Warm Spare NAT mode

[Sengly]

Hi team,

I try to read the document about Warm Spare NAT mode from here: https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair and this one provide good explanation but it didn't mention much about LAN part. And i have question below:

1. Will the MX secondary take over the role and use the IP that we assign as MX (both MX use the same IP)?

2. Connection from MX to Switch is control by STP like my attach picture?

3. For WAN port i can see that the recommend is to use 3 IP however, can we use only 1 IP if so what is the pros and cons?

[Bruce]

1. Yes, when the secondary MX becomes active it uses the IP address of the primary MX, there is only one IP address for each VLAN on the LAN side.
2. No, there will be one STP forwarding, and one STP blocking connection per MX. So in your diagram both links to Switch A would likely be 'STP Active'. The MXs communicate at Layer 2 all the time through VRRP frames.
3. You can't use a single IP address on the outside for a HA pair of Meraki MX, you need a minimum of two - one for each MX, this is because the redundant MX still needs to communicate with the Meraki cloud. With three IP addresses the VPN shouldn't drop when you failover to the redundant MX (since one IP address is passed from the primary MX to the standby); with two IP addresses the VPN tunnels will be torn down and rebuilt as the IP address changes.

[Sengly]

Hi Bruce as you said both of the link from MX A to Switch A are active will it be loop in there? As we will use L2 on the stack switch and we don't have link aggregation on MX. 

[Bruce]

There will likely be an active link from MX A to Switch A, and an active link from MX B to Switch A; both the links to Switch B will be blocking. There won't be a loop (you are correct in saying that if both links to MX A were active then there would be a loop).

EDIT: I say 'likely' as you can never quite be sure which ports will get Blocked by spanning tree as you don't know the actual port costs; you can take a good guess, but sometimes an unexpected port gets blocked.