Skip to content

Cloud-managed networks

Monitor Cisco Meraki, Ubiquiti UniFi, Fortinet FortiGate and Aruba Central devices through the vendors' own APIs when SNMP isn't available.

6 min read · For admins and msps

Where a network is managed from a vendor's dashboard, SNMP is often not available: Meraki access points and switches, UniFi gear behind a Cloud Gateway, branches run from Aruba Central. Monitaria reads those devices through the vendor's own API instead and monitors them next to everything else, with the same sites, alerts and reports. It only reads: nothing is changed in the vendor's dashboard.

  • Cisco Meraki: every device's status; for MX and Z appliances, uplink status, loss and latency, site-to-site VPN peers and the performance score; client counts.
  • Ubiquiti UniFi, read from the console itself: device state, uptime, CPU and memory, and clients; gateway WAN links with a local account.
  • Fortinet FortiGate: CPU, memory, sessions, interfaces, SD-WAN health checks (latency, jitter, loss and SLA), IPsec tunnels, and the FortiAPs and FortiSwitches it manages.
  • Aruba Central: access points, switches and gateways with their status, CPU, memory, clients and uptime; gateway uplinks.

1. Create a read-only key in the vendor's dashboard

  • Meraki: in the Meraki dashboard, open My profile › API access and generate an API key, signed in as a read-only organization administrator. Turn on API access under Organization › Settings.
  • UniFi: in UniFi Network 9 or later, open Settings › Control Plane › Integrations and create an API key. For an older self-hosted controller, create a local account with view-only access, not a UI.com account with two-factor sign-in.
  • FortiGate: open System › Administrators › Create New › REST API Admin, with a read-only profile and the collector's address as a trusted host. Copy the token; it is shown once.
  • Aruba Central: open Organization › Platform Integration › REST API, note your region's API gateway address, and create an API client and a token for it.

2. Add the connection

  1. On the collector, open Settings › Cloud-managed devices and choose Turn on cloud polling. Nothing is sent to a vendor until you do.
  2. Choose + Add a connection, pick the Vendor and give it a Name, for example Riverbend Meraki.
  3. Fill in the address and the key, token or account the form asks for. For Meraki, keep the API address unless your dashboard is in another region. For a UniFi console or FortiGate with a self-signed certificate, set Certificate to Don't check it (self-signed certificate).
  4. Choose Save and test. The answer says what the key can see, for example: Connected. The key sees 1 organization: Riverbend Logistics.

3. Discover and add devices

  1. Choose Connect and discover on the connection. Monitaria lists every device the key can see, by network (Meraki), site (UniFi and Aruba Central) or FortiGate.
  2. Give each network or site its Monitaria site, such as Warehouse. Monitaria suggests one from the devices you already monitor there or from the name; leave it empty for the collector's own site.
  3. Tick the devices to monitor, and under Watch, what to watch on each. The usual choices are ticked already: status everywhere, uplinks and VPN peers on Meraki appliances, and CPU, memory, sessions, SD-WAN and tunnels on a FortiGate.
  4. Choose Add ticked devices. The first results arrive within a minute.

A device you already monitor by ping or SNMP, with the same LAN address or name, is offered as the same device: its cloud sensors are added to it rather than creating a second one. Untick add to … on that row to keep them apart. New devices carry their site in their name, such as Warehouse · RB-WH-MX01, so site filters, scopes, reports and the map work as for any device.

Day to day

  • A device's status sensor is Down when the vendor says it is offline or dormant, Warning when Meraki says it is alerting or UniFi is updating or adopting it, and Up when it is online.
  • Uplink latency warns above 150 ms, loss above 5% (Down above 50%), and CPU and memory above 90%. Change the limits by editing the sensor in Devices › Sensors.
  • The device dialog has Cloud details: status in the vendor's dashboard, addresses, firmware, clients, CPU and memory, uplinks, SD-WAN health checks and VPN tunnels, an Open in … link to the vendor's dashboard, and Poll now for operators and admins.
  • Model, serial number, firmware, MAC and LAN address go into the device details, so search finds a device by its serial number.

Tip: One alert, not hundreds. When a vendor's API can't be read, device sensors keep their last answer for up to three poll intervals and then show No data, which doesn't alert. The connection's own API connection sensor, on a device named after it (for example Riverbend Meraki API), reports the failure once.

Good to know

  • Keys, tokens and passwords are stored on the collector only, never shown again and never sent to the hub. Calls go only to the addresses you entered, and redirects are followed only to the same host, so a key is never sent elsewhere.
  • Each connection is polled once per interval (Poll every): every 5 minutes for Meraki and Aruba Central, 2 minutes for UniFi and 1 minute for FortiGate by default. All its sensors share that one answer, and the vendors' rate limits are respected.
  • Aruba Central allows 5,000 API calls a day by default, and the connection shows how many are left today. Monitaria renews the token itself; paste a new refresh token only if the connection stops working.
  • Meraki client counts and the performance score cover up to 100 devices per organization per poll. A key that sees many organizations reads them all every time; if polls run out of time, split it into connections with Only these organizations (IDs, optional).
  • With an API key, UniFi CPU and memory need UniFi Network 9 or later, and WAN links are only reported with a local account.
  • Connect to each FortiGate directly; Fortinet's central management tools aren't used. Aruba Central mobility conductors and EdgeConnect SD-WAN aren't covered.
  • No direct internet on the collector? Under Proxy for collectors without direct internet access, enter an HTTP proxy that allows CONNECT, without a sign-in. Consoles on your own network are still reached directly.
  • Each connection's API connection sensor sits on its own device, which counts as one device in the license. A FortiGate connection doesn't add one.