Meraki Warmspare using Lan private ip

[Vishal07]

Hi All,

Can we configure meraki mx warmspare using private ip for wan and lan connection. Here mx reach internet via perimter Ftd firewall.

[alemabrahao]

Yes, you can, it's not the best option, but it works.

[Vishal07]

what if criss cross links between Mx1 and sw goes down? if mx do a failover ?

[alemabrahao]

In this architecture, the primary and secondary MXs are not directly connected, and VRRP heartbeats are carried between the downstream switches. This is the recommended architecture for most deployments, as there is no single point of failure in this topology.

[cmr]

You need to add a link from Meraki Active to FTD passive and another from Meraki spare to FTD active.  This will then work perfectly well.  At the moment if the Meraki active fails and the spare takes over, you will have no internet connection for SW1 and SW2.

[PhilipDAth]

Personally, I would get rid of these links:

And add two links using LACP here (assuming these are not stacked switches).

[Vishal07]

How can we do lacp between Mx and Ms ?. Yes there's a trunk link between Ms switches 

[Pavithran_Che]

Have a direct connection between Primary and Secondary MX for heartbeat monitor.

If there is a possibility to stack the switches, that would be better design. SW can also use all the links. 

Primary MX and Secondary MX can send and receive VRRP heartbeat over LAN as well. 

[Vishal07]

As per documentation it wont say need to do. If we use direct connection between Mx, can we use public ip i.e /30 pool to configure warmspare between Mx

[rhbirkelund]

A direct connection between MX'es for Heatbeat link is no longer recommended, and should in fact be avoided. A single trunk from MX to MS, and a LACP/Aggregated link with the same VLANs as the MX-MS link, as @PhilipDAth suggests is the way. 

A cross link with a link between both MS's are also a possibility, but you'll need to have control over your RSTP topology. 

For warmspare, you'll need at least a /29 on the WAN links. 

[Vishal07]

You mentioned aggregate/lacp between Mx-Ms. Does Mx supports aggregate/lacp ?

[rhbirkelund]

The MX does not support aggregated links or LACP.

[Pavithran_Che]

Correct.. This is not recommended. You can ignore the above idea.

Primary MX and secondary MX need to be configured using warmspare VIP.

You may need to have /29 subnet - as we will 6 usable ip address. / 30 subnet wont work.

Below switch need to be separate not in stack to forward the VRRP packets.

If you have the Cisco FTD in active / passive scenario, you need to add two more connections.

Cisco FTD Primary to Secondary MX

Cisco FTD Secondary to Primary MX.