New MX 17.10.1 stable release candidate firmware - AutoVPN fix

[cmr]

Security appliance firmware versions MX 17.10.1 changelog

Important notice

• While Meraki appliances have traditionally relied on UDP port 7351 for cloud communication and TCP ports 80 and 443 for backup communications, with MX 16 we are beginning a transition to using TCP port 443 as the primary means for cloud connectivity. In order to ensure proper connectivity to the Meraki cloud after this upgrade, please ensure that traffic using TCP port 443 between 209.206.48.0/20 is allowed through any firewalls that may be deployed upstream of your Meraki appliances.
• HTTP proxy, which allows default management traffic from MX appliances to be sent through a proxy, is deprecated on MX 16 and higher firmware versions.
• The transition to Cisco Talos intelligence for our content filtering services means that some URL categories have changed names, some categories are no longer available, and multiple new categories are now available. Please review your configuration after upgrading to ensure content filtering is effectively tailored to your needs and deployment environment.

Legacy products notice

• When configured for this version, Z1, MX60, MX60W, MX80, and MX90 devices will run MX 14.56.
• When configured for this version, MX400 and MX600 devices will run MX 16.16.6.

Bug fixes

• Corrected a rare issue that resulted in AutoVPN connectivity failing to form when cellular active uplink was configured.
• Performance and traffic reliability improvements.
• Stability improvements for vMX appliances.

Known issues

• After making some configuration changes on MX84 appliances, a brief period of packet loss may occur. This will affect all MX84 appliances on all MX firmware versions
• Due to an MX 15 regression, the management port on MX84 appliances does not provide access to the local status page
• Client traffic will be dropped by MX65(W), MX67(C,W), and MX68(W,CW) appliances if 1) The client is connected to a LAN port with 802.1X authentication enabled and 2) The VLAN ID of the port is configured to 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, or 240.

[JF1]

We upgraded a site to this firmware at the weekend. We now have an issue whereby client endpoints are unable to browse to the internet. We can ping the internet fine, DNS is resolving, however we cant browse. 

I cant see any obvious cause. Has anyone else encountered this?

[JF1]

For awareness Meraki support advised the above issue is a bug. We have rolled back to the previous firmware

[cmr]

@JF1 I am at a site right now where the MXs are running 17.10.1, but only with the enterprise feature set, and it is working fine.  Did they explain the conditions that caused the issue?

[JF1]

In a word no, not at the minute. The latest notes received on the case advise "During the call, I managed to establish that your MX has been running into a known issue that is currently being worked on by our engineering team." The roll back to MX16.16.6 addressed our issue. I was advised we should receive some more detailed routes around the cause. I will share these if received.