Securing Enterprise Networks with Cisco Meraki

Ryan Chaney, the lead author on this book, started his Cisco journey in his early 20s, completing his first CCIE (R+S) at the age of 25, before completing his second CCIE (Security) just 2 years later. Before joining Cisco, he worked in a variety of networking roles across the world, including time as a network architect for Visa in London. Ryan spent the first 10 years of his 15 years at Cisco as a systems engineer, educating customers, designing, and building IT solutions. His first experience with Meraki came while volunteering at the Royal Far West Centre for Country Kids, where he designed and built the network for their new headquarters in Manly, Sydney. At the time, no books had been published on Meraki. This experience and wanting to share his learnings with fellow network engineers, like you, became the inspiration for this book. Ryan lives in Bondi Beach, Australia.Simerjit Singh, the contributing author on this book, is a seasoned Meraki solutions engineer with more than 17 years’ tenure at Cisco. From his wealth of experience working with customers in the Enterprise and SMB segments, Simerjit contributes his vast experience of the diverse needs of these customers and relevant Meraki solutions. Simerjit holds highly regarded qualifications in networking and security, including a bachelor of technology in computer science, as well as both CCIE and ISC2 Certified Cloud Security Professional (CCSP) certifications. Committed to continuous learning and professional growth, Simerjit is currently pursuing a master’s degree in cybersecurity from the Royal Melbourne Institute (RMIT). Simerjit lives in Melbourne with his mother, wife, and two sons.

• Introduction xixChapter 1 Meraki’s History 1Roofnet 1Start-up 3Acquisition by Cisco 4The Meraki Museum 7Summary 7Notes 8Further Reading 8Chapter 2 Security Frameworks and Industry Best Practices 11The Cybersecurity Imperative 11Adopting Industry Best Practice 13Industry Standards 13Security as a Team Sport 15Key Themes Across Security Standards 15Continuous Improvement 16Comparison of Common Security Standards and Framework Requirements 16Summary 17Further Reading 17Chapter 3 Meraki Dashboard and Trust 19Meraki Dashboard 19Out-of-Band Management 20Meraki Dashboard Hierarchy 20Trust 22Privacy 23Data Retention Policy 24Data Security 24Data Center Resiliency 26Compliance with Information Standards, Regulations, and Industry Best Practices 26Hardware Trust Model 28Supply Chain Security 28Secure Boot 29Secure Device Onboarding 29Software Trust Model 30Cloud Shared Responsibility Model 32Summary 32Notes 33Further Reading 33Chapter 4 Role-Based Access Control (RBAC) 37Meraki Dashboard’s Administration Hierarchy 38Administrator Access Levels for Dashboard Organizations and Networks 38Assigning Permissions Using Network Tags 40Port-Level Permissions 42Role-Based Access Control for Camera-Only Administrators 49Role-Based Access Control for Sensor-Only Administrators 52Role-Based Access Control Using Systems Manager Limited Access Roles 53Summary 60Further Reading 60Chapter 5 Securing Administrator Access to Meraki Dashboard 61Securing Administrative Access to Meraki Dashboard 61Meraki Dashboard Local Administrator Access Controls 62Creating Meraki Dashboard Local Administrator Accounts 62Password Age 68Password Reuse 70Password Complexity 72Account Lockout After Invalid Login Attempts 74Idle Timeout 77IP Whitelisting 79Multifactor Authentication (MFA) 81Configuring SAML Single Sign-On (SSO) for Dashboard 98The Use Cases for Single Sign-On 98SAML Single Sign-On Login Flow 99SAML Single Sign-On Design 99Configuring Meraki SAML SSO Using Cisco Duo and Microsoft Entra ID 102Prerequisites 103Adding SP-Initiated SAML SSO 146Verifying SAML SSO Access to Meraki Dashboard with Cisco Duo and Microsoft Entra (Including Duo Inline Enrollment) 148Implementing Additional Access Controls Using Cisco Duo and Microsoft Entra ID 159Password Policies 159Password Age 