Meraki MDM - Devices Not Checking In

[enjay]

Looking at our Meraki MDM console, almost none of our devices have checked in since 22nd June. The fact they are all time-stamped within a few hours of each supports the theory that something's broken. Any devices registering with Meraki after that time are fine.

 

Any ideas?!

[Blue_Cookeh]

It's a complete PITA to get Meraki through a firewall, take a look at their port ranges and IP addresses https://dashboard.meraki.com/manage/support/firewall_configuration

 

I've punched umpteen holes through our proxies and firewalls. I've watched our logs in realtime and there's NOTHING being blocked, yet 95% of our devices don't check in.

[andydis]

Is the certificate still valid ?

[dapaulio]

Sounds suspiciously like firewall ports have been changed at some point. i had a nightmare with meraki ports. although the documented ports were there we found others needed to be open also. Mainly port ranges were a lot larger than documented and the amazon servers are integral in deployment as apparently their servers hold the configuration info for the client when you run the client installer. Unblocking *.amazon.com didnt help and we had to unblock their IPaddresses. Be careful with the amazon servers as their IP addresses are different geographically. we had to ping and tracert amazon to get their ip address then use a online tool called ARIN to acquire the CIDR to unblock the whole ip range and the port associated in the documentation. if i recall it was only 993 that was additional to 80 and 443.

 

believe me it is not for the faint hearted especially if you have a third party to get involved. We had to ask or our LEA to also unblock the ports and you always suspected whether they were actually doing it (correctly). As our LEA had to repeat what we were doing it took me 6 months off and on and one of our LEA third tier network engineers and hosting services engineer to get sorted so good luck.

 

if you have to deal with a third party firewall then i recommend you escalate that call soon as possible

Edited July 25, 2015 by dapaulio

[LukeC]

This happened to me as well I needed to renew my certificate as they only last a year

[enjay]

I don't see how it can be either firewall or certificate, because newly-registered devices (or existing ones which are re-registered) work just fine. If it were firewall or certificates, all devices would be blocked. No?

[Blue_Cookeh]

Both device and Apple certificates are fine on mine, most still don't check in...

 

Looks like we're alone so far @enjay!

 

I'm tempted to deploy an on site MDM at this point.

Edited July 27, 2015 by Blue_Cookeh

[dapaulio]

I don't see how it can be either firewall or certificate, because newly-registered devices (or existing ones which are re-registered) work just fine. If it were firewall or certificates, all devices would be blocked. No?

 

Did you install any windows updates around the time, or any updates for that matter. We had a wu break a part of sims once. Not something you would normally expect. Now it is one of the first things I check if the problem is not obvious

 

Funny really because the only time I experience problems is registration and first time sync. checking in is fine through my proxy after the initial sync. For some reason meraki doesn't like my clients proxy configured by wpad Togo through my smoothwall. However connect them through a transparent proxy on the same smooth wall they are fine they sync and check in fine.

[enjay]

How would Windows updates make a difference? There aren't any Windows devices involved in this. iPad connects to Meru access points, goes through Lightspeed filtering, Cisco firewall and then on to whatever Meraki is running on.

[localzuk]

We had this a while back, and it was down to firewall. Is it entirely managed by yourselves, or is there anything above you in the ISP chain that could be blocking? I put a request in with our ISP and they released a stack of ports to allow it to work. Been flawless since - even got the message/notification bit working which has always refused to work before.

 

Are all the devices the same version of iOS? That's my only thought about why new devices would work and old ones not. IIRC, things have changed with regards to MDM over different iOS versions.

[enjay]

We had this a while back, and it was down to firewall. Is it entirely managed by yourselves, or is there anything above you in the ISP chain that could be blocking? I put a request in with our ISP and they released a stack of ports to allow it to work. Been flawless since - even got the message/notification bit working which has always refused to work before.

 

Are all the devices the same version of iOS? That's my only thought about why new devices would work and old ones not. IIRC, things have changed with regards to MDM over different iOS versions.

 

I still don't buy that - if our firewall were blocking something, surely new devices wouldn't be able to check in either. Or have I got that wrong??

[localzuk]

I still don't buy that - if our firewall were blocking something, surely new devices wouldn't be able to check in either. Or have I got that wrong??

 

That was what the second part of my message alludes to. Are all these devices on the same version of iOS?

[enjay]

That was what the second part of my message alludes to. Are all these devices on the same version of iOS?

 

No, they're a mix, but we have 8.3 devices which can't check in and which can check in; same goes for 8.4