What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from the Meraki organization:- Administrators - every dashboard administrator, with their name, email address, account status (a locked administrator is shown as disabled), last activity, and how they sign in (email and password, Cisco SecureX Sign-On, or SAML). Oleria shows whether the administrator uses two-step verification and whether your organization requires it, and treats an administrator with full or enterprise organization access as an administrator.
- Roles - the organization-wide access levels (Full, Read-only, Enterprise, Camera and sensor), the network and tag access levels, and your SAML roles with the access each one grants.
- Role assignments - each administrator’s organization access, and their network and tag privileges. For a network or tag privilege, Oleria lists the networks or tags it applies to.
- API keys - the Dashboard API key of each administrator who has one, as a credential linked to that administrator. For the administrator the connection uses, Oleria also shows each key’s last four characters and creation date. Oleria never reads or stores key values.
- Activity - the organization’s configuration change log, and the API calls that create, change, or delete things, including failed attempts. Oleria collects up to 365 days of the change log and 31 days of API calls.
Prerequisites
- A Meraki organization with Dashboard API access turned on. Open Organization -> Settings -> Dashboard API access.
- A dashboard administrator for Oleria. We recommend a dedicated administrator, not a person’s account, so the integration doesn’t depend on one person. The administrator’s Organization access sets what Oleria can do:
- Read-only lets Oleria read administrators, roles, and activity.
- Full (or Enterprise) is also required to run remediation actions.
- The organization ID and the region the organization is hosted in: global, Canada, China, India, or US government.
Meraki API keys carry the dashboard privileges of the administrator who generated them. There is no separate scope to select.
Create the administrator and its API key
1
Add the administrator
In the Meraki dashboard, go to Organization -> Administrators and add a new administrator for Oleria. Set Organization access to Read-only, or to Full (or Enterprise) if you want to run remediation actions.
2
Generate the API key
Sign in as that administrator, go to My profile -> API access, and select Generate new API key. Copy the key. Meraki shows it only once.
3
Find the organization ID
Note your organization ID. The Dashboard API call
GET /organizations lists the organizations the key can access.If your organization restricts API key use to specific IP addresses in its login security settings, allow Oleria’s egress IP addresses so the connection can reach the Dashboard API.
Connect Cisco Meraki to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select Cisco Meraki.
2
Complete the connection form
When you edit the integration later, leave Dashboard API key blank to keep the stored key, or enter a new one to replace it. You can change the Region.
3
Authenticate
Select Authenticate to validate and save the integration. Oleria checks the key against your organization before saving.
Verify the integration
Confirm the Cisco Meraki instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, review the discovered administrators, roles, and API keys in your Oleria workspace.Remediation actions
When Oleria connects as an administrator with Full or Enterprise organization access, it can take the following actions:Oleria refuses to:
- change or remove the administrator the integration’s API key belongs to
- remove or lower the last administrator with Full or Enterprise organization access
- assign a network, tag, or SAML role. Meraki grants these for specific networks or tags, so assign them in the Meraki dashboard.
- lower an administrator’s organization access when you add a lower role
- add or remove a role for an administrator who has switch-port network access (Switch port or Switch port manager). Meraki’s API doesn’t return those privileges’ port tags and packet-capture setting, so writing the administrator back would drop them. Change these administrators in the Meraki dashboard.
- add or remove a role for an administrator with Camera and sensor organization access, which Meraki’s API can’t set again. Change these administrators in the Meraki dashboard.
Known limitations
- SAML role holders aren’t listed. Meraki applies a SAML role when a person signs in, and doesn’t say who holds it. Oleria shows the SAML roles and what they grant, without assignments.
- Only the integration administrator’s API keys show details. Meraki lists the last four characters and creation date of the signed-in administrator’s own keys only. For every other administrator, Oleria shows that a key exists. Oleria can’t see keys’ last use, and can’t revoke them.
- Administrators can’t be disabled. Meraki has no way to suspend or lock an administrator through its API, and no sign-in or session API. Delete user removes access.
- Last password change and creation date aren’t available. Meraki doesn’t expose them.
- No groups. Meraki has no user groups.
- No sign-in log. Activity comes from the configuration change log and the API call log. Oleria doesn’t collect read-only API calls.
- Networks and devices aren’t synced. Oleria shows which networks and tags a privilege applies to, but not the networks themselves.
- Camera roles and Systems Manager roles aren’t synced.