MX85 HA Warm Spare Config design

[JCA1]

Hi, I'd like to have some feedback to determine if this configuration is supported. We tried to implement this and had to rollback because we started seeing all kinds of problems in the network, dhcp, no intervlan traffic, etc. Any help would be appreciated. The breakout switch is an HP 3800, no svi in the switch. The fws are MX85. This is a single ISP link. We used the virtual ip option for the mx uplink.

[alemabrahao]

Warm spare with trunk port is really problematic, try configuring the LAN port to Drop Untagged Traffic.

[JCA1]

Thank you! I was under the impression that as long as the native vlan is not on the "allow" list, it will be dropped.

[alemabrahao]

I still recommend you to apply this configuration for test.

[KarstenI]

I would avoid this setup as much as I can. Or even more, I would refuse to implement it for a customer. In this setup, the switch has the potential to bypass the firewall. This is really bad practice.

[JCA1]

Thanks. How would you be able to bypass the firewall with the wan/core switch?

[KarstenI]

• Admin error, putting the wrong port into the wrong VLAN
• switch crash and forwarding without config applied 
• config lost due to any other reason

As @cmr writes, it is not worth it to save a couple of bucks. Although I prefer managed switches on the WAN side like Catalyst 1000 or CBS 350.

[PhilipDAth]

That should work ok.  Was this the first power on of the MXs?  Perhaps they were still doing firmware upgrades.  What did the Dashboard show?

[JCA1]

No, it wasn't the first power on. It was just that the traffic stopped hitting the meraki, dhcp problems, the core switch froze.

[cmr]

Why would you want to do this?  We use cheap unmanaged 5-8 port L2 Cisco switches for the WAN and they have been performant and reliable for the last 4+ years.

[JCA1]

Well, they only have one ISP with one fiber handoff so they need a breakout switch, that breakout switch splits the internet connection. What do I need to change here to make it right? Keep the breakout switch but from the MX Lan ports go to a downstream LAN switch instead of going back to the breakout switch?

           ISP
              |
___WAN SWITCH___
|                                   |
MX1                          MX2
                  |
             LAN SW

[cmr · Accepted solution]

Yes, as below:

[JCA1]

Thank you!