That would be your collector egress addresses. Generally the only LM-originated access would be from the website check source addresses (documented in the support site).
I think there is some miscommunication, or maybe i don't understand fully how Logicmonitor works.
The Meraki sd-wan of the customer which i'm trying to make more secure is managed and monitored from the Cisco/Meraki dashboard.
The API calls are made from <??> to this Meraki-hosted dashboard (api.meraki.com/…..) which has continuous overview of the whole sd-wan with several 1000's of devices.
https://documentation.meraki.com/General_Administration/Other_Topics/Cisco_Meraki_Dashboard_API
API calls are not made to the individual components or networks of the sd-wan but only to this api interface of the dashboard.
