PSA: Upgrade Your MX64/65 Security Appliances for Continued Snort Support!

[Phi-L]

Hey y'all, Phil Coburn from Product Enablement here, with a friendly announcement for our MX64/65 owners! 

In May 2025 we released firmware 18.1.7.13 for the MX64/65 security appliances. There were several updates and fixes in this version, but the primary change was that our MX team bumped the version of Snort 2 -- the MX security appliance's IDS and IPS -- to 2.9.20. This provided MX security appliances with updated rule sets, protecting them against newly discovered vulnerabilities.

However, just a week ago Snort announced that other versions of Snort 2, like 2.9.18.1 and 2.9.19.0, are deprecated and will no longer be supported as of 12/18/2025. Since older versions of MX firmware (before 18.1.7.13) use these soon-to-be deprecated versions of the Snort 2 engine, if your MX64/65 security appliances aren't upgraded to the latest stable MX firmware release they will not have the latest Snort 2 IDS/IPS rules... and the last thing you want is for your IDS/IPS to be out of date. 

If you'd like to keep your MX64/65s up to date with the latest IDS/IPS rules (yes, you do), then upgrade to the latest stable firmware release. As always, you can find this under Organization > Monitor > Firmware Upgrades. Good luck, and stay safe! 

[James_Craig]

Is the MX84 affected by this announcement at all?

[James_Craig]

Actually, reading the documentation below it seems that the MX84 is running Snort 3:
https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Versio...

[AlexP]

Hey James,

We're working on some documentation updates to help clarify the scope of this a bit better in the section you just called out. If you have any feedback on how we can make it any clearer, please let me know

[JamesC_AB]

HI Alex,

That documentation section mostly gave me the clarity that I was looking for. The only lack of clarity is due to issues which are separate to the topic at hand.

I think it's understandable why people are asking questions about the MX84 and MX100 since they have similar 18.1 firmware limitations as the MX64 and MX65. But the documentation covers that if you read carefully - so I think it's optional whether or not to explicitly call that out.

I also think it's understandable why people are getting confused about the MX's (lack of consistent) firmware versioning notation. Until this is fixed everywhere, it should probably be a requirement of your documentation to help customers to navigate this conundrum.

My suggestions for an edit to the section follow in red:

---

WARNING: MX64 and MX65 devices on firmware releases prior to MX 18.1.7.13 (a.k.a. "18.107.13"), and all other MX devices on firmware prior to MX 17.6 run versions of Snort 2 that will stop receiving updates after December 18, 2025. All network traffic will continue to pass normally and be inspected using outdated signatures, which may expose clients to a reduced security posture until the firmware is updated.

To ensure that such devices continue to receive updated rule sets, please ensure they have been upgraded to MX 18.1.7.13 (a.k.a. "18.107.13") or any higher firmware version before the above date.

For more information, please refer to this Snort blog post.

Note: MX84 and MX100 devices on firmware releases ≥ 17.6 are not impacted by the Snort announcement.

---

[alemabrahao]

Hi @Phi-L 

But the release notes for the most current version and the release candidate version state the following:

Legacy products notice When configured for this version, MX64(W), MX65(W), MX84, MX100, and vMX100 devices will run MX 18.107.13.

[RaphaelL]

18.1.7.13 = 18.107.13 

This is also the same way the firmware is presented with the API : 

"firmware": "wired-18-1-07"

I don't know why 🤔

[alemabrahao]

I suspected it from the beginning. 😅