Setting up Cisco Meraki Collector

This setup is for the XDR Collector only. If you are using a physical or virtual sensor, refer to Integrating Cisco Meraki.

Enable the Cisco Meraki Collector integration
Install the XDR Collector
Configure the Firewall
Open the port on the XDR Collector Host

Enable Cisco Meraki

In Barracuda XDR Dashboard, navigate to Administration > Integrations.
On the Cisco Meraki card, click Setup.
Select the Enabled check box.
Click Save.

Install the XDR Collector

When collecting logs from one or more integrated data sources, always set up the XDR Collector on a dedicated host server. Don't use an existing server because the amount of data produced by logs can impact critical infrastructure.

If you haven't already set up the XDR Collector, do one of the following:
- Setting up the XDR Collector for Windows
- Setting up the XDR Collector for Linux

Configure the Firewall

Log in to your Meraki dashboard.
Select the relevant device.
Go to Alerts & Administration.
Scroll down to the Logging section and click Add a syslog server.
Enter the IP address of your Appliance Sensor.
Specify port number 9221.

Remember to define the appropriate roles for the server. Supported roles include Airmarshal, Events, Flows, IDS Alerts, IP flows, Security, and URLs.

The Cisco Meraki documentation is available here.

Open the Port on the XDR Collector Host

Ensure incoming traffic is allowed on UDP port 9221.

Linux

sudo ufw allow 9221/udp

Windows

netsh advfirewall firewall add rule name=“Meraki Firewall Events” dir=in action=allow protocol=UDP localport=9221