Moving Layer 3 & 7 firewall rules from the MX to MR

[rsage_voda]

I have a customer with a HA pair of MX450 that Meraki have advised are running very close to the limit. Anyone have experience of deploying Firewall rules on the MR's. Logically to me it makes sense to drop traffic as close to the source as possible.

Any gotcha's I need to be aware of

[KarstenI]

IMO, it only makes sense if you have separated VLANs for Wireless. If not, you need the Firewall controls on the MR and MX sides, which can be an administrative burden.

[PhilipDAth]

Which limit are you running into?

Session limit?

CPU limit?