New MX feature: MultiWAN Backup Uplink (third/backup WAN)

[Ryan_Miles]

As promised at the launch of MX18.2 support for a third/backup WAN port is now available on supported models (MX75, 85, 95, and 105) when running MX18.208 firmware.

Documentation: https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink

Be aware that when enabling this feature you will need to use SFP WAN ports (which you might not be doing today). So, make sure to review the above documentation for WAN port behavior on the MX75 and 85-105.

I'm also including my own slide deck covering the feature with a WAN failover animation slide and some examples of loss during WAN failures for Internet and VPN bound traffic.

https://docs.google.com/presentation/d/19zAJMSewQYFQJILjWsGz9t8zoQkOeYoNRSM9kSYf5ns/edit?usp=sharing

In my testing I was shutting down the switch port connected to the MX WAN port. As always, failover times can vary based on the nature of the failure (hard down vs. upstream failure). And failback behavior will depend on the setting you have configured (Graceful vs. Immediate). 

Be aware, when you enable (or disable) the backup WAN feature it will do a soft reset on the MX and cause a brief outage, similar to what you'd see when enabling a WAN 2 port on a MX67. So, do this in a maintenance window or whenever you can incur a few minutes of disruption on the MX.

[alemabrahao]

Great to know, too bad it's restricted to specific models, but better than nothing. 🙂

[cmr]

Excellent! It is a shame that the MX100 doesn't support 18.2 as it has many WAN ports... 

[GreenMan]

To be accurate:   MX100 has many LAN ports     While physically the ports look the same, architecturally LAN ports and WAN ports are very different.   I know that's a little hard to square with the fact that some MXs have (a) hybrid port that can be switched from one to the other - but that's very much a specific exception.

Unfortunately MX100 and some other older models don't really have the 'oomph' to add the new capabilities available from 18.2 onwards.  (details here:  https://documentation.meraki.com/General_Administration/Firmware_Upgrades/Product_Firmware_Version_R...)

[cmr]

@GreenMan I may be wrong, but I believe the MX100 can physically have many WAN ports, but this was never done:

Ports 2-11 should all be WAN capable!

[RaphaelL]

I don't want to get side tracked here , but in your slides you mentionned a part about Insight and WAN3 will only work if WAN1-2 are down.  On MX68CW , WAN3 is showing since MX16 ( since the addition of Cellular Active uplink ) However , even if you don't have Cellulare active uplink enabled WAN3 will still show up as down. Will this ever be fixed ?

[Ryan_Miles]

I see a logged bug on this. No idea when it will be resolved though.

[ShawnHu]

And we have the demo environment on this feature for Cisco and partners. Check this post.

[jbright]

I have implemented this on my MX85 and it is working fine, now.

I inserted the Copper SFP in Ports #1 and #2, rebooted the firewall and
moved the ethernet connections over to the SFP ports. Once I verified

those were working again, then I switched over to Multi-WAN and connected

my MG51 to Port #4. The MX was able to pull an IPV4 address from the MG51 NAT Pool.

I tried disconnected the ethernet cables from both SFP modules and the firewall

did not switch over to WAN3. The firewall completely dropped off the internet and

the dashboard. I connected both internet ethernet cables back to the

MX and once those came back up and the MX was visible on the dashboard, I rebooted the MX again.

Once the MX came up, I tried again to unplug both internet ethernet cables and this

time the firewall did switch over to WAN3. It also sent an email alert stating that it

had switched over to the cellular port. In this case that is correct, but I think the

alert should say WAN3 and not the cellular port.

I connected the two internet ethernet ports back to the MX and it immediately

started using them again. So a second reboot of the firewall after switching to

Multi-WAN seems necessary for the failover to WAN3 to work correctly.

One bug that I see is that even though IPV6 is enabled on WAN3,

the MX is not pulling an IPV6 address from my MG51, which is getting an

IPV6 address from the cellular carrier and is enabled to pass IPV6 through

to the MX.

Overall, the implementation of Multi-WAN is not too bad, but finding out

that a second reboot of the firewall is necessary for the failover to work

was a nasty surprise that will likely impact many customers that choose

this feature. Maybe this is also a bug that will be fixed in future firmware versions?

[Ryan_Miles]

Have you tested with the MG connection being on WAN 1 or 2? I don't see IPv6 being passed through to any of the WAN ports in my lab, not just WAN 3.

And I'm not seeing any reboots required. I'm testing with a MX75. Not sure if something would be different on the MX85 as it does use port 4 - which isn't present on a MX75.

[jbright]

I plugged the MG51E into the MX WAN2 and immediately got IPV4 and IPV6 addresses on it.

So it is confirmed that the MG51E can provide an IPV6 address and it does not show up on WAN3 on the MX.

[Ryan_Miles]

Gotcha. I now also see IPv6 on my WAN 1 & 2. Just took a little time I guess. 

[Ryan_Miles]

IPv6 has been added to the caveats section. Thanks for the catch @jbright 

https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink#Caveats