Meraki problems

[mikkydoos]

Our goes through an unauthenticated proxy with meraki/apple whitelisted and not https inspection.

 

Our smoothwall doesn't seem to be blocking anything, traffic from these devices goes through OK but obviously something isn't working somewhere.

 

You've probably got the same setup as us.

 

I think the whole issue isn't Meraki. As I said before I couldn't even install my own profile from Apple Configurator.

The ipad went out looked for some Apple server somewhere when applying profiles.

Edited September 28, 2016 by mikkydoos

[Sheridan]

The only error I can find is when the Meraki app is trying to enroll - the IOS log shows lots of these

 

Sep 28 03:45:16 iPad kernel[0] : Sandbox: Meraki MDM(340) deny(1) file-write-create /private/jailbreak.test

Sep 28 03:45:16 iPad Meraki MDM[340] : Checking in without location update

Sep 28 03:45:17 iPad Meraki MDM[340] : HTTPManager(381): Got 404 when checking in

Sep 28 03:45:19 iPad Meraki MDM[340] : Starting checkin of type: StatusRefresh

Sep 28 03:45:19 iPad kernel[0] : Sandbox: Meraki MDM(340) deny(1) process-fork

Sep 28 03:45:19 iPad Meraki MDM[340] : -canOpenURL: failed for URL: "cydia:/package/com.com.com -- file:///" - error: "This app is not allowed to query for scheme file"

 

The http 404 suggests it can't connect to something, somewhere!

[mikkydoos]

Try what @Glandwr did.

[Sheridan]

I think I'm a bit screwed here. When I point these directly at the firewall (unfiltered, direct access with all outbound ports open) I can see access on 443/5223 going through the firewall, yet it still won't enroll.

 

I can only assume that TMG is mangling something in the process, or our wireless is blocking it somehow but that seems unlikey as we use Xirrus and don't currently use any application blocking policies

[mikkydoos]

I take it it worked before ?

[Sheridan]

I take it it worked before ?

 

Yeah it all worked OK before - we moved from Ruckus to Xirrus and now they don't enroll. Or, if the do enroll simply don't do the initial synch.

[mikkydoos]

Are they doing any packet rejection or filtering. Https or anything else ?

 

Sounds weird.

[Sheridan]

No filtering on our wireless at all, I've got some bizarre errors on the ios logs as well:

 

MDM: Rejecting MDM push dictionary because it does not have the right magic string

 

I mean, WTF is that supposed to mean!?

[mikkydoos]

Ask Paul Daniels Its Magic!

 

 

 

U getting that on more than one device?

[Sheridan]

Ask Paul Daniels Its Magic!

 

 

 

U getting that on more than one device?

 

Heh, to be honest I've lost track of whats going on. I have a dozen new ipads and none will enroll or synch. The 404 error and magic seem to be common errors on them though.

 

If I hotspot them they will then work - which isn't a solution really but I've wasted so much time on this I'm going to have to accept defeat.

 

I think I've found what the 404 refers to, its an app crash logging site (crashlytics.com) that returns the 404, so some ios app is trying to log a crash log

Edited September 28, 2016 by Sheridan

[mikkydoos]

Y. Do them one your phone. Sod it.

[Sheridan]

Weirdly, this has started working! I have changed nothing, and have simply been monitoring the firewall logs. Activity was the same, but several ipads have now enrolled,synched and pulled down the apps!

 

Maybe this was at meraki's end all along!

[Arreks]

Probably Meraki's side as you say, sometimes my iPads just don't cooperate at all unless I leave them for ages or keep unenrolling/enrolling.

[Sylv3r]

Does anybody else still have this issue? It just doesn't seem to be pulling down the security policy or pulling down any apps for us.

 

I've supervised them via Apple Configurator and have tried both installing the MDM app and registering that way as well as visiting m.meraki.com and neither seem to work. Looking at the client, it shows the following error:

 

Management

Settings: updates pending

 

Meraki have advised trying the install missing / updated profiles button, but it doesn't seem to make any difference.

