New MX feature: MultiWAN Backup Uplink (third/backup WAN)

Ryan_Miles
Meraki Employee
Meraki Employee

New MX feature: MultiWAN Backup Uplink (third/backup WAN)

As promised at the launch of MX18.2 support for a third/backup WAN port is now available on supported models (MX75, 85, 95, and 105) when running MX18.208 firmware.

 

Documentation: https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink

 

Be aware that when enabling this feature you will need to use SFP WAN ports (which you might not be doing today). So, make sure to review the above documentation for WAN port behavior on the MX75 and 85-105.

 

I'm also including my own slide deck covering the feature with a WAN failover animation slide and some examples of loss during WAN failures for Internet and VPN bound traffic.

 

https://docs.google.com/presentation/d/19zAJMSewQYFQJILjWsGz9t8zoQkOeYoNRSM9kSYf5ns/edit?usp=sharing

 

In my testing I was shutting down the switch port connected to the MX WAN port. As always, failover times can vary based on the nature of the failure (hard down vs. upstream failure). And failback behavior will depend on the setting you have configured (Graceful vs. Immediate). 

 

Be aware, when you enable (or disable) the backup WAN feature it will do a soft reset on the MX and cause a brief outage, similar to what you'd see when enabling a WAN 2 port on a MX67. So, do this in a maintenance window or whenever you can incur a few minutes of disruption on the MX.

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
24 Replies 24
alemabrahao
Kind of a big deal
Kind of a big deal

Great to know, too bad it's restricted to specific models, but better than nothing. 🙂

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
cmr
Kind of a big deal
Kind of a big deal

Excellent! It is a shame that the MX100 doesn't support 18.2 as it has many WAN ports... 

GreenMan
Meraki Employee
Meraki Employee

To be accurate:   MX100 has many LAN ports     While physically the ports look the same, architecturally LAN ports and WAN ports are very different.   I know that's a little hard to square with the fact that some MXs have (a) hybrid port that can be switched from one to the other - but that's very much a specific exception.

Unfortunately MX100 and some other older models don't really have the 'oomph' to add the new capabilities available from 18.2 onwards.  (details here:  https://documentation.meraki.com/General_Administration/Firmware_Upgrades/Product_Firmware_Version_R...)

cmr
Kind of a big deal
Kind of a big deal

@GreenMan I may be wrong, but I believe the MX100 can physically have many WAN ports, but this was never done:

 

cmr_0-1708699896645.png

Ports 2-11 should all be WAN capable!

RaphaelL
Kind of a big deal
Kind of a big deal

I don't want to get side tracked here , but in your slides you mentionned a part about Insight and WAN3 will only work if WAN1-2 are down.  On MX68CW , WAN3 is showing since MX16 ( since the addition of Cellular Active uplink ) However , even if you don't have Cellulare active uplink enabled WAN3 will still show up as down. Will this ever be fixed ?

Ryan_Miles
Meraki Employee
Meraki Employee

I see a logged bug on this. No idea when it will be resolved though.

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
ShawnHu
Meraki Employee
Meraki Employee

And we have the demo environment on this feature for Cisco and partners. Check this post.

jbright
A model citizen

I have implemented this on my MX85 and it is working fine, now.

I inserted the Copper SFP in Ports #1 and #2, rebooted the firewall and
moved the ethernet connections over to the SFP ports. Once I verified

those were working again, then I switched over to Multi-WAN and connected

my MG51 to Port #4. The MX was able to pull an IPV4 address from the MG51 NAT Pool.

I tried disconnected the ethernet cables from both SFP modules and the firewall

did not switch over to WAN3. The firewall completely dropped off the internet and

the dashboard. I connected both internet ethernet cables back to the

MX and once those came back up and the MX was visible on the dashboard, I rebooted the MX again.

Once the MX came up, I tried again to unplug both internet ethernet cables and this

time the firewall did switch over to WAN3. It also sent an email alert stating that it

had switched over to the cellular port. In this case that is correct, but I think the

alert should say WAN3 and not the cellular port.

I connected the two internet ethernet ports back to the MX and it immediately

started using them again. So a second reboot of the firewall after switching to

Multi-WAN seems necessary for the failover to WAN3 to work correctly.

 

One bug that I see is that even though IPV6 is enabled on WAN3,

the MX is not pulling an IPV6 address from my MG51, which is getting an

IPV6 address from the cellular carrier and is enabled to pass IPV6 through

to the MX.

 

Overall, the implementation of Multi-WAN is not too bad, but finding out

that a second reboot of the firewall is necessary for the failover to work

was a nasty surprise that will likely impact many customers that choose

this feature. Maybe this is also a bug that will be fixed in future firmware versions?

Ryan_Miles
Meraki Employee
Meraki Employee

Have you tested with the MG connection being on WAN 1 or 2? I don't see IPv6 being passed through to any of the WAN ports in my lab, not just WAN 3.

 

And I'm not seeing any reboots required. I'm testing with a MX75. Not sure if something would be different on the MX85 as it does use port 4 - which isn't present on a MX75.

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
jbright
A model citizen

I plugged the MG51E into the MX WAN2 and immediately got IPV4 and IPV6 addresses on it.

So it is confirmed that the MG51E can provide an IPV6 address and it does not show up on WAN3 on the MX.

Ryan_Miles
Meraki Employee
Meraki Employee

Gotcha. I now also see IPv6 on my WAN 1 & 2. Just took a little time I guess. 

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
Ryan_Miles
Meraki Employee
Meraki Employee

IPv6 has been added to the caveats section. Thanks for the catch @jbright 

 

https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink#Caveats

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
meraki-user
Comes here often

If an MX has this third uplink enabled, AND the built-in cellular enabled, which takes precedence? As always, the documentation is extremely lacking. The documentation page for this feature is very small:

 

https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink

There is not a single mention of how (or if) the two backup ports (cellular, and the new "third port") behave together.

Ryan_Miles
Meraki Employee
Meraki Employee

Multi-WAN Backup (aka 3rd WAN) is only supported on the MX75-105. None of those models have built in cellular. 

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
meraki-user
Comes here often

The Sydney MX75 used in dCloud Meraki Launchpad shows a Cellular port in the GUI, in addition to the WAN 3 port.  wan3 and cellular.jpg

Ryan_Miles
Meraki Employee
Meraki Employee

All MX models have a USB port that was historically used for Cellular modems. Starting with MX18 USB support is best effort and no longer receiving any updates. https://documentation.meraki.com/MX/Cellular/3G%2F%2F4G_Cellular_Failover_with_USB_Modems

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
meraki-user
Comes here often

So just to clarify: does this mean that all MX models show "Cellular" in the GUI, but on some models this field indicates built-in cellular, and on other models it just refers to the historical USB port?

meraki-user
Comes here often

My original question can be modified to say "USB" instead of "built-in." The question then is, can the uplink labeled "WAN 3" and the one labeled "Cellular" be enabled on the same MX, and if so, does WAN 3 take precedence? And if uplinks WAN 1, 2, and 3 are all down, would the MX then fail over to "Cellular"?

Ryan_Miles
Meraki Employee
Meraki Employee

@meraki-user Not sure what the expected behavior is. But I'll check with the Product Team. I'll also test it here myself - although I don't know if my super old USB modem will even work on the newer MX models/firmware. 

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
Ryan_Miles
Meraki Employee
Meraki Employee

Update - my MX75 and MX95 don't recognize my USB modem. Not surprised as it's ancient and we no longer actively support USB modems past MX 18.

 

I still have the question out to PM about it. But I'd be willing to bet the answer is that USB is not supported past MX 18 and Backup WAN Uplink requires MX18.2+. So the two would be incongruent. 

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
meraki-user
Comes here often

Okay, thank you for all that information.

I feel like the "Cellular" field in the GUI should have been worded differently, distinguishing between built-in cellular and the USB port. Also, I think the field should be removed from the GUI, in firmware versions/models that don't support it.

MarcAEC
Building a reputation

The web site is still proudly advertising "Instant wired failover with added 3G/4G failover via USB modem" for the MX75, MX85, and MX105.  I've told support (who said they sent it over to marketing as a "suggestion") and multiple account reps (not sure what they did) that this can be considered false advertising.   It's even more-so that 18.2 firmware is treating USB modems as best effort and the old modems don't actually work at all in the newer models.

nishmeNtic
Getting noticed

Any plans to roll out to 250's?

cmr
Kind of a big deal
Kind of a big deal

I don't imagine that this is planned to be back ported to older hardware architectures like the MS250.  Which is a shame...

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels