Meraki Dynamic Flow Preference

[Alex413]

Hi, im working with a client that wants to achieve the below. I'm pretty sure this is not possible with any of the MX licenses tiers

Corp traffic to go out out of WAN1 - default

Guest traffic to go out of WAN 2 - flow preference rule 

If WAN 1 fails Corp traffic to automatically fail to WAN 2 - default automatic 

if WAN 1 fails automatically block Guest from breaking out of WAN2 - from my experience, not possible. 

is there any other way this can be achieved? 

thanks in advanced

[alemabrahao]

I can only think of two ways.

1 - Create some kind of automation via API.

2 - Use a router or other firewall in conjunction with the MX since this type of configuration is not possible.

[GIdenJoe]

You could indeed try out the new workflows feature to build a simple automation that is triggered when the primary WAN fails (webhook) that then applies a deny all rule group policy on the guest subnet and removes it when it is restored.

So it would require some testing but I do see a possibilty here.

[PhilipDAth]

That is inspired thinking.

[PhilipDAth]

I am very grey on this one.

I *think* support has an option to configure WAN2 as a "cellular" interface (or perhaps it was the other way around).  You still use WAN2 like normal - just the MX thinks it is a cellular interface in the dashboard now.

You can then use the cellular firewall rules.

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Firewa...

[Ryan_Miles]

Yes. But that wouldn't specifically address the OP's scenario of wanting to use WAN 2 for Guest while WAN 1 is up, but then deny it when WAN 1 is down. 

That feature would work as long as the OP wants Guest to use WAN 1 normally then deny it when WAN 2 is active.

[MilesMeraki]

Although not achieving what you are wanting, why not just rate limit the guest internet traffic regardless of it's "Internet" connectivity.