As per the licensing FAQ: "...This means that you will no longer be able to configure or make changes to your Meraki network device, and your Meraki network product will no longer pass traffic."   So at minimum no network traffic will pass through the device but I'd say it's likely the SSID's will also stop beaconing. ... View more

By default the Meraki Client VPN establishes a full tunnel connection, meaning all of your network traffic from the client is tunnelled to the Meraki gateway. This would include web browsing and office resources. However, split tunnelling (where only internal traffic is routed across the VPN) can be configured on the client. Configuring Split Tunnel Client VPN - Cisco Meraki ... View more

I believe it can be done using an Azure site-to-site VPN and/or Meraki vMX appliance. The following blog (written by a Meraki engineer) provides some detail - Meraki MR 802.1X with Azure Active Directory – APICLI ... View more

1. Meraki switches should continue forwarding indefinitely if they lose cloud access (at least as long as the license allows) 2. That's a good question. I would assume it stays running until next time it becomes cloud connected but I've never tested this (I'd say very few people have). Might be a good question for your Meraki rep.   3. You can make some changes to switchport configuration and uplink configuration. It's primarily designed is to be able to get the switch cloud connected again after a potentially incorrect configuration change - Using the Cisco Meraki Device Local Status Page - Cisco Meraki 4. Depends on what you mean... Meraki configuration that has been applied more that 30 minutes ago (and the device has not rebooted) is considered 'safe', which then has implications on what happens if it loses access to the cloud. Behavior during Connection Loss to Cisco Meraki Cloud - Cisco Meraki In terms of backing up configuration, it's not exactly a requirement given all configuration is cloud managed but there's a few tools (paid and not paid) that enable this function - IFM - Backup Meraki Config to an offine file ... View more

This might be what you're looking for: "The MX supports L2TP/IPsec Client VPN and AnyConnect VPN simultaneously. "   AnyConnect on the MX Appliance - Cisco Meraki ... View more

Chances are you can configure just about all of this in the firewall on the MX250.   Outbound rules can be set with the applicable source/destination subnets & ports to allow/deny. Or you can add an explicit deny all as the last configurable rule. The rest depends on your topology:  - Whether the static route is for a WAN port or LAN port or S2S VPN?  - Is your MX setup for NAT or No-NAT? Is it common practice to deny all outbound connections in the firewall and only allow wanted outbound connections?  It really depends on your use case, traffic flows and security you're putting in place. For example blocking all outbound except for specific allowed rules is a common firewall technique. However for many SMB's it is too much overhead to implement and maintain the rules. Therefore the trade-off may be that they leave the allow any-any rule for an arguably less secure but easier to manage environment. ... View more

North-South will definitely require solid switches given all of your Management, VM Network and vMotion traffic will be going through it but the requirements for those should be exactly the same as any other server solution (HCI, traditional SAN etc). I can only see PFC being a requirement if you're using the same switches to push the storage traffic across, or presenting the storage directly to other hosts on the network. In that circumstance though, I'd probably just opt for physically separate switches. That said, these are all assumptions. The only HCI solution I've worked on (albeit very closely) is Cisco Hyperflex. ... View more