Configuring Cisco Meraki Firewall Connectors

You can connect Stellar Cyber to firewalls so that you can quickly and easily implement firewall rules on those firewalls from within Stellar Cyber, while you are threat hunting. You can configure firewall actions or manually trigger a firewall action from the event display. With a Cisco Meraki firewall connector configured, you can create a Stellar Cyber rule to automatically or manually block on that firewall.

Connector Overview: Cisco Meraki Firewall

Capabilities

  • Collect: No

  • Respond: Yes

  • Native Alerts Mapped: No

  • Runs on: DP

  • Interval: N/A

Collected Data

N/A

Domain

https://api.meraki.com/api/v1

Response Actions

Action

Required Fields

Block IP

srcip or dstip

Third Party Native Alert Integration Details

N/A

Required Credentials

  • API Key, Organization Name, Network or Template Name

               Let us know if you find the above overview useful.

Adding a Cisco Meraki Firewall Connector

To add a Cisco Meraki firewall connector:

  1. Enable API access
  2. Add the connector in Stellar Cyber
  3. Test the connector

Enabling API Access

Other than having your firewall rules enabled, you will need to obtain the following three things from your Cisco Meraki account: 

  • API Key

  • Organization Name

  • Network Name

To obtain the information:

  1. Access the Cisco Meraki Dashboard as a user with administrative privileges.

  2. Select your Organization from the navigation menu on the left side of the dashboard. Then select Organization>Settings, below that.

  3. When the right pane refreshes to display the Settings, make note of Organization Name located at the top of the pane.

  4. Next, scroll down the page to API Access and ensure the corresponding checkbox is enabled.

  5. From the top right of the page, click your user name and then select My Profile.

  6. When your account details display, scroll to the API Access block and click, the button to Generate a new API key.

  7. Make note of that key as you will not be able to view it later, then check the note box and click Done.

  8. Now, use the navigation pane to display your organization's networks. You will need either the Name or Template Name of each network for which you want to create a connector:

    • If the network is NOT bound to any template, use the Network Name when you add the connector in Stellar Cyber.

    • If the network IS bound to a template, use the Template Name when you add the connector in Stellar Cyber.

    As described below, using the correct type of name for your configuration ensures that Block IP and Revert actions work correctly.

    If you want to use more than one network, you can create multiple connector instances with one for each network or template name.

After you obtain this information, you can proceed to configuring the connector in Stellar Cyber. Based on the examples above, you should now have:

  • API Key: 5b2efd9fee131d2b9810caf5423f1c17a61751be

  • Organization Name: Test Lab

  • Network Name: Stellar-Meraki-MX64

Adding the Connector in Stellar Cyber

To add a new Meraki firewall connector in Stellar Cyber:

  1. Log in to Stellar Cyber.

  2. Click System | Integration | Connectors. The Connector Overview appears.

  3. Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

  4. Choose Firewall from the Category drop-down.

  5. Choose Cisco Meraki Firewall from the Type drop-down.

  6. For this connector, the supported Function is Respond, which is enabled already.

  7. Enter a Name.

    This field does not accept multibyte characters.

  8. Choose a Tenant Name. The Interflow records created by this connector include this tenant name.

  9. Choose the device on which to run the connector.

    • Certain connectors can be run on either a Sensor or a Data Processor. The available devices are displayed in the Run On menu. If you want to associate your collector with a sensor, you must have configured that sensor prior to configuring the connector or you will not be able to select it during initial configuration. If you select Data Processor, you will need to associate the connector with a Data Analyzer profile as a separate step. That step is not required for a sensor, which is configured with only one possible profile.

    • If the device you're connecting to is on premises, we recommend you run on the local sensor. If you're connecting to a cloud service, we recommend you run on the DP.

  10. Click Next. The Configuration tab appears.

  11. Enter the API Key to access the firewall.

  12. Enter the Organization Name you noted earlier.

  13. Enter the Network Name or Network Template Name you noted earlier.

    You can specify either a network name or a network template name. Keep in mind that if the network is bound to a template, you must use the template name in order for the Block IP and Revert actions to work correctly. The Test button still works correctly if you use the network name for a network that is bound to a template, but the actions only work correctly if you use the template name. This is summarized in the table below.

    Meraki Firewall Name Configuration

    Added in Stellar Cyber Using...

    Supported Operations
    Network Name, no template Network Name Test button, Block IP, and Revert actions all work correctly.
    Network Name, bound to template Template Name Test button, Block IP, and Revert actions all work correctly.
    Network Name, bound to template Network Name Test button works but Block IP does not work correctly. Fails with error message similar to the following: "{"errors":["Cannot override L3 firewall rules on a network bound to a template - the firewall rules are inherited from the template"]}."

  14. Click Next. The final confirmation tab appears.

  15. Click Submit.

The new firewall connector is immediately active.

Testing the Connector

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates only the authentication / connectivity; it does not validate data flow).

  1. Click System | Integrations | Connectors. The Connector Overview appears.

  2. Locate the connector that you added, or modified, or that you want to test.

  3. Click Test at the right side of that row. The test runs immediately.

    Note that you may run only one test at a time.

Stellar Cyber conducts a basic connectivity test for the connector and reports a success or failure result. A successful test indicates that you entered all of the connector information correctly.

To aid troubleshooting your connector, the dialog remains open until you explicitly close it by using the X button. If the test fails, you can select the  button from the same row to review and correct issues.

The connector status is updated every five (5) minutes. A successful test clears the connector status, but if issues persist, the status reverts to failed after a minute.

Repeat the test as needed.

ClosedDisplay sample messages...

Success !

Failure with summary of issue:

Show More example detail: