MX100 and MS425 Internet Zone

conner172
Comes here often

MX100 and MS425 Internet Zone

I'm trying to configure a zone for Direct Internet Access (WAN1 Interface) and MPLS (WAN2 Interface) on a Meraki MX100 (our Internet Firewall) connected to a Meraki MS425 (our brand-new core switch), where all zones come together (DMZ, Corporate, Internet, VPN, VoIP, etc.). Right now, I've got the first zone (Internet and MPLS) planned for the MX100 in its own zone, with MX64s each providing firewall and routing for their respective zones as mentioned above. Downstream, I have a MS425 in its own zone. The MS425 is, as I said, our new core switch, which will have new Meraki MS210 switch stacks acting as access switches (I don't plan on using aggregation switches in-between the access layer and core). I'm looking for examples of multi-zone configurations, including setting up communications between the different zones and the core MS425. At this point, I can't even figure out how to configure the MS425 to talk to the MX250 - the zone issue is preventing me from deciding whether I need to use MAC address-based client tracking or IP address-based client tracking.

 

This was so much simpler with Cisco devices!

1 REPLY 1
PhilipDAth
Kind of a big deal
Kind of a big deal

The "zones" are going to be VLANs.

 

Hopefully the DIA and MPLS will plug directly into your MX making that bit simple.  You may end up running the MPLS via a VLAN via the switch instead to keep it being routed.

 

You can read about creating MX VLANs here:

https://documentation.meraki.com/MX/Networks_and_Routing/Configuring_VLANs_on_the_MX_Security_Applia...

 

You'll need a trunk port between the MX and your MS.

 

Then on your MS just make ports connecting to other end devices access VLANs and specify the appropriate VLAN number.

 

 

>This was so much simpler with Cisco devices!

 

No.  It is exactly the same.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels