MX75 HA question


MX75 HA question

I was told recently that it should be no issue that have two MX75 in a HA (passive/ready) configuration with only 1 external IP address. 


So I bought two MX75 and started configuring them. 


As soon as I add the spare and set it to "MX IP", I rather immediately get a issue where it states that there is a duplicate IP configured and then the two firewalls takes turn on being primary/spare. 


Is it so that this can't be done and I have to do it "old style" where each of the MX has there own external IP?


Are there any other options? 


For reference I have connected it all as per following drawing: 



Kind of a big deal
Kind of a big deal

HA with routed MX's is definitely achievable with just the one IP shared between the two MX's.


It sounds like you're not configuring HA correctly. It's hard to tell from your diagram but do you have a LAN connection from both of the MX's to share VRRP heartbeats?

P2 on the MX is the "Internet 2" port (port 2)

These ports are then connected to each of the Switches

FW01-P2 > SW01-P3

FW02-P2 > SW02-P5

which is set to the same VLAN as the port containing the ISP (SW01-P1).


P4 and P5 on the MX are the "LAN ports", which are set to trunk as per usual. 


So they go to each of the Core-switches

FW1-P4 > SW01-P7

FW1-P5 > SW02-P8


FW2-P4 > SW01-P9

FW2-P5 > SW02-P10


(STP to protect the network from loops)

Kind of a big deal
Kind of a big deal

You can use a Nated IP for Wan interface, I did it a few times and worked well.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.