How Do MX Tags Interact With Configuration Templates for VLAN/Subnet Overrides?

[MerakiMaverick]

Hello Meraki Community,

I’m looking for some clarification on how the tagging system works when using Meraki MX security appliances in combination with configuration templates.

Suppose I have a configuration template that assigns VLANs, subnets, and per‑port settings through the Addressing & VLANs section.

Is there any way to use tags to override these VLAN or subnet assignments on a per‑network basis? Or does the configuration template always take precedence and overwrite any local network‑specific VLAN or subnet changes, regardless of the tags applied?

Thanks in advance for any insights!

[RWelch]

When a network is bound to a template, you can override the subnet assigned to a VLAN locally on that network. However, the override must use a subnet from the same subnet pool defined in the template, and you cannot override the VLAN ID itself.

Tags themselves do not provide a mechanism to override VLAN or subnet assignments. Tags are used for device grouping, policy application, and dashboard filtering, but not for configuration overrides.

The configuration template sets the default VLAN and subnet assignments. Local overrides made directly on the network (via Security & SD-WAN > Addressing & VLANs) will take precedence for that network, as long as they comply with the template’s subnet pool rules.

If you unbind a network from the template, any local overrides and template-based configuration are lost, and the network reverts to its own configuration.

Tags do not override VLAN/subnet assignments.

Local configuration changes on a network bound to a template can override the template’s VLAN/subnet settings within the allowed subnet pool, but the template always controls the available options.

[MerakiMaverick]

Thank you, RWelch. Is there a location within the dashboard, at the network level, where I can apply a local VLAN override? When I attempt to manually adjust settings under Security & SD‑WAN > Addressing & VLANs, the option to modify per‑port VLAN assignments is missing. The only controls available to me are for changing the VLAN interface IP address and its associated subnet range.

[RWelch · Accepted solution]

You can apply a local VLAN override at the network level by navigating to Security & SD-WAN > Addressing & VLANs, however the available local override options are limited:

You can only modify the VLAN interface IP address and its associated subnet range for each VLAN. This allows you to select a different subnet from the template’s defined pool for that VLAN.

The ability to change per-port VLAN assignments (such as assigning specific VLANs to individual MX LAN ports) is not available for MX appliances when bound to a template. Per-port VLAN controls are only available for stand-alone MX networks, not for template-bound ones.

If you require granular per-port VLAN assignment, you would need to unbind the network from the template or use a stand-alone network configuration. For template-bound MX networks, only the VLAN interface IP and subnet can be locally overridden.