Hi,   a quick question, I´d like to know if it`s possible to access a MX-Firewall which operates in Passthrough/One-armed Concentrator Mode from WANside? I can`t see any possibilty to configure Security appliance services  section...   thank you in advance! ... View more

Hi,   I´d like to ask you some questions about the following solution scenario: the requisition is, to setup a Guest-WiFi with some MR`s where the SSIDs would be configured in Bridge-Mode where the DHCP-Server is located on an Upstream Router... To get some Content/URL-Filtering I think of using the Cisco Umbrella Solution which could be integrated in/with the Merkai Dashboard. In that typical network level Umbrella deployment, pointing DNS to Umbrella alone may not be sufficient to enforce Umbrella protections. Savvy users may attempt to bypass Umbrella by changing the DNS settings on their machines, so the question for me is, if it`s possible to use the integrated MR Firewall configuration to lock down the users on the Guest-Network to prevent any other DNS service from being used to bypass Umbrella settings and protection (e.g. with an ACL-entry "deny udp any any eq 53")? I`ve read through the following documentation -> https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment   but I don`t understand the marked area... how can/does the MR restrict that traffic, if it`s send to the Clients LAN Standard-Gateway (which would be the Upstream Router)?   probably someone has already done a deployment which is similar or could tell me if the design approach is suggested at all 🙂 ... View more

Hi,   unfortunately I do`nt understand the following documentation about "Configuring Active Directory with MX Security Appliances...   let`s assume I`d like to setup " MPLS Failover to Meraki Auto VPN" while the MPLS connections terminate on the LAN side of the security appliance! W ould the AD integration work on the central Hub side or not?     ... View more

Hi Guys, when I look at the following network plan (https://meraki.cisco.com/lib/pdf/meraki_whitepaper_vpn_redundancy.pdf), I don't understand - why a Layer3 switch is used/necessary in this scenario? wouldn't it make more sense to "connect" the MXs from L3 perspecitve directly on the 3rd party firewall?     Assuming the layer3 switch terminates the customer vlan`s /w ip-subnets you could also regulate this traffic on the FIrewall?!   I appreciate every opinion - thank you! ... View more

Hi all,   I´d like to ask you some questions about a MPLS Failover to Meraki Auto-VPN design! Note: please do not measure the sensibility of the deployment, I`m just thinking and try to get a better technical understanding how things could/would go 🙂   In my example topology two sites (Spokes) with MX security appliances (each in NAT-Mode) are connected over an MPLS connection as well as the Meraki site-to-site auto-VPN over Internet to their HQ-MX (Hub) also acting in NAT-Mode. The MPLS links are connected to LAN interfaces to prevent NATing of traffic. All Traffic (Corporate + Web) should utilize the MPLS connection, until a failure occurs, in which case the traffic will be sent over the Meraki auto-VPN. So in both cases the Internet Access should break out centrally! In BO-01 is a File-Server located which has to be accessed from the Internet via a Public-IP - which is 1:1 mapped on the HQ-MX...   Q1-) when using the LAN Interfaces for the MPLS connection, is it possible to influence traffic (e.g. QoS re-marking, ACLs, etc.) -  or would it be better for these requirements to use NO-NAT on the 2nd WAN-Interface which is yet a beta feature?   Q2-)  is it even possible to use the Hub MX (in NAT-Mode) to terminate the Auto-VPN Tunnels on the specified WAN-Link and also use that WAN-Interface for PAT the IP-Traffic from the Branch-LANs with all possible functionalites e.g. L3/L7-Firewall Rules, Content-Filtering, etc. without problems?   Q3-) if the MPLS connection of the BO-01 fails and all traffic is routed over the VPN-Tunnel; is access to the file server still possible in this case or are there perhaps problems with intra-interface traffic or anything other? ... View more