MX75 HA question

[JFridolf-Iver]

I was told recently that it should be no issue that have two MX75 in a HA (passive/ready) configuration with only 1 external IP address. 

So I bought two MX75 and started configuring them. 

As soon as I add the spare and set it to "MX IP", I rather immediately get a issue where it states that there is a duplicate IP configured and then the two firewalls takes turn on being primary/spare. 

Is it so that this can't be done and I have to do it "old style" where each of the MX has there own external IP?

Are there any other options? 

For reference I have connected it all as per following drawing: 

[Brash]

HA with routed MX's is definitely achievable with just the one IP shared between the two MX's.

https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Routed_...

It sounds like you're not configuring HA correctly. It's hard to tell from your diagram but do you have a LAN connection from both of the MX's to share VRRP heartbeats?

[JFridolf-Iver]

P2 on the MX is the "Internet 2" port (port 2)

These ports are then connected to each of the Switches

FW01-P2 > SW01-P3

FW02-P2 > SW02-P5

which is set to the same VLAN as the port containing the ISP (SW01-P1).

P4 and P5 on the MX are the "LAN ports", which are set to trunk as per usual. 

So they go to each of the Core-switches

FW1-P4 > SW01-P7

FW1-P5 > SW02-P8

FW2-P4 > SW01-P9

FW2-P5 > SW02-P10

(STP to protect the network from loops)

[alemabrahao]

You can use a Nated IP for Wan interface, I did it a few times and worked well.