How to Configure Meraki Device Reporting via Syslog, SNMP, and API

Add the syslog server 

1. Go to Network-Wide > Configure > General. 

2. Locate the Reporting section, which contains the Syslog server configuration. 

3. Select Add a syslog server to define a new server. 

4. Configure the IP address of your syslog server, the UDP port the server listens on, and the roles you want reported to the server.

Enable firewall rule logging (optional) 

If you enable the Appliance Flows role for Meraki MX reporting, you can enable or disable logging for individual firewall rules. 

1. Go to Security & SD-WAN > Configure > Firewall. 

2. Set logging under the Logging column. 

Generate a Dashboard API key 

The Cisco Meraki Dashboard API is enabled by default on all organizations. The API key associates with the dashboard administrator account that generates it and inherits that account's permissions. You can generate, revoke, and regenerate your API key on your profile. 

1. Select the avatar icon in the top right-hand corner of the dashboard, then open the My Profile page. 

2. Select Generate new API key. A window displays your unique API key.

3. Record the API key immediately. Once this window closes, you cannot view the full key on the Meraki dashboard again. 

4. After copying the key, select the I have stored my new API key checkbox. 

5. Select Done.

The page refreshes. Under the API access section, only the last 4 digits of the key display for security. 

API endpoints for device and network reporting 

The following endpoints support device and network reporting: 

API Endpoint	API Call	Description
Client Security Events	Get Network Appliance Client Security Events	Gathers data on all security events for a specified dashboard network
Clients	Get Device Clients	Gathers data on all client devices connected to specific Meraki device, up to a maximum of one month
Devices	Get Network Device Loss and Latency History	Displays data on uplink loss percentage and latency (in milliseconds) for Meraki security appliance
Devices	Get Network Device Performance	Returns the performance score for a specified device.  (Only MX security appliances are supported for this API call at this time)
Devices	Get Network Device Uplink	Returns the current uplink information of a specified device.
Devices	Get Network Devices	Lists all devices in the specified network
MV Sense	Get Device Camera Analytics Live	Returns live state form camera of analytics zones configured
MV Sense	Get Device Camera Analytics Overview	Returns overview of aggregate analytics data for timespan specified
MV Sense	Get Device Camera Analytics Recent	Returns the most recent record for analytics zones configured
MV Sense	Get Device Camera Analytics Zone History	Returns historical records for analytic zones configured
MV Sense	Get Device Camera Analytics Zones	Returns all configured analytic zones for specified camera
Networks	Get Network Air Marshal	Lists the Air Marshal scan results for the specified network
Networks	Get Network Traffic	Gathers traffic analysis data for the specified network
Organizations	Get Organization Device Statuses	Lists the current status is every Meraki device in the specified Organization
Organizations	Get Organization License State	Returns the license state for the specified Organization
Organizations	Get Organization Uplinks Loss and Latency	Returns the uplink loss and latency measurements for every MX in the Organization. (From 2 - 7 minutes ago)
Splash Login Attempts	Get Network Splash Login Attempts	Lists the number of login attempts for a splashpage on the specified network
Wireless Health	Get Network Clients Connection Stats	Gathers aggregated connectivity information for wireless clients in the specified network
Wireless Health	Get Network Clients Latency Stats	Gathers aggregated wireless latency for clients on the specified network
Wireless Health	Get Network Connection Stats	Gathers aggregated connectivity data for the specified network
Wireless Health	Get Network Devices Connection Status	Lists client connectivity data on a per-AP basis for the specified network
Wireless Health	Get Network Devices Latency Stats	Lists the amount of wireless latency data on a per-AP basis for the specified network
Wireless Health	Get Network Failed Connections	Lists all failed client connection events on the specified network based on time frame given
Wireless Health	Get Network Latency Stats	Lists aggregated wireless latency information for the entirety of the specified network

To learn more about using API with the Meraki dashboard, please visit Cisco Meraki DevNet at https://developer.cisco.com/meraki/

Set up Webhooks on the dashboard 

1. Go to Network-Wide > Configure > Alerts. 

2. Locate the Webhooks section. 

3. Select Add an HTTP server and configure the server URLs. 

4. Specify the HTTP servers as recipients for dashboard alerts. 

For more information about setting up and using Webhooks, refer to Cisco Meraki Webhooks. 

SNMP device information 

You can poll the following information from the Meraki dashboard: 

• Device MAC address 
• Device serial number 
• Device name 
• Device status (online or offline) 
• Device last contacted—date and time 
• Mesh status (gateway or repeater) 
• Public IP address 
• Product code (for example, MR18-HW) 
• Product description (for example, Meraki Cloud-controller 802.11n AP) 
• Name of the network the device resides in (dashboard network) 
• Packets/bytes in/out on each physical interface 

Standard MIB support 

SNMP servers use a Management Information Base (MIB), a database of SNMP Object Identifiers (OIDs). OIDs identify the managed objects that inform the SNMP server which values to poll from the device. 

The Meraki dashboard and SNMP-capable Meraki devices support the following standard MIBs: 

• SNMPv2-MIB .1.3.6.1.2.1.1 
• IF-MIB .1.3.6.1.2.1 

Meraki proprietary MIB 

The Meraki dashboard has its own proprietary MIB that lets SNMP servers pull data and information from the dashboard. 

1. Go to Organization > Configure > Settings > SNMP to locate and download the MIB document. 

The Meraki Cloud MIB cannot poll information from Meraki devices directly, because it is designed strictly for dashboard information. 

Configure dashboard SNMP polling 

1. Go to Organization > Configure > Settings > SNMP. 

2. Choose an SNMP configuration option: SNMP Version 2C or Version 3. 

3. After you enable SNMP, send SNMP requests to the host defined directly under the enable setting. The community string and a sample command to extract information via SNMP requests display as well. 

Configure IP restrictions to restrict SNMP access to particular IP addresses in your environment when using v2c. SNMP versions 1 and 2 send the community string in clear text, so IP restrictions prevent unauthorized SNMP access if another party intercepts or learns the community string. IP restrictions are recommended for v3 but not required.

Configure local device SNMP polling 

You can poll individual Meraki devices locally. In this scenario, SNMP traffic stays within the local network, and each device is polled from the network management system. 

1. Go to Network-wide > Configure > General > SNMP. 

2. Configure the local SNMP settings. 

Enable SNMP traps 

1. Go to Network-Wide > Configure > Alerts. 

2. Locate the SNMP Traps section, which is set to Disabled. 

3. Enable SNMP Version 2c or Version 3. 

4. To use V3 (username/password), select Add an SNMP user. 

5. Input the desired username and password, which must also be configured on the SNMP server. 

6. Enter the Receiving server IP address, which must be a public IP address. 

7. Configure the receiving server ports with UDP port 161 or 162 (the default ports SNMP servers listen on). 

Define SNMP traps to be sent 

SNMP traps are closely tied to the alerts configured under Network-Wide > Configure > Alerts. To generate SNMP traps, configure SNMP as a recipient for the alert. You can: 

• Input SNMP as a default recipient so all enabled alerts generate a trap, or 
• Configure SNMP on a per-alert basis.

Once you enable and configure SNMP traps to send, enable and set up the alerts that trigger them. The following list maps each SNMP trap to its dashboard alert and alert category:

SNMP Trap Sent	Meraki Dashboard Alert	Alert Category
Settings Changed	Configuration settings are changed	Network-Wide
VPN Connectivity Change	A VPN connection comes up or goes down	Network-Wide
Foreign AP Detected	A rogue access point is detected	Network-Wide
Device Goes Down/Device Comes Online	A gateway goes offline	Wireless
Device Goes Down/Device Comes Online	A repeater goes offline	Wireless
Gateway to Repeater	A gateway becomes a repeater	Wireless
Device Goes Down/Device Comes Online	A WAN appliance goes offline	WAN Appliance
Uplink Status Changed	Primary uplink status changes	WAN Appliance
No DHCP leases	The DHCP lease pool is exhausted	WAN Appliance
IP Conflict	An IP conflict is detected	WAN Appliance
Cellular Network Up/Cellular Network Down	Cellular connection state changes	WAN Appliance
Rogue DHCP Server	A rogue DHCP is detected	WAN Appliance
Warm Spare Failover Detected	A warm spare failover occurs	WAN Appliance
Malware Blocked	Malware is blocked	WAN Appliance
Malware Detected	Malware is downloaded	WAN Appliance
Device Goes Down/Device Comes Online	A switch goes offline	Switch
New DHCP Server Alert	A new DHCP server is detected on the network	Switch
Port Disconnected/Port Connected	Any port goes down	Switch
Port Cable Error	Any port detects a cable error	Switch
Port Speed Change	Any port changes link speed	Switch
Power Supply Down/Power Supply Up	A power supply goes down	Switch
Redundant Power Supply Backup/Redundant Power Supply Back to Primary	A redundant power supply is powering a switch	Switch
UDLD Error	Unidirectional link detection (UDLD) errors exist on a port	Switch
Critical Temperature	A switch is operating at critical temperature	Switch
Device Goes Down/Device Comes Online	A camera goes offline	Camera
Device Goes Down/Device Comes Online	A cellular gateway goes offline	Cellular Gateway

Storage allocation 

Syslog messages can take up a large amount of disk space, especially when collecting flows. When choosing a host to run the syslog server, ensure enough storage space to hold the logs. Consult the syslog-ng man page for information on keeping logs for only a certain amount of time. 

Expected traffic flow 

Syslog traffic flows to the server in one of three scenarios, depending on the route type used to reach the server. 

Scenario 1 – Reachable via LAN: The MX sources traffic from the VLAN interface where the server resides if the syslog server is on the LAN of the MX. The transit VLAN interface is used if the device is only accessible via static route. 

Scenario 2 – Reachable via public interface: The MX sources traffic from the public interface (WAN) if the syslog server is accessible via the WAN link. 

Scenario 3 – Reachable via AutoVPN: The MX sources traffic from the interface of the highest VLAN participating in AutoVPN if the syslog server is accessible via AutoVPN. If the traffic passes through the site-to-site AutoVPN connection, the traffic is subject to the Site-to-site outbound firewall rules, so you may need an allow rule. 

To configure this allow rule: 

1. Go to Security & SD-WAN > Configure > Site-to-site VPN > Organization-wide settings. 

2. Select Add a rule.