Xbox Series S/X with a Meraki MX

[Alex413]

Hi everyone,

I'm running into issues with Xbox Live on a Meraki MX where the NAT type is showing as Strict. As far as I know, Meraki doesn't support UPnP, which complicates things.

From what I’ve read, the suggested solution involves setting up 1:1 NAT with a wide-open bi-directional rule. Has anyone here had success with this approach? Or perhaps found an alternative workaround?

I’d appreciate any insights or suggestions you might have.

Thanks in advance!

[SupaStud1994]

Good afternoon Alex. I would not reccomend using a 1:1 Nat as it could expose (and probably will) your xbox to the entire internet. If you are getting a Strict NAT type this tells me that your firewall is probably behind a NAT OR your ISP is also NAT'ting your internet connection. A quick check for when I run into this is to see what the actual IP address is you are getting on your firewall. If you check the uplink tab under appliance status. you should see "public IP" in grey with what Meraki sees as your public IP. If that IP is not the same as your WAN 1 confgured IP then likely your device is behind a router or something is Natting your device upstream. Often with home users your ISP provides a local network (192.168.x.x 172.16-32.x.x or 10.x.x.x). If that is the case you would want to work with them to get your router configured in pass through mode so that your MX pulls a public IP rather than a private. 

[PhilipDAth]

Their is an option called something like "NAT persistence" that support can enable that helps this issue.  Check out this post.  Also search on things like "Nitendo NNAT type D".

https://community.meraki.com/t5/Security-SD-WAN/Nintendo-Switch-NAT-Type-D/m-p/248820

[SeanW]

This may or may not help you, but I was playing around with this issue last night. In my home I have two Xboxes and a PS5. I had all the ports setup including the alternate ports for my second Xbox and I was getting strict NAT or Type 3. Now for giggles I went into the traffic shaping and told the MX to prefer WAN 1 and all devices either went to open or type 2. I also tried setting the rule to WAN 2 and once again the issue was in a good state. @PhilipDAth I'll give your link a read so thanks for sharing.