topic Re: Block device from API in Network Platform API

Block device from API

Bails1664 — Mon, 08 Jul 2019 10:39:08 GMT

Hi All,

I'm creating an App that can be rolled out to our Service Desk and Security Team to allow them to manage users devices etc. on our networks from the API.

One of the bits i'm looking to do is block a device from the network if we see any malicious activity etc. being conducted on that device. However, i'm unable to find what the policy ID maybe for the in built Meraki Blocked policy.

I've checked a device that is blocked on a network from the API and it says normal, even though on the dashboard it is actually blocked with a custom message being presented to it. :S

Any one had this issue before and can maybe shed some light on this?

Thank you!

Cheers

Re: Block device from API

DexterLabora — Mon, 08 Jul 2019 11:24:22 GMT

You might be looking at per-SSID policies. The Dashboard API can set a client device to a Group Policy but not specific to an SSID. If you just need to block a user, then set a Group Policy to the device with strict limits or just set it to "Blocked"

Related API endpoints

You can find the available Group Policies for a network and their respective ID
https://developer.cisco.com/meraki/api/#/rest/api-endpoints/group-policies/get-network-group-policies

To assign a policy to a new or existing client
https://developer.cisco.com/meraki/api/#/rest/api-endpoints/clients/provision-network-clients

To assign a policy to an existing client only

https://developer.cisco.com/meraki/api/#/rest/api-endpoints/clients/update-network-client-policy

important params

devicePolicy	String The policy to apply to the specified client. Can be 'Whitelisted', 'Blocked', 'Normal' or 'Group policy'. Required.
groupPolicyId	String The ID of the desired group policy to apply to the client. Required if 'devicePolicy' is set to "Group policy". Otherwise this is ignored.

Example using the provision endpoint (works for all clients)

POST /networks/{networkId}/clients/provision

Body: Provision as Blocked

{
"mac": "00:11:22:33:44:55",
"name": "Miles's phone",
"devicePolicy": "Blocked"
}

Body: Provision as Group Policy

{
"mac": "00:11:22:33:44:55",
"name": "Miles's phone",
"devicePolicy": "Group policy",
"groupPolicyId": "99"
}

Hope this helps!

Re: Block device from API

Bails1664 — Mon, 08 Jul 2019 11:39:07 GMT

Thats the fella!

Thank you!

Re: Block device from API

Bails1664 — Wed, 10 Jul 2019 09:13:55 GMT

Actually, is there a way to add in the blocked note when sending the API POST?

Re: Block device from API

DillonWhite9048 — Thu, 15 Aug 2019 01:00:37 GMT

@Bails1664 Do you have a GitHub repo I can reference? This sounds awesome!!

Re: Block device from API

claybarber — Wed, 11 Sep 2019 07:06:15 GMT

@DexterLabora wrote:
You might be looking at per-SSID policies. The Dashboard API can set a client device to a Group Policy but not specific to an SSID. If you just need to block a user, then set a Group Policy to the device with strict limits or just set it to "Blocked"
Related API endpoints
You can find the available Group Policies for a network and their respective ID
https://developer.cisco.com/meraki/api/#/rest/api-endpoints/group-policies/get-network-group-policies
To assign a policy to a new or existing client
https://developer.cisco.com/meraki/api/#/rest/api-endpoints/clients/happy wheels provision-network-clients
To assign a policy to an existing client only
https://developer.cisco.com/meraki/api/#/rest/api-endpoints/clients/update-network-client-policy
important params
devicePolicy
String
The policy to apply to the specified client. Can be 'Whitelisted', 'Blocked', 'Normal' or 'Group policy'. Required.
groupPolicyId
String
The ID of the desired group policy to apply to the client. Required if 'devicePolicy' is set to "Group policy". Otherwise this is ignored.
Example using the provision endpoint (works for all clients)
POST /networks/{networkId}/clients/provision
Body: Provision as Blocked
{
"mac": "00:11:22:33:44:55",
"name": "Miles's phone",
"devicePolicy": "Blocked"
}
Body: Provision as Group Policy
{
"mac": "00:11:22:33:44:55",
"name": "Miles's phone",
"devicePolicy": "Group policy",
"groupPolicyId": "99"
}
Hope this helps!

This worked great. I've been digging into this for over an hour! Thanks.

Re: Block device from API

MollyEskam — Thu, 16 Jul 2020 13:25:47 GMT

finally something that actually worked, thanks to you man @claybarber funny work quotes

Re: Block device from API

noemijmorgan — Tue, 10 Nov 2020 08:00:57 GMT

Really great answers to your question, we were informed, thank you. @noemi

Re: Block device from API

Jackmash2 — Tue, 18 Jan 2022 14:45:30 GMT

DexterLaBora actually worked, thanks to you man @DexterLaBora

Re: Block device from API

IsiahAtkins — Fri, 20 May 2022 12:14:47 GMT

Thanks for it. This endpoint allows you to create and manage block devices. @dotsnel