MX 26.1.1 - First beta

[RaphaelL]

Security appliance firmware versions MX 26.1.1 changelog

What's new

• Expanded BGP attribute support to include outbound well-known and custom communities and increased route integrity with inbound filtering.
• Client VPN now supports IKEv2 for establishing connections.
• VPN full-tunnel exclusion now includes source-based and NBAR application-based exclusion definitions.
• Added support for encrypted (TLS) syslog

Legacy products notice

• When configured for this version, Z3(C) devices will run MX 19.2.4.
• When configured for this version, MX64(W), MX65(W), MX84, MX100, and vMX100 devices will run MX 18.107.13.

Other

• The product complies with EN 18031-1:2024 and EN 18031-2: 2024

[RaphaelL]

First Meraki product to have the CalVer format

[cmr]

I thought they were just copying the Apple IOS numbers by mistake...

[GIdenJoe]

Hehe, no, all the releases are going with calendar year format.
Even IOS-XE and Catalyst SD-WAN will start following this format.

[KarstenI]

The Secure Firewall Thread Defense just now went back to 2010 ...

[GIdenJoe]

That's the exception... for now 😜

[PhilipDAth]

>Client VPN now supports IKEv2 for establishing connections.

Now that is interesting.

[RaphaelL]

I wouldn't be surprised to finaly see a sunset on L2TP. Something like MX 26 to be the last version offering support for it.

[KarstenI]

I would be happy if that option disappeared. One click less to go to AnyConnect.

[AlexP]

I cannot say when, but yes, this is the plan. IKEv1 is no longer secure enough, as per what the IETF stated a few years back - ref https://datatracker.ietf.org/doc/rfc9395/ - and IKEv2 can handle client addressing natively, so there's no more reason to keep using L2TP for it.

[RaphaelL]

Music to my ears ! 

[antonis_sp]

Too many reboots on MX67... 

[peto]

i upgraded at 1AM. starting at 9am my MX67 started to reload every few minutes. After I downgraded back to 19 everything started to work.

[Holli69]

Same in 2 of my networks, rolled back from 26.1.1 to 19.1.11 and everthing work fine for me.

[JamesT91]

Our lab MX67 has been stable on the beta firmware for 24 hours now, although it is the MX67C-WW variant so perhaps that makes a difference 🙃

[ShaunB93]

• Expanded BGP attribute support to include outbound well-known and custom communities and increased route integrity with inbound filtering.

Keen to test this new functionality - does anybody know where the configuration option would be?
Checked under SD-WAN > Routing and no new options there that I can see!

[ShaunB93]

Within Security & SD-WAN > Routing, Outbound community string and Inbound route filter is now available within eBGP peers in the Route control section:

[thomasthomsen]

Do anyone , by chance, know of some documentation on the inbound route filter part ?
What is the correct input in that field ?
A network like 10.0.0.0/8 or ?

(I have not tried it yet 🙂 )

/Thomas

[RaphaelL]

The MX feature directory mentions the filtering : https://documentation.meraki.com/Platform_Management/Product_Information/Compatibility_and_Firmware/...

but : https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networ... doesn't give much information. 

Hope that helps

[ShaunB93]

A space-separated list of IPv4 subnets that controls which routes are to be accepted from this BGP peer. If empty, all routes are accepted.

[thomasthomsen]

Thanks, that was super helpful, and just the info I needed 🙂
Do you know if it will "allow" a smaller subnet to be recieved then the actual subnet permitted ?
So, for example, I permit 10.10.0.0/16, but the router on the other end advertises 10.10.0.0/24, would 10.10.0.0/24 be accepted ?

[thomasthomsen]

---- deleted previous message ----

I was wrong about what I wrote.

The filter needs to be specific.

When entering fx. 10.100.0.0/16 I dont get, lets say 10.100.24.0/24 as a route.

So it needs to be specific. The "second" i put in 10.100.24.0/24 its received and installed.

And if your neighbour advertises a default 0.0.0.0/0 route, its installed, regardless of the filter 😕

[ShaunB93]

My results differ. 
Only prefixes included in the route filter are imported to the MX routing table - this need to be an exact prefix match. 
i.e if prefix 10.110.0.0/16 is set in the route filter and my peer is advertising 10.110.0.0/24 - the MX does not import the route. If the MX route filter is updated to 10.110.0.0/24, the MX imports the route. 
If the MX route filter does not include 0.0.0.0/0, the MX does not import the default route from the eBGP peer. 

[thomasthomsen]

I was in a "panic" because the neighbour advertised the default route.

But you are right, the networks needs to be specific.

But it still installed the default route when I had a 10.100.0.0/16 filter 😕
- With all the benefits of it being a higher priority for all spokes in autovpn ...  thats where the panic came from 🙂

So something is definitely going on there.

[armelin1]

After upgrading my MX67W it was rebooting every 5 min. This firmware doesn´t work with MX67W.

[ESMichal]

Still nothing about IPv6 support with high-availably pair 😞 
I think we will ditch HA in order to finally deploy IPv6 next year. Sad though.

[jOMeraki2]

what is 

• VPN full-tunnel exclusion now includes source-based and NBAR application-based exclusion definitions.

[ewcs]

MX68 reboots every 24 hours on this.