Security appliance firmware versions MX 18.211 changelog Important notice USB modems with MX/Z series devices running firmware MX 18 or newer will be limited to best effort support and will not be receiving any future firmware fixes or improvements. Bug fixes Resolved an MX 18.2 regression that resulted in the WAN2 being unable to pass traffic if 1) WAN1 was not in use and 2) cellular was enabled. Fixed inconsistencies with the cellular active uplink feature. WAN 2 cannot be used as a functioning WAN interface when cellular active uplink is enabled. Fixed a MX 18.2 regression that resulted in MX75, MX85, MX95, MX105, MX250, and MX450 appliances being unable to successfully establish IPSec VPN connections when NAT-T was required to establish the connection. Corrected an MX 18.2 regression that resulted in MX75, MX85, MX95, MX105, MX250, and MX450 appliances failing to form AutoVPN or teleworker tunnels with other peers via their LAN interfaces. Resolved an issue that made MX75, MX85, MX95, MX105, MX250, and MX450 appliances more likely to rewrite the source port of traffic being NAT'ed out a WAN interface. Fixed an issue that resulted in the VPN status information for non-Meraki VPN peers being shown incorrectly on the VPN status page in Dashboard. Fixed a rare issue that could result in the AnyConnect VPN process becoming unresponsive on MX75 and MX85 appliances. Resolved an issue that could result in AutoVPN tunnel instability on both MX uplinks when packet loss and intermittent connectivity occurred on one uplink. Corrected an issue that could result in Z4C appliances being unable to successfully pass cellular traffic when using a Telstra SIM. Fixed an issue that resulted in MX75, MX85, MX95, MX105, MX250, and MX450 appliances tracking information about upstream WAN addresses as if they were local clients if 1:1 or 1:M NAT were configured. Resolved an issue that resulted in uplink connectivity tests for IPv6 being routed incorrectly. Fixed an issue that could result in an increased level of jitter and latency for AutoVPN traffic on Z3(C) appliances. That would specifically occur during periods of low and infrequent AutoVPN traffic. Stability improvements for MX75, MX85, MX95, MX105, MX250, and MX450 appliances. Resolved an issue that could result in MX appliances with adaptive policy configured encountering frequent connectivity state changes for AutoVPN tunnels. Corrected a MX 18.2 regression that resulted in the SIM and APN configuration being shown on the device local status page for devices without integrated cellular modems. Reduced the potential for existing traffic flows to be disrupted from configuration changes on MX75, MX85, MX95, MX105, MX250, and MX450 appliances. Resolved a rare issue that could result in the AnyConnect client VPN process crashing. Corrected a rare issue that could result in an IPv6 delegated prefix not being visible in Dashboard. Fixed a MX 18.2 regression that could result in MX appliances not performing ARP for virtual IP addresses, 1:1 NAT IP addresses, and 1:M NAT IP addresses when 1) the MX was configured in high availability and 2) had WAN1 disconnected or disabled. Legacy products notice When configured for this version, Z1 devices will run MX 14.56. When configured for this version, MX400 and MX600 devices will run MX 16.16.9. When configured for this version, MX64(W), MX65(W), MX84, MX100, and vMX100 devices will run MX 18.107.10. Known issues status This list is being reviewed and updated. Known issues In rare cases, MX67C, MX68CW, and Z3C appliances may fail to enter into a "Ready" state despite being able to register to a cellular network and obtain an IP address for the modem. The Non-Meraki VPN service may fail to properly establish IKEv2 tunnels when the MX appliance is acting as the IKEv2 responder and many allowed subnets are configured. Due to an MX 18.2 regression, the link light LED for WAN2 on MX75 appliances will not light up if WAN2 is the only wired interface in use. Due to an issue with no known method of reproduction, the IDS and IPS process may unexpectedly restart. When a WAN failover occurs, Non-Meraki VPN tunnels will persist on the backup, non-primary uplink after a failback to the primary WAN interface if the WAN interface uses IPv6. Due to an issue still under investigation, MX appliances may experience an unexpected reboot when ThreatGrid is enabled. MX AutoVPN tunnels fail to generate new connections when the AutoVPN flow has been blocked or filtered unidirectionally by an upstream or intermediary device. This prevents appliances from automatically working around this partially connected state. MX appliances may experience unstable eBGP connections when 1) the MX appliance is configured in Routed mode and 2) the MX learns a large number of routes from its eBGP neighbor. This may result in eBGP-learned routes being inaccessible. Other Improved AutoVPN failover times for VPN connections between MX appliances running MX 18 or higher.
... View more