Meraki MX and ATT Arris Modem - Failover Issues (follow-up 2025)

[Catiare]

This was a solved issue years ago. Failover would never work because there was a notification page that would "confuse" the MX that is not down by spoofing all failover tests preventing cell failover to kick in. The solution was to disable the Broadband Status Notification in the modem. Once that was done, failover worked perfectly. 

AT&T, in their infinite wisdom, decided to re-enabled that feature remotely (on a frequent basis) so when your circuit goes down and your failover did not kick in, you know that AT&T has put that notificaion check back. This is happing to us on dozens of MX on different customers and locations; and changing to another ISP is not an option. Calling AT&T and opemning a ticket with them is futile.

I just wonder if someone had a workaround solution for this on the Meraki side. Perhaps a good olde ping rather than some sofisticated (but highly spoofable) failover test. 

[alemabrahao]

You can configure the Meraki MX to use a ping test to a reliable external IP address (like Google's 8.8.8.8) to determine if the primary connection is down.

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failo...

[Catiare]

The problem is that the MX also checks for DNS and HTTP so the MX asumes is up since the modem replies to the DNS and HTTPS quieries. 

From that Document:

"...

Failover Connectivity Tests
The MX runs the following tests to determine uplink status:

DNS test

Query the DNS servers (primary or secondary) configured on the internet interface for the following hosts:
meraki.com
google.com
yahoo.com
Internet test

Pings to either 209.206.55.10 or 8.8.8.8. One ping per second.
Uses a round-robin technique to send an HTTP GET to http://meraki.com or http://canireachthe.net. An HTTP response of any kind will result in a success.
ARP test

ARP for the default gateway and its own IP (to detect a conflict).

..."

[alemabrahao]

You can try creating firewall rules on the Meraki MX to block the modem notification page from being returned as a valid response. This may involve identifying specific patterns in the notification page responses and filtering them.

Otherwise the only alternative I can see is to contact support to see if they can help you.

[Catiare]

The responses are being spoofed. So they are respoding from the original IP so no, blocking the unit IP will not work. BTW we tried this already. 

[alemabrahao]

Don't you have access to the AT&T modem to somehow try to disable this?

If not, I think it's worth contacting them to see what can be done on their side. I personally don't see it as a Meraki problem, but I could be wrong.

[Catiare]

You can disable it and that was the original fix to this issue, but recently AT&T decided to enable it remotely. So if you disable it now and check back a few days later its enabled again.

We did contact them back. They say everything is working as it should. 

I agree with you the problem is with AT&T 100%. But because AT&T will do nothing about it, then I'm asking Meraki for help. Ubiquity made some tweaks to their failover meachanisim to address this. So I would hope Meraki doing the same thing. 

[PhilipDAth]

You would need to write something like a Python script that kept trying to retrieve a web page, and then do something if the spoofed page was returned.

Two good ones are (used by Android phones to test connectivity):

http://connectivitycheck.gstatic.com/

Which should always return a 404.  If you get anything other than a 404 - it must be the modem.

http://clients3.google.com/

This should always return a blank page.  Anything other than a blank page ...

[Catiare]

I haven't gone thru the API route yet. Let me review the API docuention and see we can "do something" when the ISP is really down.