160Password Reuse 160Password Complexity 160Account Lockout After Invalid Login Attempts 160Security Policies 161IP Whitelisting 161Restricting Concurrent Logins 162Automatically Disabling Inactive Accounts 162Automatically Disabling Accounts After a Predetermined Period of Time Unless Revalidated 163Automatically Disabling Temporary Accounts 165Summary 165Further Reading 166Chapter 6 Security Operations 169Centralized Logging Capabilities 170Login Attempts 172Change Log 172Event Log 174Creating API Keys 175Finding Your Organization ID 180Exporting Logs 180Exporting Logs to Splunk 181Syslog 190Exporting Flow Data 192NetFlow, IPFIX, and Encrypted Traffic Analytics 193Syslog Flows 196Compliance Reporting with AlgoSec 197Prerequisites 197Integrating AlgoSec with Meraki Dashboard for Compliance Reporting 197Monitoring and Incident Response 208Security Center 209Alerts 210External Alerting 213Webhooks 213SNMP Traps 224External Polling 227Meraki Dashboard API 228SNMP 234Automated Incident Response with ServiceNow 240Security Management 246Inventory 247Hardware 247Software 248Configuration 249Client Devices 251Topology 252Summary 253Notes 253Further Reading 254Chapter 7 User Authentication 257Configuring Meraki Cloud Authentication 260Configuring SAML with Cisco Duo and Microsoft Entra 264Confirming Functionality of SAML Configuration Using AnyConnect VPN 273Configuring RADIUS Using Cisco ISE, Cisco Duo, and Microsoft Active Directory 276Prerequisites 277Configuring Users and Groups in Microsoft Active Directory 280Configuring Group(s) in Active Directory 280Configuring User(s) in Active Directory 281Configuring Cisco Identity Services Engine (ISE) 285Adding Network Access Devices (NADs) to Cisco ISE 285RADIUS Configuration for Wired and Wireless 802.1X 295Configuring Organization-Wide RADIUS in Meraki Dashboard 295Creating a Policy Set for Wired and Wireless 802.1X in Cisco ISE 300Configuring an Authentication Policy in Cisco ISE 304Configuring an Authorization Policy in Cisco ISE 305Confirming Functionality of RADIUS Authentication on Wireless 308Confirming Functionality of RADIUS Authentication for Wired 802.1X 312RADIUS Configuration for AnyConnect VPN with Duo MFA 315Configuring Duo Authentication Proxy 317Configuring AD Sync in Duo Admin Panel 319Encrypting Passwords in Duo Authentication Proxy 330Enrolling Users with Cisco Duo 330Configuring Cisco Duo as an External RADIUS Server in Cisco ISE 335Creating the Policy Set for AnyConnect VPN in Cisco ISE 337Meraki Dashboard Using Active Directory Authentication for AnyConnect VPN 342Prerequisites 342Configuring Active Directory Authentication 346Confirming Functionality of Active Directory Configuration 348Summary 350Further Reading 350Chapter 8 Wired and Wireless LAN Security 353Access Control Lists and Firewalls 354Access Control Lists (Meraki MS) 354Meraki MR Firewall 357Layer 3 Firewall 358Layer 7 Firewall (Including NBAR Content Filtering) 360Ethernet Port Security Features (Meraki MS) 362MAC Allow Lists 362Sticky MAC Allow Lists 366Port Isolation 368SecurePort 370Dynamic ARP Inspection 373Rogue DHCP Server Detection (Meraki MS) 376Hardening Meraki MR and MS Devices (Local Status Page) 379Zero Trust (Wired and Wireless Dot1x) 382802.1X with Protected EAP (PEAP) on Wired and Wireless Networks 383Configuring Wireless 802.1X with Protected EAP (PEAP) 383Configuring Wired 802.1X with Protected EAP (PEAP) 388Configuring 802.1X Using EAP-TLS on Wired and Wireless Networks 394Configuring the Identity Source Sequence in Cisco ISE 396Configuring the Policy Set in Cisco ISE 398Generating a Client Certificate Using Cisco ISE 404Exporting the Cisco ISE Certificate Authority Certificate 408Testing Wireless 802.1X with EAP-TLS 411Testing Wired 802.1X with EAP-TLS 413Sentry-Based 802.1X with EAP-TLS on Wired and Wireless Networks 416Sentry Wi-Fi 416Sentry LAN 419Configuring MAC Authentication Bypass (MAB) 426Configuring an Endpoint Identity Group in Cisco ISE 426Creating a Policy Set in Cisco ISE for