Meraki problems

[Sheridan]

Anyone else having issues with meraki? I've registed a good few devices in the last 12 months so I know our firewall settings are correct, yet 2 brand new ipads will not enroll, they just stick at the 'Waiting for enrollment' message

 

I can see they are hitting the firewall, and being allowed through. But they will not enrol. They show up in the Meraki dashboard as 'never' connected and unmanaged.

 

I've checked our firewall rules match those that meraki have specified (they haven't changed recently) so I'm a bit baffled!

[computer_expert]

Are you on the new or old MDM system? The new one has a limit of 100 devices for free whereas the old one is unlimited (but you don't get the 'new' iOS9+ features)

[Sheridan]

We've been on the new one a good while and have had no problems. These two new iPads are iOS 9 and seem to connect but never enrol. If I look at the console of the iPad I can see 'iPad Meraki MDM' errors reporting 404. I assume that's http and page not found but not sure if meraki have changed anything?

[Sheridan]

This is a puzzling one, still no ios devices will enroll. The enrollment procedure completes OK and the devices shows in the dashboard but never checks in. It must be a connectivity issue but our firewall shows the device connecting with no errors!

 

This was a trial of meraki for future rollout of staff ipads so I guess lightspeed is the next option.

[sarahstacey]

If you look under Device Management - Meraki Management on the iPad is the profile verified?

I had some iPads that were not verified, I restored them using itunes, went through setup again and they were fine.

[Sheridan]

If you look under Device Management - Meraki Management on the iPad is the profile verified?

I had some iPads that were not verified, I restored them using itunes, went through setup again and they were fine.

 

Its showing Verified for the Meraki profile - its sticking somewhere that won't let it enroll and pull down the profile.

 

Edit: Mind you the Meraki firewall rules are garbage, watching the traffic from one of these ipads shows all sorts of activity on ports 80 and loads of ip addresses not in the Meraki ranges being accessed when trying to enroll

Edited September 23, 2016 by Sheridan

[Sheridan]

Looks like TMG2010 doesn't like the way Meraki works now - I can see quite a few "A non-SYN packet was dropped because it was sent by a source that does not have an established connection with the Forefront TMG computer" errors when the clients are connecting.

[Sylv3r]

We've got the same problem. I've even brought an iPAD home tonight and still can't get it to enroll fully on my home broadband. Out of interest, would this be the first iOS10 device your trying to enroll, all of our other iPADs were upgrading to iOS10 after enrollment, this is the first i'm trying with iOS10 on first.

[fredbayker]

We have enrolled ios10 devices with no issue this morning.

[dcctechno]

Hi all,

 

Having a similar issue, installing with correct Network ID returns "the SCEP server returned an invalid response" have never seen that and we have been using the new version of Meraki for a number of weeks now. Any ideas?

[ollyyllo]

I am getting the same error, on both iOS9 and iOS10. Was working fine yesterday, I would guess it's a problem at Meraki's end.

[dcctechno]

Will keep a close eye and keep you inform ollyyllo, very frustrating to spend 1 1/2 classes installing. One instance of Meraki works fine and the new group does not!

[DalekSec]

Same here, trying to connect to meraki coming up with 'profile installation failed your ipad is not activated'

[boogster]

getting exactly the same guys with 1 device that we had replaced by apple recently and cant enrol.

[Sheridan]

Hmm sounds like I'm not alone. We have been using Meraki for a little while but don't have many devices on it - however with the firewall rules etc in place they have been enrolling and downloading apps OK. Until this last week or so.

 

Now they will enroll (usually) but never perform their initial synchronisation - however if I hotspot them to a phone they do this stage and then start pulling the apps down. Not sure why as I've even tried letting them out through our TMG2010 firewall open on all ports outbound - nothing on the firewall logs shows anything being blocked.

 

Even when they work, some apps are missing, some say they're missing but are installed. Some say 'Install application enqueued' in the console and it never changes. I'm getting such varied results I've forgotten where I started.

 

This was our trail with meraki for a larger deployment and so far its proved that a) its not working for us anymore and b) meraki won't give you any support unless you're already paying!

 

Off to trial lightspeed now I think!

[mikkydoos]

Hi all,

 

Having a similar issue, installing with correct Network ID returns "the SCEP server returned an invalid response" have never seen that and we have been using the new version of Meraki for a number of weeks now. Any ideas?

 

 

I'm getting this too. Not just with Meraki, but also with an Ipad I've tried installing profiles with Apple configurator and I get the same error.

 

Is this an IOS 9.3.x bug AGAIN!!!!!!!!

 

 

I'm thinking this is an Apple thing.... not Meraki.

Edited September 27, 2016 by mikkydoos

[Sylv3r]

The SCEP issue appears to have resolve itself tonight adding the profile from home.

[Glandwr]

I've just tried it from home and it worked as well, but wasn't sure was it because I'd just cleared the cache in Safari. Cross fingers it continues to work!

[mikkydoos]

Yep. Worked for me from work this morning. After a 'Cannot enroll. There is a problem with the network' error.

 

Worked second time.

 

 

Hhhhmmm.

[Sheridan]

Mine still wont do the initial synch, nor download some apps once the initial synch is done over a hotspot connection. If you try the manual download of a missing app in the Meraki MDM app, it just stills spinning away yet nothing shows are being blocked on the firewall or smoothwall.

 

Out of interest, what firewall exceptions are you running for Meraki? I've used the definitions from their site but I'm still not convinced our TMG isn't breaking this somehow as even a whitelisted devices doesn't synch through it anymore.

[mikkydoos]

Mine still wont do the initial synch, nor download some apps once the initial synch is done over a hotspot connection. If you try the manual download of a missing app in the Meraki MDM app, it just stills spinning away yet nothing shows are being blocked on the firewall or smoothwall.

 

Out of interest, what firewall exceptions are you running for Meraki? I've used the definitions from their site but I'm still not convinced our TMG isn't breaking this somehow as even a whitelisted devices doesn't synch through it anymore.

 

 

None at all. Never needed to.

[DalekSec]

Ours worked this morning, managed to get the Cert installed on the iPad without any problems.

[Sheridan]

None at all. Never needed to.

 

So do yours hit a proxy in any way? Ours are directed to a proxy, but it still hits the firewall sometimes on some of the ports Meraki specify.

[mikkydoos]

So do yours hit a proxy in any way? Ours are directed to a proxy, but it still hits the firewall sometimes on some of the ports Meraki specify.

 

Yep. They go through a transparent proxy with filtering. The Meraki urls arent filtered out.

[Sheridan]

Yep. They go through a transparent proxy with filtering. The Meraki urls arent filtered out.

 

Our goes through an unauthenticated proxy with meraki/apple whitelisted and not https inspection.

 

Our smoothwall doesn't seem to be blocking anything, traffic from these devices goes through OK but obviously something isn't working somewhere.