Meraki Security Appliance (MX) Operations

MCP Server

• Repository: CiscoDevNet/meraki-magic-mcp-community
• Transport: stdio (Python via FastMCP) or HTTP
• Requires: MERAKI_API_KEY, MERAKI_ORG_ID

Key Capabilities

| Operation | API Method | What It Does | |-----------|-----------|--------------| | Security center | getNetworkSecurityCenter | Security overview: threat score, events, top threats | | VPN status | getNetworkVpnStatus | VPN peer connectivity status | | Firewall rules | getNetworkSecurityFirewallRules | L3 outbound firewall rules | | Update firewall | updateNetworkSecurityFirewallRules | [WRITE] Modify L3 firewall rules | | Site-to-site VPN | getNetworkSecurityVpnSiteToSite | VPN mode (hub/spoke/none), hubs, subnets | | Update VPN | updateNetworkSecurityVpnSiteToSite | [WRITE] Modify VPN configuration | | Content filtering | getNetworkSecurityContentFiltering | URL categories, blocked URLs, allowed URLs | | Update filtering | updateNetworkSecurityContentFiltering | [WRITE] Modify blocked/allowed URL lists and categories | | Security events | getNetworkSecuritySecurityEvents | IDS/IPS events, malware, C2 callbacks | | Traffic shaping | getNetworkSecurityTrafficShaping | Global bandwidth limits, per-rule shaping | | Update shaping | updateNetworkSecurityTrafficShaping | [WRITE] Modify bandwidth limits and shaping rules |

Workflow: Firewall Rule Audit

When a user asks "show me the firewall rules on the branch MX":

1. Find network: getNetworks (meraki-network-ops) for the branch network
2. Firewall rules: getNetworkSecurityFirewallRules — all L3 outbound rules
3. Analyze: check for overly permissive rules (any/any/any allow), shadowed rules, unused rules
4. Content filtering: getNetworkSecurityContentFiltering — URL category blocks
5. Security events: getNetworkSecuritySecurityEvents — recent IDS/IPS hits
6. Report: rule table with security assessment and recommendations

Workflow: VPN Connectivity Troubleshooting

When investigating "VPN tunnel to HQ is down":

1. VPN status: getNetworkVpnStatus — tunnel state for all peers
2. VPN config: getNetworkSecurityVpnSiteToSite — mode, hubs, subnets
3. Device status: getDeviceStatus (meraki-network-ops) — is the MX online?
4. Uplinks: getDeviceUplink — WAN link status (is ISP up?)
5. Security events: getNetworkSecuritySecurityEvents — VPN-related errors
6. Report: root cause analysis (ISP outage, config mismatch, peer down)

Workflow: Content Filtering Review

When auditing web content filtering:

1. Current config: getNetworkSecurityContentFiltering — blocked categories, blocked/allowed URLs
2. Security events: getNetworkSecuritySecurityEvents — users hitting blocked content
3. Compare across sites: check filtering consistency across networks
4. Recommendations: tighten categories, add specific URL blocks/allows
5. Apply: updateNetworkSecurityContentFiltering — requires ServiceNow CR

Workflow: Security Event Investigation

When responding to a security alert:

1. Security events: getNetworkSecuritySecurityEvents — IDS/IPS detections, malware, C2
2. Client details: getClientDetails (meraki-network-ops) for involved endpoints
3. Firewall rules: getNetworkSecurityFirewallRules — is the threat being blocked?
4. Content filtering: check if malicious domains are in the block list
5. Containment: updateClientPolicy to quarantine the endpoint — requires human approval
6. ServiceNow: create Security Incident
7. Report: incident summary with timeline, IOCs, containment actions

Integration with Other Skills

| Skill | How They Work Together | |-------|----------------------| | meraki-network-ops | Network/device context for MX operations | | meraki-monitoring | Live diagnostics on MX appliances | | fmc-firewall-ops | Cross-platform firewall audit: Meraki MX rules vs Cisco FTD rules | | aws-network-ops | Hybrid security: Meraki MX on-prem + AWS Network Firewall cloud | | ise-posture-audit | Meraki client policies + ISE posture for unified access control | | servicenow-change-workflow | Gate all firewall, VPN, and content filtering changes | | gait-session-tracking | Record all security investigations and rule changes |

Important Rules

• Firewall rule changes affect all traffic — modifying L3 rules can break connectivity for the entire site
• VPN configuration changes can disrupt inter-site connectivity — always verify tunnel state after changes
• Content filtering affects user experience — coordinate with help desk before blocking new categories
• Security events require investigation — IDS/IPS alerts should be triaged, not ignored
• ServiceNow CR required for all firewall rule, VPN, content filtering, and traffic shaping changes
• Record in GAIT — log all security appliance audits, investigations, and changes

Environment Variables

• MERAKI_API_KEY — Meraki Dashboard API key
• MERAKI_ORG_ID — Meraki organization ID