MX - Migrating WAN Public IP Addresses

[JPScolar]

Hello,

I'm upgrading connectivity for a group of MXs which already have  Public IP addresses. The new Internet connectivity for each MX is from a different ISP, so  I will have to change the  public IP Address.

Any advise or recommendation on how to ease this transition?  I heard Dual-Homing may help but I'm not sure how this works.

All comments are much welcome. 

[Mloraditch]

Do you currently  have multiple ISPs? If not you can put the new ISP into the secondary WAN of the MXs. Verify everything is working, then change your primary uplink to the new WAN.

If you do have multiple ISPs already you would need to disconnect one in order to program the new, but you can similarly set your flow preferences/load balancing to only use the WAN you are keeping then swap the one you are replacing, test and restore your flow setup

https://documentation.meraki.com/MX/Monitoring_and_Reporting/Appliance_Status/MX_Uplink_Settings

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferen...

[alemabrahao]

Assuming you have both WANs working, you just need to reconfigure the desired WAN interface.

If you only have one working, you can configure the second WAN temporarily.

I recommend doing this during a scheduled maintenance window.

If you have any NAT, you will need to reconfigure that as well.

[cmr]

Making changes to the WAN IP addresses is likely to interrupt all traffic on the MXs for a moment in my experience.  As @alemabrahao said, plan to do it in a maintenance window.

[MaghM]

Hi @JPScolar 

>Better to do in maintenance window

>Better to be configured on the Local Status Page of the device, as if the new config doesn't work, it will revert to what it's configured previously on the LSP.

>If you notice any issue take packet capture on the internet 1/2 from the dashboard and check if the device is getting response from the ISP

>Make sure all the cloud connectivity ranges are enabled on the ISP, this can be found on help>firewall info, 1st rule

[GarageLand42]

Just in case, you should also have Local Access to the MX device.   You can them web into MX.Meraki.com and configure the IP.

[JPScolar]

Thank you for all the comments. Allow me to clarify a bit my question. My focus here is on the Public IP Transition.  All partners and service providers using the Legacy IP will have to update their records, so there will be a glitch (All IPSec tunnels with Service Providers for instance).  I'm looking for ideas on how to minimize  this glitch or shorten the transition time as much as possible. 

[Mloraditch · Accepted solution]

If we are talking about third party VPNs that's really a question for those providers as to what they can accommodate schedule wise. Even if you are able to bring up the new ISP on the secondary WAN port, third party VPNs only originate from the designated primary uplink (can be either the primary or secondary wan port) of the primary MX. They will all need to be changed at the same time or as close as possible.

For anything NAT'd you can define a new NAT/FW Rule on the secondary WAN and just have the vendor point to the new ip at a convenient time. Both WANs will work simultaneously.

For a website where you have a public ip lock, i.e. a time clock provider where you only allow access from your designated IPs you should be able to just provide the new IPs and then remove the old once it's terminated.