MX 26.1.1 - First beta

[RaphaelL]

Security appliance firmware versions MX 26.1.1 changelog

What's new

• Expanded BGP attribute support to include outbound well-known and custom communities and increased route integrity with inbound filtering.
• Client VPN now supports IKEv2 for establishing connections.
• VPN full-tunnel exclusion now includes source-based and NBAR application-based exclusion definitions.
• Added support for encrypted (TLS) syslog

Legacy products notice

• When configured for this version, Z3(C) devices will run MX 19.2.4.
• When configured for this version, MX64(W), MX65(W), MX84, MX100, and vMX100 devices will run MX 18.107.13.

Other

• The product complies with EN 18031-1:2024 and EN 18031-2: 2024

[RaphaelL]

First Meraki product to have the CalVer format

[cmr]

I thought they were just copying the Apple IOS numbers by mistake...

[GIdenJoe]

Hehe, no, all the releases are going with calendar year format.
Even IOS-XE and Catalyst SD-WAN will start following this format.

[KarstenI]

The Secure Firewall Thread Defense just now went back to 2010 ...

[GIdenJoe]

That's the exception... for now 😜

[PhilipDAth]

>Client VPN now supports IKEv2 for establishing connections.

Now that is interesting.

[RaphaelL]

I wouldn't be surprised to finaly see a sunset on L2TP. Something like MX 26 to be the last version offering support for it.

[KarstenI]

I would be happy if that option disappeared. One click less to go to AnyConnect.

[AlexP]

I cannot say when, but yes, this is the plan. IKEv1 is no longer secure enough, as per what the IETF stated a few years back - ref https://datatracker.ietf.org/doc/rfc9395/ - and IKEv2 can handle client addressing natively, so there's no more reason to keep using L2TP for it.

[RaphaelL]

Music to my ears ! 

[antonis_sp]

Too many reboots on MX67... 

[peto]

i upgraded at 1AM. starting at 9am my MX67 started to reload every few minutes. After I downgraded back to 19 everything started to work.

[Holli69]

Same in 2 of my networks, rolled back from 26.1.1 to 19.1.11 and everthing work fine for me.

[jimmyt234]

Our lab MX67 has been stable on the beta firmware for 24 hours now, although it is the MX67C-WW variant so perhaps that makes a difference 🙃

[ShaunB93]

• Expanded BGP attribute support to include outbound well-known and custom communities and increased route integrity with inbound filtering.

Keen to test this new functionality - does anybody know where the configuration option would be?
Checked under SD-WAN > Routing and no new options there that I can see!

[ShaunB93]

Within Security & SD-WAN > Routing, Outbound community string and Inbound route filter is now available within eBGP peers in the Route control section:

[armelin1]

After upgrading my MX67W it was rebooting every 5 min. This firmware doesn´t work with MX67W.