MX behind firewall and switch stack

[ksumann]

Hello everyone

our current setup looks like this:

FW -- Switch -- MX as Hub

Now we want to create a switch stack to keep everything up in case of a switch failure.

Additionally we have set manual NAT traversal for the MX.

Plan was to connect one WAN Port to one Switch of the stack.

So how can we achieve this?

- Its not possible to define an alternate NAT traversal port so we cannot define a second port forwarding (to the IP of WAN2) on the firewall

- Its not possible to share the same IP between WAN1 and WAN2

- Manually setting the same IP to WAN1 and WAN2, both connected to the stack, will give ip address conflict (obviously)

- Its not possible to use LACP with WAN1 and WAN2

[KarstenI]

One concentrator on stack-member 1, one concentrator on stack member 2. Both MX running in warm spare mode.

[alemabrahao]

Refer the documentation.

https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair

[ksumann]

So there is no way with only one MX?

[I agree that this is still a single point of failure]

[KarstenI]

No:

Interface Configuration

The MX WAN appliance being configured as a one-armed VPN concentrator should be connected to the upstream datacenter infrastructure using its Internet port, or using the Internet 1 port on devices models with two Internet uplink ports.

[ksumann]

I forgot to mention that it is configured in routed mode.

The idea was, if the primary switch fails, WAN1 would fail and thus going over WAN2 and Switch 2.

I guess it would work if there were no Port forwarding rule needed.

[KarstenI]

This information is not that unimportant ...

There is also only one ISP on the firewall?

On the MX, you could use the same IP on both WANs, but it doesn't help as the firewall needs to differentiate both WAN ports. If you set them to different IPs, I would assume that it would work if the ISP firewall doesn't mess up the NAT. But that could be solved with two dedicated 1:1 translations on the firewall. 

Still, if a customer approached me with this design, I would think they wanted to kid me.