[ipad] MERAKI - Just disabled network access for ALL school iPads!

[Koldov]

Okay so this is a doozy and I can't figure out how to fix it!

 

Whilst trying out different settings to fix a different problem...

 

https://www.edugeek.net/forums/internet-related-filtering-firewall/237854-find-device-ip.html

 

I clicked on a setting in Meraki Systems Manager:

 

"Force wifi to allowed networks only"

 

Considering there is a Wi-Fi configuration payload already on all the iPads telling them which network to join (SSID, password, auto-join etc.) I presumed this would be fine...

 

Apparently it turns out it isn't and now all the iPads have jumped off the network and will not re-join...

 

Just to add to the mix Wi-Fi power is forced on and even though it can see the network it should join it just won't... which means any config change I make now (like deselecting 'Force Wi-Fi to allowed networks only') won't even take effect...

 

Where is the 'Allowed Network' configuration then, is it in SM somewhere because I can't find it (although I'll admit I'm probably not looking as calmly as I should)....

[robintech]

Where is the 'Allowed Network' configuration

It will allow any SSID you deployed to it and blank the rest, think we did ours through Apple Configurator as it seemed to have issues when enrolling them.

Can you get an ethernet adaptor and get them back online to remove the restriction

[Koldov]

It will allow any SSID you deployed to it and blank the rest, think we did ours through Apple Configurator as it seemed to have issues when enrolling them.

 

Yeah, that's kind of what I thought... but I deployed it through a Meraki SM 'Profile Configuration' > 'Wi-Fi- Settings' > SSID (name) > Auto-Join (ticked)

 

Is that where it is? And that should work? Because that's all done...

 

 

Can you get an ethernet adaptor and get them back online to remove the restriction

 

There's hundreds of them!

[DavR]

Ouch, bad luck. If the devices are now offline due to the config change you made, there's no fix other than to re-join each device, to allow it to get your corrected configuration.

 

I did this by accident myself a few week back when changing the scoping of our WiFi policy (one which I use to disable mac address randomisation - similar to your original problem?). That was a hairy afternoon, and no mistake. Luckily I only had to fix approx 40 devices, and they were mostly accessible.

[Koldov]

Ouch, bad luck. If the devices are now offline due to the config change you made, there's no fix other than to re-join each device, to allow it to get your corrected configuration.

 

Yeah I guess I'll have to resign myself to the fact it's going to be long evening (and an early morning)...

 

I did this by accident myself a few week back when changing the scoping of our WiFi policy (one which I use to disable mac address randomisation - similar to your original problem?). That was a hairy afternoon, and no mistake. Luckily I only had to fix approx 40 devices, and they were mostly accessible.

 

I just can't work out WHY they aren't auto-joining... if the setting just forces them on to the SSID I've already provided in the Profile Configuration...

 

On the device it says:

 

Your iPad can only join Wi-Fi networks that are configured by your organization's admin

 

The Wi-Fi power is on and 'greyed out'

 

There's an Edit 'button' so I push that and it shows me the SSID that I want it to connect to... but there's no way to force it to connect... just an info button and a padlock.

 

Pressing the info button shows Auto-Join is on, but guess what... it isn't auto-joining!!!!

[DGardiner]

Yeah I guess I'll have to resign myself to the fact it's going to be long evening (and an early morning)...

 

 

 

I just can't work out WHY they aren't auto-joining... if the setting just forces them on to the SSID I've already provided in the Profile Configuration...

 

On the device it says:

 

Your iPad can only join Wi-Fi networks that are configured by your organization's admin

 

The Wi-Fi power is on and 'greyed out'

 

There's an Edit 'button' so I push that and it shows me the SSID that I want it to connect to... but there's no way to force it to connect... just an info button and a padlock.

 

Pressing the info button shows Auto-Join is on, but guess what... it isn't auto-joining!!!!

 

just an FYI the SSID will be case sensitive when youre messing with policies in some cases - i know MAC Randomisation on deployed networks doesnt apply unless the case is correct so that may be your stumbling block

[DavR]

I just can't work out WHY they aren't auto-joining... if the setting just forces them on to the SSID I've already provided in the Profile Configuration...

 

On the device it says:

 

Your iPad can only join Wi-Fi networks that are configured by your organization's admin

 

The Wi-Fi power is on and 'greyed out'

 

There's an Edit 'button' so I push that and it shows me the SSID that I want it to connect to... but there's no way to force it to connect... just an info button and a padlock.

 

Pressing the info button shows Auto-Join is on, but guess what... it isn't auto-joining!!!!

 

 

Oh dear. Have you lost connectivity, AND, locked yourself out of the wifi settings? That could be an issue!

 

 

Have you deployed the WiFi SSID and password out in the same profile that you've deployed the 'Force wifi to allowed networks only' restriction setting?

 

 

In the past, I have found that if I deploy a wireless network via a profile in Apple Configurator (for instance), when I enrol the device into Meraki it will junk those settings and overwrite them. Manually entered networks are OK, but those added via profiles other than Meraki it didn't like.

[Andrew_C]

Maybe a crazy suggestion as a) I know nothing about Macs and b) little about networking...

 

Can you create a temporary network matching the one your bricks devices are looking for?

[DGardiner]

Maybe a crazy suggestion as a) I know nothing about Macs and b) little about networking...

 

Can you create a temporary network matching the one your bricks devices are looking for?

 

if its the case sensitivity thats cause it, adjusting your ssid name to the other case would get them online

[Koldov]

Thanks all... and an update!

 

Well, after a late night and an early morning and all day yesterday, we appear to have mostly 'normal' services resumed...

 

Unfortunately messing with the SSID itself wasn't really an option, it might have been a good fix but with our old WLC it would need to be CLI which I don't have access to (even if I had the know-how) and honestly I thought better than to add more possible issues!

 

It ended up with me plugging in each individual iPad to our Mac-Mini, enabling 'Internet Connection Sharing' pressing 'Trust This Computer' on each one and waiting for the profile to update, then plugging in the next...

 

I did change the SSID case in the profile, I can't tell if that made a difference but they all connected straight away so I left it at that.

 

Now, if you're still with me, this brings me to the issue of the IP showing up in Meraki SM. Some do and some don't, some show SSID, some don't, some show Public IP and some don't (ignore the BT SSID, I don't even know how that got there, probably a teacher took one home)... In our profile now it will only connect to the school SSID set up for the children and you can't turn the Wi-Fi off.

 

 

After a whole morning wasted trying various things, profile changes, reboots, I've narrowed it down to this:

 

After changing the settings on the iPad for the Meraki SM MDM app to allow it to 'Allow Location Access' to always, the IP popped up in the dashboard.

 

Those without this access enabled do not display their IP (confirmed on multiple iPads), but this seems to go against the information I found on the page for Cisco Meraki (Managing Systems Manager Location Services for iOS):

 

Installing and enabling the Cisco Meraki MDM iOS app provides many additional features for enrolled iOS devices, including more accurate location tracking. While Systems Manager makes every effort to minimize the effect, using GPS location tracking services may result in slightly diminished battery life. If a device user feels as though their battery life is excessively compromised by the SM app, location services may be disabled, while maintaining the other beneficial features of the app (e.g., send notifications, SSID reporting, LAN IP).

 

The underlined section doesn't appear to be the case in my experience...

 

Also:

 

You cannot configure Privacy > Location Services via MDM. This means that end users have the ability to turn on or off GPS tracking.

 

So, now I have to go round and touch all these iPads again! I know it specifically mentions GPS tracking and this isn't what we're talking about here as it's only Wi-Fi, more that the user can turn it off...

 

https://documentation.meraki.com/SM/Monitoring_and_Reporting/Managing_Systems_Manager_Location_Services_for_iOS

Edited May 1, 2024 by Koldov

[DavR]

Glad you hear you managed to get everything online. It's a faff, but sometimes that's the only way to do it.

 

Regarding getting the IP address and SSID reported in Meraki console, I *think* this is reliant on the System Manager app being open on the iPad to fully report back. I've played around a lot with trying to get the location to report back (for geofencing), and that relies on the Meraki app being open and running on the device to report correctly. Looking at my Meraki console, I can see a correlation between devices that have reported IP and SSID, and devices I know I've opened the app on.

 

Meraki is a great system, but needing that SM app to be open, or at least opened once, on the device is a massive weakness in the design.

[Koldov]

I don't think it needs to be open...

 

If 'Settings > Privacy & Security > Location Services' is set to 'ON' (which the 'user' CAN disable )...

 

Then go to 'Settings' and scroll down to the Meraki MDM app and in the 'ALLOW MERAKI MDM TO ACCESS' section choose 'Location', this will give you the options of:

 

Never

Ask Next Time Or When I Share

While Using The App

Always

 

I've chosen 'Always' for those I've got round to so far.

 

Agree on the weakness of the design, maybe an Apple 'Privacy' thing though... but... when you first open the app itself (or after first install), for some reason it doesn't give you the 'Always' option...

 

Also the 'user' can disable this too!

Edited May 1, 2024 by Koldov

[DavR]

I don't think it needs to be open...

 

If 'Settings > Privacy & Security > Location Services' is set to 'ON' (which the 'user' CAN disable )...

 

Then go to 'Settings' and scroll down to the Meraki MDM app and in the 'ALLOW MERAKI MDM TO ACCESS' section choose 'Location', this will give you the options of:

 

Never

Ask Next Time Or When I Share

While Using The App

Always

 

I've chosen 'Always' for those I've got round to so far.

 

But... when you first open the app itself (or after first install), for some reason it doesn't give you the 'Always' option...

 

Also the 'user' can disable this too!

 

Oh, I've done all this, so I've had test devices up with these settings enabled.