 

Thanks

[Glandwr]

Hi, does your devices show up as Online in the Meraki Web Console?

[mikkydoos]

Mine are good now.

[Sheridan]

Mine have now stopped working again!

 

I don't know what's going on with these, at the ipad end they show as enrolled and compliant, yet the dashboard shows they haven't checked in for days (and the location is on the wrong continent!)

 

Plus, newly assigned apps appear on the clients Meraki app, but dont install - trying to manually pull them down doesn't work either.

 

So I'm back to the start again - but pretty much written off meraki as any kind of usable solution anymore.

Edited October 4, 2016 by Sheridan

[broomop]

I have the same issue, i have everything installed however it thinks its not enrolled. Once i try enroll it from the web it works but still no applications install or anything i push through Meraki. When i try enroll using the Meraki application it says an error has occurred and crashes.

[Sylv3r]

We are up and running again with ours. No two days are the same it seems !

[mikkydoos]

I'll be trying one in a bit. Will post results...

[Arreks]

Well I deployed a new profile and it went over to half of my set within 5 minutes but still nothing on the other half (this was yesterday) - all connected, enrolled, compliant..

 

Meraki's just weird.

[broomop]

ok, the same happened to me lol its all ok now. Must of been a server issue.

[Sheridan]

I would say I've got a 50/50 split of ones working and not working. They were all working a couple of weeks ago.

 

I've had to configure a handful of ipads with configurator just to get the damn things out there!

[mikkydoos]

I'll be trying one in a bit. Will post results...

 

Mines good now. ?????????????????????????????????????????

[Arthur_2_Sheds_Jackson]

I have been experiencing this issue too. On maybe 10% of iPads. Meraki build 45. ios 9.3.5. (in other words, the latest)

 

When manually forcing a check in that WORKS I see in the console log:

 

 

Oct 11 11:18:55 al-ipads76 mdmd[833] : (Note ) MDM: mdmd starting...

Oct 11 11:18:55 al-ipads76 mdmd[833] : (Note ) MDM: Network reachability has changed.

Oct 11 11:18:55 al-ipads76 mdmd[833] : (Note ) MDM: Network reachability has changed.

Oct 11 11:18:55 al-ipads76 mdmd[833] : (Note ) MDM: Push token received.

Oct 11 11:18:55 al-ipads76 mdmd[833] : (Note ) MDM: Received push notification.

Oct 11 11:18:55 al-ipads76 mdmd[833] : (Note ) MDM: Polling MDM server https://ios.meraki.com/apple_mdm/ios?org=129225 for next command.

Oct 11 11:18:56 al-ipads76 mdmd[833] : (Note ) MDM: Transaction completed. Status: 200

Oct 11 11:18:56 al-ipads76 mdmd[833] : (Note ) MDM: Server has no commands for this device.

Oct 11 11:18:57 al-ipads76 mdmd[833] : (Note ) MDM: mdmd stopping.

 

On iPads where the check in DOES NOT WORK I see:

 

Oct 11 11:23:56 al-ipads75 mdmd[229] : (Note ) MDM: mdmd starting...

Oct 11 11:23:56 al-ipads75 mdmd[229] : (Note ) MDM: Network reachability has changed.

Oct 11 11:23:56 al-ipads75 mdmd[229] : (Note ) MDM: Network reachability has changed.

Oct 11 11:23:56 al-ipads75 mdmd[229] : (Note ) MDM: Push token received.

Oct 11 11:23:56 al-ipads75 mdmd[229] : (Note ) MDM: Received push notification.

Oct 11 11:23:56 al-ipads75 mdmd[229] : (Error) MDM: Rejecting MDM push dictionary because it does not have the right magic string.

 

So "Rejecting MDM push dictionary because it does not have the right magic string." seems to be the key.

 

If someone can pass this by Meraki that would help. I'm not allowed to contact Meraki support.