MX 26.1.1 - First beta

[RaphaelL]

Security appliance firmware versions MX 26.1.1 changelog

What's new

• Expanded BGP attribute support to include outbound well-known and custom communities and increased route integrity with inbound filtering.
• Client VPN now supports IKEv2 for establishing connections.
• VPN full-tunnel exclusion now includes source-based and NBAR application-based exclusion definitions.
• Added support for encrypted (TLS) syslog

Legacy products notice

• When configured for this version, Z3(C) devices will run MX 19.2.4.
• When configured for this version, MX64(W), MX65(W), MX84, MX100, and vMX100 devices will run MX 18.107.13.

Other

• The product complies with EN 18031-1:2024 and EN 18031-2: 2024

[RaphaelL]

First Meraki product to have the CalVer format

[cmr]

I thought they were just copying the Apple IOS numbers by mistake...

[GIdenJoe]

Hehe, no, all the releases are going with calendar year format.
Even IOS-XE and Catalyst SD-WAN will start following this format.

[KarstenI]

The Secure Firewall Thread Defense just now went back to 2010 ...

[GIdenJoe]

That's the exception... for now 😜

[PhilipDAth]

>Client VPN now supports IKEv2 for establishing connections.

Now that is interesting.

[RaphaelL]

I wouldn't be surprised to finaly see a sunset on L2TP. Something like MX 26 to be the last version offering support for it.

[KarstenI]

I would be happy if that option disappeared. One click less to go to AnyConnect.

[AlexP]

I cannot say when, but yes, this is the plan. IKEv1 is no longer secure enough, as per what the IETF stated a few years back - ref https://datatracker.ietf.org/doc/rfc9395/ - and IKEv2 can handle client addressing natively, so there's no more reason to keep using L2TP for it.

[RaphaelL]

Music to my ears ! 

[antonis_sp]

Too many reboots on MX67... 

[peto]

i upgraded at 1AM. starting at 9am my MX67 started to reload every few minutes. After I downgraded back to 19 everything started to work.

[Holli69]

Same in 2 of my networks, rolled back from 26.1.1 to 19.1.11 and everthing work fine for me.

[JamesT91]

Our lab MX67 has been stable on the beta firmware for 24 hours now, although it is the MX67C-WW variant so perhaps that makes a difference 🙃

[ShaunB93]

• Expanded BGP attribute support to include outbound well-known and custom communities and increased route integrity with inbound filtering.

Keen to test this new functionality - does anybody know where the configuration option would be?
Checked under SD-WAN > Routing and no new options there that I can see!

[ShaunB93]

Within Security & SD-WAN > Routing, Outbound community string and Inbound route filter is now available within eBGP peers in the Route control section:

[thomasthomsen]

Do anyone , by chance, know of some documentation on the inbound route filter part ?
What is the correct input in that field ?
A network like 10.0.0.0/8 or ?

(I have not tried it yet 🙂 )

/Thomas

[RaphaelL]

The MX feature directory mentions the filtering : https://documentation.meraki.com/Platform_Management/Product_Information/Compatibility_and_Firmware/...

but : https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networ... doesn't give much information. 

Hope that helps

[ShaunB93]

A space-separated list of IPv4 subnets that controls which routes are to be accepted from this BGP peer. If empty, all routes are accepted.

[thomasthomsen]

Thanks, that was super helpful, and just the info I needed 🙂
Do you know if it will "allow" a smaller subnet to be recieved then the actual subnet permitted ?
So, for example, I permit 10.10.0.0/16, but the router on the other end advertises 10.10.0.0/24, would 10.10.0.0/24 be accepted ?

[armelin1]

After upgrading my MX67W it was rebooting every 5 min. This firmware doesn´t work with MX67W.

[ESMichal]

Still nothing about IPv6 support with high-availably pair 😞 
I think we will ditch HA in order to finally deploy IPv6 next year. Sad though.

[jOMeraki2]

what is 

• VPN full-tunnel exclusion now includes source-based and NBAR application-based exclusion definitions.