Connecting MX100 directly to a broadband uplink device (e.g. a cable modem) generally works, however placing a switch such as MS220 between MX100 and the broadband uplink is causing issues: the broadband uplink stops working (100% loss, no DHCP) and the switch itself disconnects from the dashboard.
What are the "minimum working" (baseline) settings for the switch to get it to work between MX100 and a broadband connection?
Some of the questions that come to mind:
What should the switch's VLAN be set to?
What VLAN (if any), and what port settings (trunk? access? does it matter?) are recommended for upstream (broadband device) and downstream (MX100) connections on the switch?
Given MX100 ports do not appear to have VLAN configuration options, should VLAN be configured at all for the switch and its ports?
Thank you!
Solved! Go to solution.
Thanks for all the help!
After a few back-and-forth with Meraki support, and studying the "MX, MS - WAN Breakout Switch designs" slide deck suggested by ww in this thread (thank you!), the following crystallized:
In more detail:
(Absolute minimum baseline settings; the switch can still be manageable if properly configured for internet access)
That's it. Everything else remains the same, i.e. if the internet was working through that uplink when the circuit was connected directly to the MX w/o a switch - this configuration should work as well.
(a minimum of 3 switch ports are configured)
The switch however may become unmanageable in the previous "minimal" configuration and disconnect from Meraki dashboard, unless it can get its own IP from the ISP circuit via DHCP, or be set to a valid static IP.
To make it manageable and accessible regardless of whether it's connected to any ISP circuits, set up another port for manageability and connect it to one of the LAN ports - e.g. on the MX appliance itself:
Hope this helps someone in a similar boat, and who needs as much hand-holding as I did.
Mx does support vlans for lan, or vlan config/tag for wan port. Two switch acces ports in any vlan would normally do the trick. However the issue here could be several things.
In this topic you can find slides that could help you https://community.meraki.com/t5/Security-SD-WAN/How-to-turn-MS120-into-WAN-breakout-for-2-ISPs-and-2...
Thank you, that deck helped tremendously. I don't have enough networking background to translate everyone's suggestions into actual configuration settings, and that deck more or less did it.
Hi @cabricharme!
A breakout switch between the MX and the ISP should be working as layer 2 only. Please make sure there is not L3 interface configured. The recommended configuration is to have a copule of ports in access mode. If you are using other ports on the switch, is recommended if are trunk interfaces to prune the VLAN. Ex. use ports 1 and 2 for ISP modem and MX100, both in access VLAN 999. In any other trunk port in the switch do not allow VLAN 999.
I hope it makes sense.
A breakout switch between the MX and the ISP should be working as layer 2 only. Please make sure there is not L3 interface configured.
Thank you.
Not sure what this means in terms of where to go in the switch configuration and what to change, to ensure the switch stays in L2 mode. If it means "there is not L3 interface configured" - then what does that mean in terms of Interface (switch port?) configuration?
The recommended configuration is to have a copule of ports in access mode.
Assuming (for now) the switch will only have two connections - to the ISP circuit, and to the MX100, does this mean both of those should be in access mode?
If you are using other ports on the switch, is recommended if are trunk interfaces to prune the VLAN. Ex. use ports 1 and 2 for ISP modem and MX100, both in access VLAN 999. In any other trunk port in the switch do not allow VLAN 999.
I hope it makes sense.
The switch is dedicated to just being the breakout switch, i.e. no plans to use it for other tasks. This means ports other than the primary ones (one - to the ISP circuit, the other - to MX100's WAN port) can be used for two purposes only:
With all that in mind - does something like this make sense, and does it look secure enough?
Port 1: to ISP circuit
Port 2: to MX100 WAN port
Port 3: to MX100 LAN port (for management)
Thanks again!
The cable modem is using a plain routed address block, like a /29?
If it is passing through PPPoE then you may have issues.
The cable modem is using a plain routed address block, like a /29?
If it is passing through PPPoE then you may have issues.
Two ISP circuits in play:
Either one is working OK when connected directly to the MX100. I'd like to put a "breakout" switch(es) between the circuits and the MX, and configure everything securely.
Got a good response from Meraki support:
... although still have trouble translating it to actual configuration steps.
So far my "translation" into configuration steps or options is as follows:
I've often added a switch between the ISP device and the MX (mainly to split the circuit to two MXs as an HA pair), but I always use a dumb unmanaged L2 switch.
Why do you want to manage the WAN switch? In my opinion it adds a security risk and a reliability risk that I'd rather not have.
I hear you on simplicity, security and reliability.
One reason to use a switch like that is because we have it... 🙂
The other - to counter ISP's assertion of "you have a lot of errors on your side" and get port error stats from a switch that can collect and report them.
(Generally, get a little better visibility into WAN traffic.)
Yet another: ease of configuration and testing. Configure two ports for one ISP circuit, another two - for the 2nd one, another - for a cellular uplink, isolate them all, see them all...
Thanks for all the help!
After a few back-and-forth with Meraki support, and studying the "MX, MS - WAN Breakout Switch designs" slide deck suggested by ww in this thread (thank you!), the following crystallized:
In more detail:
(Absolute minimum baseline settings; the switch can still be manageable if properly configured for internet access)
That's it. Everything else remains the same, i.e. if the internet was working through that uplink when the circuit was connected directly to the MX w/o a switch - this configuration should work as well.
(a minimum of 3 switch ports are configured)
The switch however may become unmanageable in the previous "minimal" configuration and disconnect from Meraki dashboard, unless it can get its own IP from the ISP circuit via DHCP, or be set to a valid static IP.
To make it manageable and accessible regardless of whether it's connected to any ISP circuits, set up another port for manageability and connect it to one of the LAN ports - e.g. on the MX appliance itself:
Hope this helps someone in a similar boat, and who needs as much hand-holding as I did.