New MX feature: MultiWAN Backup Uplink (third/backup WAN)

[Ryan_Miles]

As promised at the launch of MX18.2 support for a third/backup WAN port is now available on supported models (MX75, 85, 95, and 105) when running MX18.208 firmware.

Documentation: https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink

Be aware that when enabling this feature you will need to use SFP WAN ports (which you might not be doing today). So, make sure to review the above documentation for WAN port behavior on the MX75 and 85-105.

I'm also including my own slide deck covering the feature with a WAN failover animation slide and some examples of loss during WAN failures for Internet and VPN bound traffic.

https://docs.google.com/presentation/d/19zAJMSewQYFQJILjWsGz9t8zoQkOeYoNRSM9kSYf5ns/edit?usp=sharing

In my testing I was shutting down the switch port connected to the MX WAN port. As always, failover times can vary based on the nature of the failure (hard down vs. upstream failure). And failback behavior will depend on the setting you have configured (Graceful vs. Immediate). 

Be aware, when you enable (or disable) the backup WAN feature it will do a soft reset on the MX and cause a brief outage, similar to what you'd see when enabling a WAN 2 port on a MX67. So, do this in a maintenance window or whenever you can incur a few minutes of disruption on the MX.

[alemabrahao]

Great to know, too bad it's restricted to specific models, but better than nothing. 🙂

[cmr]

Excellent! It is a shame that the MX100 doesn't support 18.2 as it has many WAN ports... 

[GreenMan]

To be accurate:   MX100 has many LAN ports     While physically the ports look the same, architecturally LAN ports and WAN ports are very different.   I know that's a little hard to square with the fact that some MXs have (a) hybrid port that can be switched from one to the other - but that's very much a specific exception.

Unfortunately MX100 and some other older models don't really have the 'oomph' to add the new capabilities available from 18.2 onwards.  (details here:  https://documentation.meraki.com/General_Administration/Firmware_Upgrades/Product_Firmware_Version_R...)

[cmr]

@GreenMan I may be wrong, but I believe the MX100 can physically have many WAN ports, but this was never done:

Ports 2-11 should all be WAN capable!

[RaphaelL]

I don't want to get side tracked here , but in your slides you mentionned a part about Insight and WAN3 will only work if WAN1-2 are down.  On MX68CW , WAN3 is showing since MX16 ( since the addition of Cellular Active uplink ) However , even if you don't have Cellulare active uplink enabled WAN3 will still show up as down. Will this ever be fixed ?

[Ryan_Miles]

I see a logged bug on this. No idea when it will be resolved though.

[ShawnHu]

And we have the demo environment on this feature for Cisco and partners. Check this post.

[jbright]

I have implemented this on my MX85 and it is working fine, now.

I inserted the Copper SFP in Ports #1 and #2, rebooted the firewall and
moved the ethernet connections over to the SFP ports. Once I verified

those were working again, then I switched over to Multi-WAN and connected

my MG51 to Port #4. The MX was able to pull an IPV4 address from the MG51 NAT Pool.

I tried disconnected the ethernet cables from both SFP modules and the firewall

did not switch over to WAN3. The firewall completely dropped off the internet and

the dashboard. I connected both internet ethernet cables back to the

MX and once those came back up and the MX was visible on the dashboard, I rebooted the MX again.

Once the MX came up, I tried again to unplug both internet ethernet cables and this

time the firewall did switch over to WAN3. It also sent an email alert stating that it

had switched over to the cellular port. In this case that is correct, but I think the

alert should say WAN3 and not the cellular port.

I connected the two internet ethernet ports back to the MX and it immediately

started using them again. So a second reboot of the firewall after switching to

Multi-WAN seems necessary for the failover to WAN3 to work correctly.

One bug that I see is that even though IPV6 is enabled on WAN3,

the MX is not pulling an IPV6 address from my MG51, which is getting an

IPV6 address from the cellular carrier and is enabled to pass IPV6 through

to the MX.

Overall, the implementation of Multi-WAN is not too bad, but finding out

that a second reboot of the firewall is necessary for the failover to work

was a nasty surprise that will likely impact many customers that choose

this feature. Maybe this is also a bug that will be fixed in future firmware versions?

[Ryan_Miles]

Have you tested with the MG connection being on WAN 1 or 2? I don't see IPv6 being passed through to any of the WAN ports in my lab, not just WAN 3.

And I'm not seeing any reboots required. I'm testing with a MX75. Not sure if something would be different on the MX85 as it does use port 4 - which isn't present on a MX75.

[jbright]

I plugged the MG51E into the MX WAN2 and immediately got IPV4 and IPV6 addresses on it.

So it is confirmed that the MG51E can provide an IPV6 address and it does not show up on WAN3 on the MX.

[Ryan_Miles]

Gotcha. I now also see IPv6 on my WAN 1 & 2. Just took a little time I guess. 

[Ryan_Miles]

IPv6 has been added to the caveats section. Thanks for the catch @jbright 

https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink#Caveats

[meraki-user]

If an MX has this third uplink enabled, AND the built-in cellular enabled, which takes precedence? As always, the documentation is extremely lacking. The documentation page for this feature is very small:

https://documentation.meraki.com/MX/MultiWAN_Backup_Uplink

There is not a single mention of how (or if) the two backup ports (cellular, and the new "third port") behave together.

[Ryan_Miles]

Multi-WAN Backup (aka 3rd WAN) is only supported on the MX75-105. None of those models have built in cellular. 

[meraki-user]

The Sydney MX75 used in dCloud Meraki Launchpad shows a Cellular port in the GUI, in addition to the WAN 3 port.  

[Ryan_Miles]

All MX models have a USB port that was historically used for Cellular modems. Starting with MX18 USB support is best effort and no longer receiving any updates. https://documentation.meraki.com/MX/Cellular/3G%2F%2F4G_Cellular_Failover_with_USB_Modems

[meraki-user]

So just to clarify: does this mean that all MX models show "Cellular" in the GUI, but on some models this field indicates built-in cellular, and on other models it just refers to the historical USB port?

[meraki-user]

My original question can be modified to say "USB" instead of "built-in." The question then is, can the uplink labeled "WAN 3" and the one labeled "Cellular" be enabled on the same MX, and if so, does WAN 3 take precedence? And if uplinks WAN 1, 2, and 3 are all down, would the MX then fail over to "Cellular"?

[Ryan_Miles]

@meraki-user Not sure what the expected behavior is. But I'll check with the Product Team. I'll also test it here myself - although I don't know if my super old USB modem will even work on the newer MX models/firmware. 

[Ryan_Miles]

Update - my MX75 and MX95 don't recognize my USB modem. Not surprised as it's ancient and we no longer actively support USB modems past MX 18.

I still have the question out to PM about it. But I'd be willing to bet the answer is that USB is not supported past MX 18 and Backup WAN Uplink requires MX18.2+. So the two would be incongruent. 

[meraki-user]

Okay, thank you for all that information.

I feel like the "Cellular" field in the GUI should have been worded differently, distinguishing between built-in cellular and the USB port. Also, I think the field should be removed from the GUI, in firmware versions/models that don't support it.

[MarcAEC]

The web site is still proudly advertising "Instant wired failover with added 3G/4G failover via USB modem" for the MX75, MX85, and MX105.  I've told support (who said they sent it over to marketing as a "suggestion") and multiple account reps (not sure what they did) that this can be considered false advertising.   It's even more-so that 18.2 firmware is treating USB modems as best effort and the old modems don't actually work at all in the newer models.

[nishmeNtic]

Any plans to roll out to 250's?

[cmr]

I don't imagine that this is planned to be back ported to older hardware architectures like the MS250.  Which is a shame...

[hvdalen]

why is there no option to configure a virtual ip on the backup wan?