Meraki Community

Oucean · ‎Jun 28 2024

Hi Tellis002 I used to work with multiple layer-2 networks so I'm always thinking STP should work fine... Could you please update in this thread when you get a feedback from Meraki? I'm also very curious about what will cause this kind of issue. Thanks a lot.

Oucean · ‎Jun 8 2024

Hello Glden Joe Thanks for your reply. Oh...I'm very sorry. I forgot to highlight this part. Yes, I know Meraki MS switch can't manually adjust some attributes. So actually in this design, the two switches are not Meraki switches. I can't find other switch's icon so I used MS switches to draw this diagram. Sorry, It's my fault. So in this design, I'm planning to use port priority on these two switches to manually select preferred port. And I believe this work fine. But still, what I'm keeping thinking is, why Meraki doesn't suggest this design (With one cable directly connect two MXs with proper VLAN configuration). May I ask if you know other potential issues for this design? Exclude the issue may caused by Meraki MS switches. Thanks a lot.

Oucean · ‎Jun 5 2024

Hello PhilipDAth Thanks for your reply. And yes, MX series is not spanning tree aware. It will just forward spanning tree packet (BPDU) within the broadcast domain that the packet was received. So I believe I can say from STP perspective, the diagram is like below. The STP will still work to block one port to avoid layer 2 loop. I think this is good. If there is some non-optimal traffic flows at layer 2, we can manually configure STP attributes to manually select which port to block, right? And if using multiple VLANs, we can see the link between two MXs to allow the same VLANs (Also the same Native VLAN). Seems...I don't think this will result in an outage? But let's see your "ps". I think this will cause issue. Just image if one of the switch is down, or the link between the switch is down. Then both MX can not receive VRRP packets from each other, right? So both MX will be the active one. I think this will high possiblely result in an outage.

Oucean · ‎Jun 5 2024

Hello Everyone Just got some mental block about MX HA Warm Spare design. In Meraki Document, we all know that the recommanded diagram from Meraki for two MX HA and two switch is as below. And below one seems not recommended by Meraki. The reason in this document says "there is an increased potential for a spanning-tree loop". Although this is for one switch design, just still it is not recommended by Meraki. But I'm confused... In my opinion, the less cables, the easier to manage. If something goes wrong, there will be less "road blocks" while troubleshooting. So...Does anyone know if there is any reason Meraki doesn't suggest this way? I know we must connect both MXs. If not, the two MXs will become both active if the cable between switches is down or if either switch is done. And I also know MX will not run STP but they will forward BPDU, so I believe STP can work properly to avoid layer 2 loop. So I'm thinking, maybe connecting both MXs with the same VLAN configuration and ultilize STP on the two switches to avoid layer loop will be a better choice? May I know your opinion? Thank you very much.

Oucean · ‎Dec 26 2023

Hello Ruan Thanks a lot for your reply~ And yes, if primary MX is down Server 1 will be unreachable. Actually that's an expected situation. If we use two switches, and if one switch is down, the server under that switch will also become unreachable. So in fact, both servers are also HA build for one service. Now I got what should I do. Many thanks again for your kindly help.

Oucean · ‎Dec 26 2023

Hello Everyone Our customer has a Meraki network that only contains MX Security Appliance. Since the customer wants to avoid one more failure point and also to save cost, they didn't purchase MS Switch for this network. Now the customer wants to enable HA architecture for this MX only network. So I'm thinking if two MX appliances (of course the same model) can enable HA without an MS switch and hosts under two MX appliances can all work fine? For example, like below topology. VLAN 101 was created on both MX appliance with private IP address 10.1.1.1/24. This VLAN is used to connect with each other and to the hosts under them. So when the Secondary MX works in Spare mode, will its LAN part still be functioning as a L2 switch and make the Server 2 be able to access Internet via Primary MX? I know the best way to confirm this is just to do a test, but I'm sorry currently I don't have the environment to do the test. Only if it can work, the customer will purchase the secondary MX appliance. So I raised this post to request everyone's help. May I know if any one tried this way and is it working fine? Thanks very much in advance.

Meraki Community

About Oucean

Oucean

Community Record

Badges

Re: In MX HA Warm Spare design, does anyone know why Meraki doesn't recomme...

Re: In MX HA Warm Spare design, does anyone know why Meraki doesn't recomme...

Re: In MX HA Warm Spare design, does anyone know why Meraki doesn't recomme...

In MX HA Warm Spare design, does anyone know why Meraki doesn't recommend d...

Re: In Meraki MX HA architecture, will the spare MX (LAN Ports) still be fu...

In Meraki MX HA architecture, will the spare MX (LAN Ports) still be functi...