Moving firewall rules to another MX - The smoothest way? - Except a SS that support suggested :D

[DavidR]

So except a screen shot - easiest way to move an MX?
Well I actually have two MX so I can set up the other first and then copy all settings?
No export?

[rhbirkelund]

No Export per se. You would use the API to get the rules, and post them to the other MX.

[DarrenOC]

This is the way.

[rhbirkelund]

If you use Objects and Object Groups, it'll be a bit more complex, as you'll have to keep track of the IDs, assuming you'll be moving rules between organizations. It it's between networks within the same organization, it shouldn't be much difficult, other than you'll need to keep track of the source networks. If I remember correctly, the source ip network, needs to exist in the Meraki Network for it to work.

[RaphaelL]

Clone the network

[DavidR]

OK Hmm

[PhilipDAth]

Can you clarify exactly what you are doing?  Is this an in-place upgrade, or something else?

[DavidR]

I am moving an MX67 to another organisation (and network) but want to keep all the firewall settings.

[cmr]

Is it a new Organisation, or does the organisation already have Meraki networks configured?

If it is then split the current combined network into constituent parts, re-combine the non-MX networks if you want to and then ask support to move the MX network to a new org with the license.  I'm pretty certain they will do that.

[cmr]

Here is a link to the documentation, MXs aren't on the not allowed list:

Organization Split Overview and FAQ - Cisco Meraki Documentation

[PhilipDAth]

In the Meraki GitHub, there is a script for exporting and importing firewall rules between Organisations.

https://github.com/meraki/automation-scripts/tree/master/mx_firewall_control

[PhilipDAth]

There is also a network migration script that could be worth a look.

https://github.com/meraki/automation-scripts/blob/master/migrate_networks/migrate_networks.py

All the network automation scripts are here:

https://github.com/meraki/automation-scripts/