Integrate Cisco Meraki (Log collector)
You must have the Firewall integrations license pack to use this feature.
Note
An API-based integration of Cisco Meraki is also available. See Integrate Cisco Meraki (API).
You can integrate Cisco Meraki with Sophos Central so that it sends data to Sophos for analysis.
This integration uses a log collector hosted on a virtual machine (VM). Together they're called an integration appliance. The appliance receives third-party data and sends it to the Sophos Data Lake.
This page describes integration using an appliance on ESXi or Hyper-V. If you want to integrate using an appliance on AWS, see Integrations on AWS.
Key steps
The key steps in an integration are as follows:
- Add an integration for this product. In this step, you create an image of your appliance.
- Download and deploy the image on your VM. This becomes your appliance.
- Configure Meraki to send data to the appliance.
Requirements
Appliances have system and network access requirements. To check that you meet them, see Appliance requirements.
Add an integration
To add the integration, do as follows:
- In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.
-
Click Cisco Meraki.
The Cisco Meraki page opens. You can add integrations here and see a list of any you've already added.
-
In Data Ingest (Security Alerts), click Add Configuration.
Note
If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.
Integration setup steps appears.
Configure the appliance
In Integration setup steps, you can configure a new appliance or use an existing one.
We assume here that you configure a new appliance. To do this, create an image as follows:
- Enter an integration name and description.
- Click Create new appliance.
- Enter a name and description for the appliance.
- Select the virtual platform. Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later.
-
Specify the IP settings for the Internet-facing network ports. This sets up the management interface for the appliance.
-
Select DHCP to assign the IP address automatically.
Note
If you select DHCP, you must reserve the IP address.
-
Select Manual to specify network settings.
-
-
Select the Syslog IP version and enter the Syslog IP address.
You'll need this syslog IP address later, when you configure Meraki to send data to your appliance.
-
Select a Protocol.
You must use the same protocol when you configure Meraki to send data to your appliance.
-
Click Save.
We create the integration and it appears in your list.
In the integration details, you can see the port number for the appliance. You'll need this later when you configure Meraki to send data to it.
It might take a few minutes for the appliance image to be ready.
Deploy the appliance
Restriction
If you're using ESXi, the OVA file is verified with Sophos Central, so it can only be used once. If you have to deploy another VM, you must create an OVA file again in Sophos Central.
Use the image to deploy the appliance as follows:
- In the list of integrations, in Actions, click the download action for your platform, for example Download OVA for ESXi.
- When the image download finishes, deploy it on your VM. See Deploy appliances.
Configure Cisco Meraki
Now configure Cisco Meraki to send data to your appliance.
Note
You can configure multiple instances of Cisco Meraki to send data to Sophos via the same appliance. After you finish integration, repeat the steps in this section for your other instances of Cisco Meraki. You don't need to repeat the steps in Sophos Central.
Configure Cisco Meraki as follows:
- Sign in to the Meraki Dashboard.
- Click Network-wide > Configure > General.
- Scroll down to Reporting and click Add a syslog server.
-
Enter the following connection details for your appliance:
- IP address. This is the syslog IP address you set in Sophos Central.
-
Port number.
You must enter the same settings you entered in Sophos Central when you added the integration.
-
Add the following roles to configure the data sent to your appliance:
- Event logs for the services running on your devices. For example
Security events
,Appliance event log
. Flows
. These are traffic flow messages that include source and destination information, and port numbers.IDS Alerts
. These are alerts from the intrusion detection system.
- Event logs for the services running on your devices. For example
-
In You have unsaved changes, click Save.
If the Flows role is enabled on an MX security appliance, logging for individual firewall rules can be turned on or off on the Security appliance > Configure > Firewall page, in the Logging column.
More resources
This video takes you through setting up the integration.
For more information on configuring syslog servers on Meraki devices, refer to the Cisco documentation. See Syslog Server Overview and Configuration.