 

But, during my testing, the device didn't report location as a matter of course (you may be able to request location from the console, I don't recall if I tried that or not). The only time the device reported location was when I had the System Manager app open. My scenario being, taking a device offsite to see if it reported being offsite and violating our geofencing policy. Even after 24hrs offsite, it didn't report as violating the geofencing policy. Open the SM app, it reported location and a geofencing alert occurred a minute or two later.

 

Thus my understanding is that the device doesn't report location to Meraki, unless the SM app is open, or it's requested from the console. My suspicion, getting back to your original problem, is that IP and SSID don't report either, unless SM app is open. Maybe try one of your iPads that currently isn't reporting IP and SSID, open SM app, and see what happens.

Edited May 1, 2024 by DavR

[Koldov]

Dammit!

 

Unfortunately, to get the 'location sharing' settings to even appear in the app properties, you have to open the app. When you open the app for the first time (as I realised these were all new iPads that I had to throw in to the mix quickly and hoped the MDM would do it's magic with minimal touch and I hadn't done this) it checks if you have the main 'Location Services' set to ON. Then the app opens and the 'Location' section has an amber question mark.

 

Click on the little arrow and it asks you to enable Once, When Sharing, When Using The App.

 

I chose 'Once' and then went into the app settings in the iPad settings menu and changed it to always... so they have all now reported IP (but of course I have had to open the app)...

[Koldov]

Even after 24hrs offsite, it didn't report as violating the geofencing policy..

 

This may be why one of my iPads had a BT SSID (my presumption is that a teacher took one home) and yet I didn't get a Geofencing violation alert...

 

EDIT: Which is also annoying because whenever I've been searching for one, I've looked at the dashboard and said "well, it must be here because it doesn't show it has gone off-site"...

Edited May 1, 2024 by Koldov

[DavR]

Yep! It's a bit rubbish that it only works, when you've opened the app.

 

I have devices in iPad trolleys, that are deployed via Apple Configurator and Apple Device Enrolment, where the System Manager app is installed, but likely in the lifetime of the device, will never be opened, so we'll never get this data reported.

 

Infuriating!

[Koldov]

Yep! It's a bit rubbish that it only works, when you've opened the app.

 

I have devices in iPad trolleys, that are deployed via Apple Configurator and Apple Device Enrolment, where the System Manager app is installed, but likely in the lifetime of the device, will never be opened, so we'll never get this data reported.

 

Infuriating!

 

Agreed!

 

A few of mine still weren't showing the SSID, but as soon as I opened the app and refreshed the page for the dashboard... it showed up... pointless 'feature'!

 

This also means that I guess I can't be 100% certain of the IP address, in case it has been given another by DHCP and hasn't updated the dashboard because the app hasn't been opened...?

Edited May 1, 2024 by Koldov

[DavR]

This also means that I guess I can't be 100% certain of the IP address, in case it has been given another by DHCP and hasn't updated the dashboard because the app hasn't been opened...?

 

 

Yep, afraid that information can't be relied upon. Even if it's always been on the same DHCP server, there's nothing to say that IP hasn't changed over time.

 

 

If I'm trying to track my devices by IP, I search in the clients section of our managed wireless solution, MDM isn't reliable.

[Koldov]

Annoyingly I've just looked there, but that doesn't stop a 24 hour old report showing an 'old' IP address, so I guess that's just for immediate alerts/real-time reporting?

 

So I mean if we are looking in the morning at an emailed report that came in overnight and specifies an IP tried to access a website yesterday, if the iPad has a new IP the old one won't show anywhere.

 

I thought MAC might be better, but somehow the iPad and the WLC are showing different MACs for the same device... I thought this was what I'd just stopped?

 

Meraki SM dashboard has:

 

WiFi MAC

1a:2b:3c:4d:5e:0C

 

and the WLC has:

 

MAC Address

a1:b2:c3:d4:e5:85

 

But both report the same IP... 12.34.56.78

[DavR]

Tbf, within 24hrs you'd expect the IP address to probably still be the same. But it is best to be certain, especially if you're reporting on web filtering infractions.

 

With our wireless management, we get a current and a historical tab for clients, so that's where I look these things up when I need to. Which is no help in your case I know!

[Koldov]

Yeah, almost makes this whole fiasco pointless...

 

 

EDIT: One good thing is that the MAC seems to have aligned now, maybe just needed a few hours to get rid of the previous randomisation...

Edited May 2, 2024 by Koldov

[howartp]

On the topic of searching for missing iPads, you can put them into Lost Mode (iCloud) - this turns on location services regardless of the device setting, and thus reports where it is as long as it has power and WiFi.

[Koldov]

Yes, have done this once or twice (and even recovered one)!

 

Sometimes I even do it when a teacher hasn't returned one to the trolley overnight and has left it on their desk after taking photos from it.

 

Then at 9 a.m. when it's all quiet for them taking the morning register, I play the sound every 10 seconds...

 

It soon gets returned!

[Brimstone]

Get another MDM......?