MX15.29 out, decent number of bug fixes!

[cmr]

Mainly around the 67/68 and DHCP, see below:

Security appliance firmware versions MX 15.29 changelog

Important notice

• This is a beta version for the next major MX release. Due to this, we recommend taking additional caution before upgrading production appliances. Where applicable, MX 14 releases will provide a more stable upgrade alternative.
• The DES encryption algorithm is no longer supported for use in formation of VPN tunnels.
• Creating VPN tunnels using aggressive mode IKE is no longer supported.

Supported products notice

• Z1, MX60, MX60W, MX80, and MX90 devices are not supported on MX 15 and newer releases.

Bug fixes

• Resolved an issue that resulted in devices connected to ports 3-7 being unable to communicate with devices connected to ports 8-12 on MX68(W,CW) appliances.
• Fixed an issue that could result in MX67(C,W) and MX68(W,CW) appliances being unable to successfully fetch a configuration from the Meraki Dashboard.
• Removed a previous change to how MX appliances send DHCP request packets that was introduced in MX 15.13. The behavior this change introduced does not conform to RFC 2131. With this change removed, MX appliances will perform the DHCP process on WAN uplinks in the same manner as in MX 14.
• Corrected an issue that could result in fragmented packets that arrive across a cellular connection not being sent to clients on the LAN.
• Resolved an issue that could result in a device reboot of MX67W, MX68W, and MX68CW appliances.
• On MX67(C,W) and MX68(W,CW) appliances, several adjustments have been made to improve underlying systems related to port initialization and management. This should resolve 1) an issue that allowed these platforms to become bridged for a brief period on bootup, 2) packet loss that could arise from rebooting the spare appliance in a warm spare / high availability (HA) setup, and 3) some configuration changes resulting in a period of packet loss for 10 seconds or more.

Known issues

• After making some configuration changes on MX84 appliances, a brief period of packet loss may occur. This will affect all MX84 appliances on all MX firmware versions
• Some stability-impacting issues present in MX 14.19 that affect a small population of MX250 and MX450 devices still exist.
• Some stability-impacting issues present in MX 14 that affect a small population of MX67(C,W) and MX68(W,CW) appliances still exist.
• Some stability-impacting issues present in MX 14 that affect a small population of Z3(C) appliances still exist.
• Please note that until certification has been obtained, the Z3C will not be supported on Verizon's network.
• World-wide device SKUs of the MX67C, MX68CW, and Z3C units cannot be deployed in North America and North America device SKUs of the MX67C, MX68CW, and Z3C units cannot be deployed outside of North America.
• When deployed in warm spare / high availability (HA), MX67C and MX68CW do not support using their cellular connectivity to pass client traffic. In this deployment, the cellular connectivity can only be used for device monitoring or network troubleshooting. This is an expected limitation for these platforms.
• MX67C, MX68CW, and Z3C units must be connected to the Meraki Dashboard initially to retrieve an update to allow for proper use of the integrated cellular connectivity. This is most likely to be an issue when bringing the units online for the very first time.
• On the MX67(C,W) and MX68(W,CW) platforms, when the MX is providing PoE to a connected device, this information will not be reflected on the Meraki Dashboard.
• Once a Z3 has been updated to this firmware version it can only run MX 14.31 or MX15.8 and higher. This is an expected result of updates to the device booting mechanisms and this limitation will not be resolved in future releases.
• Due to MX 15 regressions, USB cellular connectivity may be less reliable on some modems
• Due to an MX 15 regression, the management port on MX84 appliances does not provide access to the local status page
• Devices connected to ports 3-7 may have issues communicating with devices connected to ports 8-12 on MX68(W,CW) appliances.
• Client traffic will be dropped by MX65(W), MX67(C,W), and MX68(W,CW) appliances if 1) The client is connected to a LAN port with 802.1X authentication enabled and 2) The VLAN ID of the port is configured to 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, or 240.
• MX250 and MX450 appliances will not apply the configured VLAN ID to traffic transmitted on their WAN interfaces if VLANs are also enabled on the LAN for other downstream clients and traffic.
• The following types of management traffic will not always egress a WAN interface: 1) Traffic used by MX appliances to register with the AMP Cloud in order to retrieve the security disposition of downloaded files, 2) Traffic being sent to the Meraki Cloud for the purposes of performing Meraki Authentication for Client VPN, and 3) Traffic sent to the Meraki Cloud using the HTTP backup communication channel. These types of traffic will follow the routing of normal clients, which means it may be routed across static routes and VPN connections, especially in cases where a default route (0.0.0.0/0) is in use.
• As a new major version evolving through beta, there are a number of new, uncommon issues that may result in device reboot that we are continuing to investigate and work through. In particular, the Z3(C), MX84, MX100, MX400, MX600, MX250, and MX450 appliances have unresolved issues that we are tracking closely and continuing to investigate and drive towards resolution.

Other

• Increased the accuracy for tracking when flows were created. This should help make MI tracking more precise.
• Added additional robustness to the firmware upgrade process for the MX67(C,W) and MX68(W,CW) appliances.

[CptnCrnch]

Sounds great, thanks for sharing! Guess I'll upgrade later today.

[cmr]

Ive just upgraded 6 single devices (including some 67s) and 3 HA pairs (84s and 100s)  They didn't drop off the dashboard and are passing traffic so basic tests aok 😉

[DarrenOC]

@cmr - Can see you've applied it as well due to the number of alerts received 😂

Let us know how it holds out as we need to take another customer to 15.x.

[CptnCrnch]

MX67 HA-pair sucessfully upgraded without any hickups.