cancel
Showing results for 
Search instead for 
Did you mean: 

MX in Routed Mode with No Nat

SOLVED
Highlighted
LtD
Just browsing

MX in Routed Mode with No Nat

I have a new client (private school) that has an unusual requirement for their MX firewall.  Their internal network connects directly to a private circuit to a managed data center provider for Internet access.  They currently have an MX100; however, it is in pass-through (bridge mode).  The provider requires the school to maintain the assigned the RFC1918 address space to the provider and therefore, they are unable to NAT at the firewall.  They desperately need network segmentation and a zone-based firewall to isolate traffic between the internal VLANs.  For simplicity purposes, I would like the MX100 to do this. 

I would like to change the Meraki MX firewall from pass-through to routed mode; however, the routed mode requires NAT to the uplink (Internet).  I thought I read in one of the Beta release notes that this could be done, although, I cannot find the specific article.  Any suggestions?

1 ACCEPTED SOLUTION

Accepted Solutions
Conversationalist

Re: MX in Routed Mode with No Nat

We ran into this same issue with a client that has a private MPLS connection to an office. The new 15.4 beta code has no NAT in it. We upgraded to it and that fixed our issue. 

9 REPLIES
A model citizen

Re: MX in Routed Mode with No Nat

You can't 1:1 NAT anything that needs connectivity to the provider address space?


Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful Kudo me Smiley Happy
LtD
Just browsing

Re: MX in Routed Mode with No Nat

Unfortunately, no.  Almost every device on the network will need Internet access.  

Conversationalist

Re: MX in Routed Mode with No Nat

We ran into this same issue with a client that has a private MPLS connection to an office. The new 15.4 beta code has no NAT in it. We upgraded to it and that fixed our issue. 

Meraki Employee

Re: MX in Routed Mode with No Nat

@Rwatkins1145 is correct MX 15.4 Beta has a No NAT feature. You will need to contact Meraki support to get access that Beta firmware.
Adam Slater
Senior Technical Evangelist
Training & Evangelism Team
LtD
Just browsing

Re: MX in Routed Mode with No Nat

@Rwatkins1145  Thank you for confirming this!  I will request the beta code. 

 

Thanks to all!

Kind of a big deal

Re: MX in Routed Mode with No Nat

I suspect you life would be easier if you could use a Cisco Meraki switch running in layer 3 mode, and have it do the VLANs and routing ...

Kind of a big deal

Re: MX in Routed Mode with No Nat

@AdamS can you just put specific interfaces into "no-nat" mode, or does the entire MX have to be put into that mode?

Meraki Employee

Re: MX in Routed Mode with No Nat

There are two options. You can enable it on an entire WAN interface or you can just enable it on selected VLANs. At least that's how it works now. It's still Beta so it may change.
Adam Slater
Senior Technical Evangelist
Training & Evangelism Team
Conversationalist

Re: MX in Routed Mode with No Nat

@AdamS  ...Jaw drop 

 

I'm pretty sure I get the concept of the Beta mode with no NAT mode. 

 

Could you please elaborate a little further for me? 

 

We have dozens of sites with dedicated MPLS only, the data VLAN is Auto-VPN'd back to the data centre concentrator while the voice VLAN is nat'd whereby the MPLS provider then takes the voice traffic out to their media and SBC gateways. Does this mean I can get a private /24 routed to down the link and not nat'd to the handsets?