So after speaking to Meraki Support, I now know the following. It is expected behaviour. The MX maintains maps of flows for a minimum of 5 minutes to facilitate what the support rep described as graceful failover. ANY flow that the MX sees that it has a map for (e.g. any flow in the last 5 minutes) it will hold that flow to the previous map indefinitely. So if the MX fails over to the WAN2 it will disrupt traffic and force the traffic to use WAN2. Expected. When the MX switches back to primary, it still sees any flows in it's maintained maps until there is no flow from that Src, to that Dst for > 5 Minutes. (Seems ridiculous to me) So this means it will stay using the failover WAN forever if there is a lot of flows from that Src to that Dst. There is apparently a back end (Meraki Engineer only) way to change this, BUT... You must have the MX on a dedicated MX network, not a combined network, AND you must be running v17.x firmware, which at time of writing is not a stable release. This seems quite ludicrous to me. Why would you want the flow to remain on the secondary WAN (in a non-load-balanced network), after switching back to primary. I can understand you wanting that TCP session to finish to avoid interruption, but not the entire flow. so a 5-10 second window I could understand for smooth transition between WANs, but not 5 minutes. Anyway, that is what I have been told. Hope that helps someone else that runs foul of this.
... View more