MAC Authentication Bypass 430Configuring Wireless MAC Authentication Bypass in Meraki Dashboard 436Configuring Wired MAC Authentication Bypass in Meraki Dashboard 439Group Policies 443Creating a Group Policy 443Applying Group Policies 446Applying Group Policies to a Client Manually 446Applying Group Policies Using a Sentry Policy 449Applying Group Policies Using RADIUS Attributes and Cisco ISE 452Adaptive Policy and Security Group Tags (SGTs) 459Enabling Adaptive Policy 460Configuring Security Group Tag Propagation 461Enabling SGT Propagation on Meraki MS Switches 461Enabling SGT Propagation on Meraki MX Security Appliances 463Creating Security Group Tags 466Creating Adaptive Policy Groups in Meraki Dashboard 466Creating Security Group Tags in Cisco ISE 469Assigning Security Group Tags 472Statically Assigning Security Group Tags to SSIDs 472Statically Assigning Security Group Tags to Switch Ports 473Assigning Security Group Tags Using Cisco ISE 475Creating an Adaptive Policy 476Testing Adaptive Policy 479Client Laptop 480POS Terminal 480POS Server 483Testing 483Wireless Security 487Summary 489Notes 489Further Reading 490Chapter 9 Meraki MX and WAN Security 493Meraki MX Introduction 493Site-to-Site VPN (Auto VPN) 494Site-to-Site VPN with Non-Meraki Devices 499ThousandEyes 505Remote-Access VPN 507Client VPN 508Sentry VPN 514AnyConnect VPN 519Confirming Functionality of AnyConnect VPN Access 524Restricting Client VPN Traffic 529Virtual MX (vMX) 531Sizing a Virtual MX 531Understanding Feature Parity with Meraki MX 532Deploying Virtual MX in Amazon Web Services (AWS) 533Creating a New vMX Network in Meraki Dashboard 533Configuring the Default VPC in AWS 536Deploying vMX in AWS 541Viewing the New vMX in Meraki Dashboard 552Summary 553Notes 554Further Reading 554Chapter 10 Securing User Traffic 557Comparison of Meraki’s Native Security Capabilities and Cisco Secure Connect 558Native Meraki MX Capabilities 559Layer 3 Firewall 559Layer 7 Firewall 563Geo-IP Firewall 566Enabling Detailed Traffic Analysis 566Configuring Geo-IP Firewall 567Content Filtering 570URL Filtering 570Category Blocking with Cisco Talos Intelligence 572Threat Protection 576Advanced Malware Protection (AMP) 576Intrusion Detection and Prevention (IDS/IPS) 580Cisco Secure Connect 582Setting Up Secure Connect 584Initial Setup and Integration with Cisco Umbrella 586Adding Meraki SD-WAN Sites to Secure Connect 597Configuring DHCP to Assign Umbrella’s DNS Servers 601Installing Umbrella’s Root CA Certificate on Clients 602Enabling Intelligent Proxy and SSL Decryption in Cisco Umbrella 603DNS Security 606Cloud Firewall 608Layer 3/4 Firewall 608Application Blocking 614Intrusion Detection and Prevention (IDS/IPS) 620Secure Web Gateway (SWG) 622URL Filtering (Destination Lists) 622Content Filtering (Content Categories) 631File Inspection and Advanced Sandboxing 636File Type Control 645Cloud Access Security Broker (CASB) 649Data Loss Prevention (DLP) 657Summary 667Notes 667Further Reading 667Chapter 11 Securing End-User Devices 671Integrating with Vender Mobile Device Enrollment Programs 672Enrolling Devices with Systems Manager 676Checking Compliance with Security Policy (Systems Manager Policies) 677Creating a Systems Manager Profile 681Configuring End-User Devices for Network Connectivity 684Certificate Settings Payload 684Wi-Fi Settings Payload 686VPN Settings Payload 693Applying Security Policy to Devices (Systems Manager Profiles) 697Passcode Policy (Includes Screen Lock) 697Disk Encryption 700Preventing the Installation of Banned Apps 700Deploying Applications to Devices 704Pushing Operating System Updates to Devices 711Summary 712Notes 713Further Reading 713Chapter 12 Physical Security 715Meraki MV Security Cameras 716Privacy 716Monitoring Video 717Motion Alerts 719Motion Search 721Sensor Sight (Meraki Smart Camera and Sensor Integration) 724Summary 727Further Reading 727Appendix A Comparison of Common Security Standards and Framework Requirements 729 9780138298180 TOC 9/12/2024