How to Configure a DMZ on a MX100-HA

[JPScolar]

Hello, I have this MX-100 HA  site and I need to adda DMZ (services to be advertised on a public IP which s behind the MXs).  How should this be configured and wired?  I have the Meraki doc t set up a DMZ but this assumes only one WAN connection.   Thank you very much for your advice. 

[alemabrahao]

Here is the documentation.

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Creating_a_DMZ_with_the_MX_Security...

[JPScolar]

I went through that document but it doesn't show how to to do for a Warm Stand-by system  (HA).  Also, I have a question with this setup. Assuming my DMZ server has a public IP which Im  NAT'ing 1:1 to my active MX public IP. This will be ok for sessions initiated from the DMZ server towards the Internet but for outside sessions trying to reach the public IP Address of my DMZ server, and assuming  my MX Public IP is provided by a different ISP from the ISP providing the DMZ server public IP,  then sites out on the INterenet will never be able to reach my DMZ Web server. 

[alemabrahao]

You need to use the VIP.

https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#WAN_Vir...

[RaphaelL]

The section about WAN IPs covers most of your questions : https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair