Meraki Systems Manager - anyone got it working?

[rpycroft]

Hi there,

 

We've been trying to get meraki systems manager working for managing our devices in and out of school. They seem to pick up fine when not on our network but in school they can't seem to check in properly. I've found the firewall settings here and set them appropriately on our firewall but still struggling to get through. I'm liaising with our LEA to make sure they're allowing it through but in the meantime I thought I'd just check whether anyone has it working correctly yet...?

 

Cheers

Richard

[glennda]

i have it working correctly - and it does work very well - that link you have posted is from your Portal so we are unable to see if however the correct outbound ports are.

 

Clients using Meraki Systems Manager initiate outbound management connections to the Meraki cloud using the following addresses and ports:

 

Mac/Windows

 

64.156.192.80, 64.156.192.81, 74.50.57.243, 74.50.57.93, *.amazon.com - TCP ports 80, 443, 993, 60000-61000

iOS

 

64.156.192.80, 74.50.57.93, 50.18.152.159 - TCP port 443

* - TCP ports 2195, 2196, 5223

 

Android

 

64.156.192.80, 74.50.57.93 - TCP port 443

* - TCP port 5228

[rpycroft]

D'oh, so it is. Thanks for the info. I have all those listed in my firewall - will check with LEA next just wanted to see if anyone had actually got it working correctly.

 

Do your windows clients show up right way? How does it know how to tie the installation to your account? Is the info all bundled in with the MSI that you download?

 

Cheers

Richard

[SovietRussia]

We had to get our LEA to open stuff their end before it works, but when it works - It is brilliant.

[glennda]

D'oh, so it is. Thanks for the info. I have all those listed in my firewall - will check with LEA next just wanted to see if anyone had actually got it working correctly.

 

Do your windows clients show up right way? How does it know how to tie the installation to your account? Is the info all bundled in with the MSI that you download?

 

Cheers

Richard

 

Yes it does - and I am 99% sure its that your LEA need to allow the ports outbound. Pretty much everybody who tries to use this in schools has the same issue.

 

IOS7 support is on its way shortly too.

[soveryapt]

Another thing to point out is if this is the PC System Manager you're talking about (as opposed to the iOS / Android thing) then it won't work via Proxys (as in it won't read proxy information from the PC, so will only try on a direct connection).

 

I've got this problem at this school too, as it's all proxy based stuff, I won't be able to get the Systems Manager to work properly here unless Meraki add in support for Proxy settings in the software itself.

[glennda]

I've got this problem at this school too, as it's all proxy based stuff, I won't be able to get the Systems Manager to work properly here unless Meraki add in support for Proxy settings in the software itself.

 

I'm sure if enough people make the wish in the bottom right corner they may well think about it!

[soveryapt]

I'm sure if enough people make the wish in the bottom right corner they may well think about it!

 

Which I already have, here's to hoping others do too!

[rpycroft]

Do you know if the iOS/Android version uses the system proxy if there's one set? Might explain why it's not working properly within school but does when people go home and use their home wifi...

 

Cheers

Richard

[soveryapt]

Do you know if the iOS/Android version uses the system proxy if there's one set? Might explain why it's not working properly within school but does when people go home and use their home wifi...

 

Cheers

Richard

 

It does, or it certainly picks up the proxy settings on our iPads and such. just adding a batch of ones that have been returned from around school at the moment actually, all through the schools proxy settings. iPads themselves sometimes struggle if you're trying to use automatic configuration (PAC files and what not) but direct proxy connection they work fine with.

[rpycroft]

Cool. Thanks for that. I'll try and get stuff talking to meraki's cloud properly through our LEA's proxy then. Thanks for all your help y'all.

[Edu-IT]

Ours doesn't work as its blocked at ISP level on their firewall. Can't remember the reason why it couldn't be unblocked. Might have to ask again.

[glennda]

Ours doesn't work as its blocked at ISP level on their firewall. Can't remember the reason why it couldn't be unblocked. Might have to ask again.

 

There shouldn't be a reason, apart from they don't want to do it. It is outbound traffic only nothing inbound.

[TechSupp]

May help some but it wont work wiothout setting the amazon server ip, details on this KB

 

https://webmail.education.doncaster.gov.uk/owa/redir.aspx?C=qpoQKowcDUuxZCi0cpHNneS7Vu-OidAItxlkpbmhSTtMo8A-PGG69ScbRQ9J_-qVjtVgTqFYDT0.&URL=https%3a%2f%2fkb.meraki.com%2fknowledge_base%2fdetermining-ip-address-ranges-needed-for-amazoncom-s3amazoncom

 

Just forwarded this through to out LA to see if they will set it for me. Fingers crossed.

[soveryapt]

May help some but it wont work wiothout setting the amazon server ip, details on this KB

 

https://webmail.education.doncaster.gov.uk/owa/redir.aspx?C=qpoQKowcDUuxZCi0cpHNneS7Vu-OidAItxlkpbmhSTtMo8A-PGG69ScbRQ9J_-qVjtVgTqFYDT0.&URL=https%3a%2f%2fkb.meraki.com%2fknowledge_base%2fdetermining-ip-address-ranges-needed-for-amazoncom-s3amazoncom

 

Just forwarded this through to out LA to see if they will set it for me. Fingers crossed.

 

Your link had the usual MS crap in it when copying out of OWA .. so here's the clean version .. https://kb.meraki.com/knowledge_base/determining-ip-address-ranges-needed-for-amazoncom-s3amazoncom

 

[AngryTechnician]

Another thing to point out is if this is the PC System Manager you're talking about (as opposed to the iOS / Android thing) then it won't work via Proxys (as in it won't read proxy information from the PC, so will only try on a direct connection).

Ours check in fine through Smoothwall. I had to whitelist meraki.com and open a couple of ports on the firewall (not 80 or 443) but I think that's all it took for us. We use WPAD if that makes any difference.

[Nick_Parker]

Bit of a random question (Sorry if it seems obvious - I don't wanna start out doing it one way then realise in a few weeks I should have done it another) - I'm going to add our laptops, desktops and iPads to Meraki. Should I create 3 different networks to manage the 3 different types of hardware or is it better to keep it all combined within one network?

[AngryTechnician]

I can't think of any good reason why you would separate them. You can apply your own tags to devices so you can easily filter according to device type if required.

[Nick_Parker]

Sorry, another arb question:

 

iOS

 

46.165.246.229, 74.50.56.176, 50.18.152.159 - TCP port 443

* - TCP ports 2195, 2196, 5223

 

Is my understanding correct - I need to open port 443 to 46.165.246.229, 74.50.56.176 & 50.18.152.159 and I need to open 2195, 2196 & 5223 to ALL IPs?

[soveryapt]

Bit of a random question (Sorry if it seems obvious - I don't wanna start out doing it one way then realise in a few weeks I should have done it another) - I'm going to add our laptops, desktops and iPads to Meraki. Should I create 3 different networks to manage the 3 different types of hardware or is it better to keep it all combined within one network?

 

Don't forget, if you're using this and need to set any kind of proxy settings then Meraki won't pick up on them as it trys to use a direct connection, but as already has been said, use their filtering. I have a few networks within my own login, but this is to handle different small clients I look after so I have a network per client.

[Nick_Parker]

I've definitely done something wrong somewhere.

I've just downloaded the Meraki App onto my iPhone and enrolled myself and I'm getting the "Waiting for MDM enrollment to complete" message.

I'm connected to 3G so no firewalls or port forwarding issues

[TechSupp]

Well submitted all the ports and Amazon IP for us to the LA and they duly sorted it out for my schools, checked a tablet and it updated and checked in which it never did before. Need to do some more testing when I get chance.

[TechSupp]

Your link had the usual MS crap in it when copying out of OWA .. so here's the clean version .. https://kb.meraki.com/knowledge_base/determining-ip-address-ranges-needed-for-amazoncom-s3amazoncom

 

 

Thanks for that, didn't notice it when I just copied and pasted it! At least I know for next time, thanks for posting the correct info for me.

[soveryapt]

I've definitely done something wrong somewhere.

I've just downloaded the Meraki App onto my iPhone and enrolled myself and I'm getting the "Waiting for MDM enrollment to complete" message.

I'm connected to 3G so no firewalls or port forwarding issues

 

Enrollment is normally done by going to m.meraki.com and entering the code that you get from your Meraki dashboard for that network (123-123-1234) then the app just adds function to the device. You might also be able to register through the app, but I've never tried to be honest.

[tantos82]

I have a question for you all! Any help would be great!

 

So I have my test iPad which I am trying to enrol on to Meraki. So I do the goto m.meraki.com and put in my code and install the profile. Great!! My iPad shows up in system manage I click on it and its all there. all the info about my iPad.

So i am think yes it has worked!!! NO NO NO I tried to lock my iPad and nothing just sits at pending, same goes for everything I try to do.

 

I am thinking it is being block coming in to our school because I am sending the command from my Mac that is on a public connection and my iPad is on a restricted connection

 

What do you guys think?