Supported prefix length for SD-WAN firewall

[jeffreyh]

Hi,

I have been asked to setup the internet connection for a meraki firewall and have been asked to use a /30 point-to-point address because the meraki can't support a /31. We (I work for the ISP) normally allocate /31 addressing to such links to preserve addressing surely in 2018 a /31 subnet is supported?

[PhilipDAth]

You would like to think the MX supported /31's, IPv6, IKEv2, etc - but alas no to all of these (at least not right now).

If you work for an ISP, I would suggest you consider using DHCP allocation - because then you can give out /32's - and have even less wastage.  The Meraki can handle being given a /32 via DHCP (as can pretty much every other piece of CPE).

Assuming all of your clients get presented at layer 2, and you are using a Cisco IOS-XE router, then you can use something like the below.  Note that 10.1.1.x would be your public address space, and that this makes the DHCP allocation static based on the VLAN it is coming in on (rather than the normal MAC address).

So - make the jump to /32 allocations and save even more address space!

ip dhcp use subscriber-id client-id

ip dhcp subscriber-id interface-name

!

ip dhcp pool dhcppool

network 10.1.1.0 255.255.255.0

default-router 10.1.1.254

 update arp

   address 10.1.1.30 client-id "Gi0/0/0.30" ascii

   address 10.1.1.40 client-id "Gi0/0/0.40" ascii

!

interface Loopback0

  ip address 10.1.1.254 255.255.255.0

!

interface GigabitEthernet0/0/0.30

  encapsulation dot1Q 30

  ip unnumbered Loopback0

  no ip proxy-arp

  ip verify unicast source reachable-via rx allow-self-ping

!

interface GigabitEthernet0/0/0.40

  encapsulation dot1Q 40

  ip unnumbered Loopback0

  no ip proxy-arp

  ip verify unicast source reachable-via rx allow-self-ping