Skip to content
Find out how we support MDR.

Cisco Meraki

Log collector

Provides data from Meraki secure network devices.

This integration uses a log collector on a virtual machine (VM). The log collector receives third-party data and sends it to the Sophos Data Lake.


A VM can host integrations for multiple products, but can't host more than one integration of the same product.

The key steps are as follows:

  • Add an integration for this product. This configures an Open Virtual Appliance (OVA) file.
  • Deploy the OVA file on your ESXi server. This becomes your log collector.
  • Configure Meraki to send data to the log collector.

Add an integration

To add the integration, do as follows:

  1. Sign in to Sophos Central.
  2. Go to Threat Analysis Center and click Integrations.
  3. Click Cisco Meraki.

    If you've already set up connections to Meraki, you see them here.

  4. In Integrations, click Add integration.


    If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See My domains and IPs.

    Integration steps appears.

Configure the VM

In Integration steps you configure your VM to receive data from Meraki. You can use an existing VM, or create a new one.

To configure the VM, do as follows:

  1. Enter an integration name and description.
  2. Enter Virtual appliance name and Virtual appliance description.
  3. Select the virtual platform. (Currently we only support VMware).
  4. Specify the internet-facing network ports.

    • Select DHCP to assign the IP address automatically.


      If you select DHCP, you must reserve the IP address.

    • Select Manual to specify network settings.

    You'll need the VM's address later, when you configure Meraki to send data to it.

  5. Select a Protocol.

  6. Complete any remaining fields on the form.
  7. Click Save.

    We create the integration and it appears in your list. It might take a few minutes for the OVA file to be ready.

Deploy the VM


The OVA file is verified with Sophos Central, so it can only be used once. After it's been deployed, it can't be used again.

If you have to deploy a new VM, you must do all these steps again to link this integration to Sophos Central.

Use the OVA file to deploy the VM. To do this, do as follows:

  1. In the list of integrations, in Actions, click Download OVA.
  2. When the OVA file download finishes, deploy it on your ESXi server. An assistant guides you through the steps. See Deploy a VM for integrations.

When you've deployed the VM, the integration shows as Connected.

Configure Cisco Meraki

To configure Meraki to send data to your log collector, do as follows.

  1. Sign in to the Meraki Dashboard.
  2. Click Network-wide > Configure > General.
  3. Scroll down to Reporting and click Add a syslog server.
  4. Enter the following connection details for your log collector:

    • IP address.
    • UDP port number.
  5. Add the following roles to configure the data sent to your log collector:

    • Event logs for the services running on your devices. For example Security events, Appliance event log.
    • Flows. These are traffic flow messages that include source and destination information, and port numbers.
    • IDS Alerts. These are alerts from the intrusion detection system.
  6. In You have unsaved changes, click Save.

If the Flows role is enabled on an MX security appliance, logging for individual firewall rules can be turned on or off on the Security appliance > Configure > Firewall page, in the Logging column.

More resources

This video takes you through setting up the integration.

For more information on configuring syslog servers on Meraki devices, refer to the Cisco documentation. See Syslog Server Overview and Configuration.