New MX 18.107.3 Bug Fix Release -Lots of Fixes and few random updates

[Mloraditch]

Bug fixes

• Resolved an MX 17.10.4 regression that could result in the WAN 2 port being set as disabled when making changes via the device local status page.
• Corrected an issue that could result in an unexpected device reboot when FIPS mode was enabled.
• Fixed an issue that resulted in MX95 and MX105 appliances incorrectly forwarding CDP traffic.
• Resolved an issue that resulted in MX appliances generating syslog flow messages for internal traffic processing steps.
• Corrected a rare issue that could result in IBGP instability when two AutoVPN peers established their IBGP session using IPv6.
• Fixed an issue that could result in AutoVPN IPv6 routes not being preferred over non-Meraki VPN peer IPv6 routes.
• Resolved a rare issue that could result in device reboots for MX67(C,W) and MX68(W,CW) appliances.
• Corrected an issue that could result in configuration changes to the Layer 3 firewall rules not taking effect when the MX was configured in passthrough mode and only AnyConnect client VPN was configured.
• Fixed an issue that resulted in clients not receiving DHCP IP addresses if 1) clients were connected to Z4 appliances, 2) the Z4 was originally configured in NAT mode, 3) the client received an IP address from the Z4 while it was in NAT mode, and 4) the Z4 was reconfigured to operate in passthrough mode.
• Resolved an issue that resulted in the LED activity lights for LAN ports not functioning correctly on Z3(C) appliances.
• Corrected an issue that could result in IPv6 traffic received over VPN not being correctly routed to destinations reachable through other types of VPN. For example, AnyConnect client VPN to non-Meraki site-to-site VPN peers.
• Fixed an issue that could result in the default AnyConnect group policy not being applied consistently, depending on the username’s case/capitalization.
• Resolved an issue that resulted in routes learned via IBGP being reported as “external” routes on the Route table page in Dashboard.
• Resolved an issue that could result in traffic being incorrectly dropped when being routed across an IPv6 route learned via EBGP.

Legacy products notice

• When configured for this version, Z1 and MX80 devices will run MX 14.56.
• When configured for this version, MX400 and MX600 devices will run MX 16.16.9.

Known issues

• After making some configuration changes on MX84 appliances, a brief period of packet loss may occur. This will affect all MX84 appliances on all MX firmware versions
• Due to an MX 15 regression, the management port on MX84 appliances does not provide access to the local status page
• MX appliances will now properly validate that DBD packets conform to the appropriate MTU size. If the MX's OSPF peer has an improper MTU configured, it may cause the OSPF adjacency to fail to properly form. The updated behavior properly conforms to RFC. Please ensure these settings are properly configured on any MX's OSPF peers to avoid disruption after upgrading to MX 18.1.X.

Other

• Updated APN mappings for the Orange and EE carriers.
• Content filtering URL lookups to the Talos backend will no longer follow routes configured for client traffic. These lookups should now always egress a WAN interface.
• Improved support for reporting when 2.5Gbps and 5Gbps link speeds were in use.
• Added support for automatic detection of AIF Telecom cellular connections using the “datapro” APN.

[antonis_sp]

Fun fact, at this time I cannot upgrade any of my networks to this version. (currently on 18.107.2)

[vilmantasr]

Same.

[Ryan_Miles]

Please open Support cases. Making Support & Eng aware is how things get fixed.

I see the same, but only for networks running 18.107.2. Anything older and it allows me to upgrade. Is that the same you’re all seeing?

I opened case 10522501 in case anyone wants to reference it when you open your case.

[RaphaelL]

Same thing here. Will open a case.

[DanielWahlsten]

same thing here

[jimmyt234]

Same - ticket has been opened

[cmr]

I arranged the fixes to try to make them more readable...:

BUG FIXES

• Resolved an MX 17.10.4 regression that could result in the WAN 2 port being set as disabled when making changes via the device local status page.
• Corrected an issue that could result in an unexpected device reboot when FIPS mode was enabled.
• Resolved an issue that resulted in MX appliances generating syslog flow messages for internal traffic processing steps.
• Fixed an issue that could result in the default AnyConnect group policy not being applied consistently, depending on the username’s case/capitalization.
• Corrected an issue that could result in configuration changes to the Layer 3 firewall rules not taking effect when the MX was configured in passthrough mode and only AnyConnect client VPN was configured.
• Resolved an issue that resulted in routes learned via IBGP being reported as “external” routes on the Route table page in Dashboard.

IPv6

• Corrected a rare issue that could result in IBGP instability when two AutoVPN peers established their IBGP session using IPv6.
• Fixed an issue that could result in AutoVPN IPv6 routes not being preferred over non-Meraki VPN peer IPv6 routes.
• Resolved an issue that could result in traffic being incorrectly dropped when being routed across an IPv6 route learned via EBGP.
• Corrected an issue that could result in IPv6 traffic received over VPN not being correctly routed to destinations reachable through other types of VPN. For example, AnyConnect client VPN to non-Meraki site-to-site VPN peers.

MX95/105

• Fixed an issue that resulted in MX95 and MX105 appliances incorrectly forwarding CDP traffic.

MX67/68

• Resolved a rare issue that could result in device reboots for MX67(C,W) and MX68(W,CW) appliances.

Z4

• Fixed an issue that resulted in clients not receiving DHCP IP addresses if 1) clients were connected to Z4 appliances, 2) the Z4 was originally configured in NAT mode, 3) the client received an IP address from the Z4 while it was in NAT mode, and 4) the Z4 was reconfigured to operate in passthrough mode.

Z3

• Resolved an issue that resulted in the LED activity lights for LAN ports not functioning correctly on Z3(C) appliances.

[Mloraditch]

Here's to hoping they copy you here as well!

[DanielWahlsten]

Opened a case and the support said there is no firware past 18.107.2. I sent them this link and the response was let us check. That was two days ago. 

[CyberDingo]

Please fix the issue with the Content Filter loading web pages slowly if there is a L3 device within the LAN. This has been a problem since v17 and is preventing many of us from updating our Meraki SD-WANs.

[JF1]

check this thread. Potentially the same issue that a few people resolved by changing the client tracking from MAC address to IP address - Solved: Re: MX105 version 18.107.2 - Needing to refresh pages to get them to load - The Meraki Commu...

[CyberDingo]

Thank you. I was able to fix the problem by changing the Client tracking to "IP Address."

[ww]

• Content filtering URL lookups to the Talos backend will no longer follow routes configured for client traffic. These lookups should now always egress a WAN interface

Should? 

&

Why these talos lookup ip/dns are still not mentioned in the upstream firewall rules on the dashboard.. 

https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Clo...

[vilmantasr]

MX 18.107.4, still no way to update from MX 18.107.2.

[Ryan_Miles]

https://community.meraki.com/t5/Security-SD-WAN/MX-18-107-4-is-out-STILL-can-t-upgrade-from-MX-18-10...

[Ryan_Miles]

Appears the fix has been pushed out. I can now upgrade from 18.107.2.

[RodCushman1]

I noticed 18.107.4 was in stable release; went to plan a network outage to upgrade from 18.107.2 with several issues (AD/LDAP not accurately getting user assigned to IP, etc.) and now (08/29/2023) 18.107.4 is a maintenance release.  I could not find a definition of "maintenance" release.  Is 18.107.4 (vs. 18.107.2) a safe and stable release to deploy to HA MX250's and numerous MS tonight?

[Ryan_Miles]

This issue is no longer present. Back to the regular 3 categories: Stable, Stable RC, and beta.