or resume monitoring in the network.
• View applications button: Redirects the user to the ThousandEyes Dashboard for test results visualization.
• Add tests: Initiates the workflow to add a new test to new or existing networks.
• Applications > View: Allows to see which Applications are being monitored in the selected network

Settings

• Allow users to disconnect the current linked account.

 If the current user has not logged into their ThousandEyes account when accessing this page, the Meraki Dashboard will show a banner indicating the user to do so. Example below:

Topology 1: Direct Internet Access

                                   

Characteristics:

• Most common deployment
• Test templates provide excellent coverage for most needed Apps
• Routing is extremely simple as the default route points to the WAN

Topology 2: AutoVPN Split Tunnel

                           

Characteristics:

• Test templates provide flexibility for custom Application and No Application
• Routing to the Custom App server relies on the MX routing table
• DNS is tricky as the ThousandEyes agent uses the DNS servers from the MX WAN Interfaces
• Traffic to the Custom App server uses the overlay. We cannot provide underlay visibility
• Full ThousandEyes Path Visualization support for Applications over the AutoVPN tunnel is a work in progress

Topology 3: Full AutoVPN Tunnel

                     

Characteristics:

• Hub MX propagates a default (0.0.0.0/0) route to the Branch MX
• Routing to the Custom Public App server relies on the Hub MX routing table
• Since all the traffic from the branch MX goes over the AutoVPN tunnel (Overlay), we cannot provide underlay visibility
• Since all the traffic to provision and manage the agent goes over the Hub, firewall rules are needed to allow the traffic in the hub and its upstream infrastructure
• Full ThousandEyes Path Visualization support for Applications over the AutoVPN tunnel is a work in progress

Topology 4: Full AutoVPN Tunnel to Secure Connect, Umbrella, or any Internet Gateway

                    

Characteristics:

• The Umbrella/Secure Connect cloud propagates a default (0.0.0.0/0) route to the Branch MX
• Since all the traffic from the branch MX goes over the AutoVPN tunnel (Overlay), we cannot provide underlay visibility
• All the traffic to provision and manage the agent goes over to Umbrella
• Umbrella/SC needs firewall rules to allow agent traffic to the Internet.
• Traffic to the Meraki and ThousandEyes backend needs to be excluded from HTTPS Inspection
• Full ThousandEyes Path Visualization support for Applications over the AutoVPN tunnel is a work in progress
• The Meraki and ThousandEyes domains/endpoints to be allowed are:
  • meraki.com
  • registry.meraki-applications.com
  • ThousandEyes Platform traffic