Added support for forwarding Secure Group Tags (SGT) on traffic. This is available on Z3(C), MX64(W), MX65(W), MX67(C,W), and MX68(W,CW), MX75, MX84*, MX85, MX95, MX100, MX250, and MX450 appliances and enables full stack (MR+MS+MX) Adaptive Policy operation. * Please see the known issues for important information about SGT on MX84 appliances.
MX appliances will now drop additional types of erroneous traffic received from AnyConnect VPN clients.
Resolved a rare case that could result in non-Meraki VPN traffic being incorrectly forwarded when MX appliances were configured in passthrough mode.
Performance improvements for MX250 and MX450 appliances.
Corrected an issue that resulted in client traffic being will be dropped by MX65(W), MX67(C,W), and MX68(W,CW) appliances when 1) The client was connected to a LAN port with 802.1X authentication enabled and 2) The VLAN ID of the port was configured to 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, or 240.
Fixed several rare cases that could result in a device reboot.
Fixed an issue that could result in MX appliances replying to ARP messages for an incorrect IP address when 1) The MX was configured to operate as the standby/spare device in a high availability configuration and 2) the MX appliance was configured to operate in passthrough mode.
Legacy products notice
When configured for this version, Z1 and MX80 devices will run MX 14.56.
When configured for this version, MX400 and MX600 devices will run MX 16.16.6.
After making some configuration changes on MX84 appliances, a brief period of packet loss may occur. This will affect all MX84 appliances on all MX firmware versions
Due to an MX 15 regression, the management port on MX84 appliances does not provide access to the local status page
When SGT is enabled on MX84 appliances, any packet larger than 1440 bytes will be dropped. Due to this, we recommend that the SGT feature only be enabled in lab or other non-production environments on MX84 appliances.
There may be an increased risk of encountering device stability and performance issues.
If DNS is not available on the MX’s IPv6 uplink, MX appliances will now attempt to fetch a configuration using DNS over HTTPS to the Meraki cloud.
Hi, the email I received from Meraki regarding the MX 18.105 update also mentioned support for the following: "- Added support for configuring VPN exclusion rules for non-Meraki VPN peers". This is however missing from this post and in the firmware upgrade page on the dashboard.
Could you please elaborate if this support is added or not and preferably some documentation on this new feature?
This is what I expected when I saw this new firmware. But the documentation is not yet updated. This would be great although IMO this feature is quite useless with only the MS390 supporting it on the switch side.