No problem @Maccaa31 I am sure this would work for you, as worked for me Answering your question, the MPLS should go to the internet port(1 or 2) on both MX devices (look at the diagram).The MX devices will treat it as an internet link, as long as you are allowing the Meraki cloud IPs from the MPLS. Technically you would be cheating the MX devices to think this is an internet link. Do not forget to allow ICMPs to Google 8.8.8.8 ... View more

Hello @Maccaa31  yes this actually worked for me and has been working perfectly for years now with no issues at all. Make sure your MPLS has a breakout to the Meraki cloud IPs (same as the diagram I posted above), the IPs are in the following link: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity ... View more

Hi @Oleh  Well I got this resolved and running smoothly for more than a year now, by having an internet breakout somewhere on the MPLS, you only need to allow access to a set of IPs and subnets and advertise them to the MPLS network, where they can be reached by remote MX devices I am assuming you are not running MXs in Concentrator mode at the HQ. Look at my diagram above. ... View more

It is an MX68, the subject is about wired port security. ... View more

An update on this post. I contacted a Meraki Architect and he enabled the 802.1x for our dashboard on the MX68 devices, however he mentioned that I need to have the latest beta version and this is only for Lab testing. We tested this in our lab and it seems to be working, I will not be deploying this to our production environment until this is official announced in the next 3 month (as per the Meraki Architect).   ... View more

Hi @RaphaelL  Kindly post what you get from Support, we are interested in this too. ... View more

Hi @GldenJoe We have exactly the same situation with MPLS and Internet on both Hub and Spoke with SDWAN policies configured, however what was annoying us was the tunnel going from inside the MPLS on WAN1 Spoke to the internet on WAN2 on Hub, we contacted Meraki Support and they advised that this cannot be turned off (we only wanted 2 tunnels WAN1-to-WAN1 and WAN2-to-WAN2), we ended up by blocking the Public IPs of the Hub WAN2 internet link from the MPLS breakout FW, this way we had 3 tunnels rather than 4. I believe the spoke MX would use the tunnel with lower RTD on the same interface, even so I had no confirmation either. We have a point I believe there should be a way to control how many tunnels should go through each WAN interface. ... View more

802.1x on MX68 will be available in future stable releases, we are testing this in our lab with Beta firmware. ... View more

Hi @meraki2champion  I believe the terms are not comparable, you can still use SD-WAN over MPLS in a special setup. MPLS is a dedicated service with high availability and SLA, which mostly does not use the usual ISP nodes to get connected. If your customer is insisting on a single MPLS link, versus a dual ISP Link with SDWAN, then it depends on the situation. At some locations/countries, the internet might not be as stable as required, even not resilient as required, hence an MPLS link might seem to be more efficient. I believe you should study the situation more before advising your customer. ... View more

I do not see any limitation on the MX, after all the switching functionality on the MX is basic (Vlans, Access/trunk...) ... View more

Hi @SAM-Al  For your question, I do not think it is a good idea to have the intervlan routing done on the MX devices, this will have unnecessary load on them and it is not best practices. Better that the Core MS switches take care of interconnecting the vlans and separate them from the MX (on L2 I mean), ... View more

Anytime Sam, let me know if there is anything else I can help with. ... View more

Hi @Pugmiester    We faced almost same situation, and we were able to create a small guide for the users to deploy the MXs (HA pair too), get similar devices and you should be able to do it yourself, try to be in their shoes, here are my very high level points   1- First make sure the cabinet/rack is able to accommodate the devices and has enough power sockets 2- Second make sure the Internet Modems have enough Ethernet ports and can supply DHCP IP 3- Create a small Diagram of the actual devices using visio, like this one, with the cabling details 4- Your staff should identify the devices for you by Serial number, so you understand what you are doing when configuring them remotely, you can even prepare the config before the devices even gets online 5- For the setup page, just take that part from this documentation, (it worked for us): https://documentation.meraki.com/MX/Installation_Guides/MX64_Installation_Guide   ... View more

Hi @SAM-Al  Between the MXs and the MS425 you can use any VLAN number I would suggest not to tag traffic, just configure the MX devices with all LAN ports as Access VLAN X (Enable the option below then configure them), and the MX425 with Access VLAN X (choose X to be unique VLAN  to keep a clean design). I would not recommend to keep a different VLAN between the MXs only, as this will be a confusing design, and it is preferred to have different paths between the MX devices and the switches, you are protected from loops by RSTP, bottom line, after all the MX LAN is actually a switch.   On your second point, the MX devices will only have single VLAN configured and there is no overload, however you need to design your next hop carefully (the one which gets you to the end Access VLANs) just print the diagram and start simulating what if the one of the MXs is down, what if one of the switches is down, etc...   ... View more

Below is what I received, and it does not give any hint that this would be enabled in the future, but again, which future are we talking about, if you raised this 6 month back and till no there is no plan for it. "The 802.1X feature is MX model specific and it is not possible to enable it on MX68 and MX84. Unfortunately there is no way to enable it." ... View more

@RaphaelL , I tested the latest beta firmware before posting here, it is not there, but if you had a feedback from support this is planned for the MX67/68 then, what we can only do is wait. I believe this is an important feature which should be kept. ... View more

@Aaron_Wilson, this is exactly what I am referring to, the MX is a security device after all, they cannot drop a feature which would secure LAN ports, when I contacted support they never provided a solid answer, they just said this feature is not available. I am with you this should really be enabled. ... View more

@SoCalRacer , yes it is available for MX64/65 and not for MX67/68: "MX64(W) and MX65(W) Security Appliances as well as Z3(C) Teleworker Gateways support port-based access policies using 802.1X. This feature can be leveraged for deployments where extra authentication is desired for devices that are connecting to the MX." ... View more

Thanks @ww for your answer, do you have any reference stating that this will be available in a beta firmware? I can wait for it, or even test it in production. ... View more

When I raise a ticket to a support desk, I expect a reasonable answer, not just saying MX68 does not support 802.1x. If Meraki would say MX68 is a replacement for MX65, then you should expect that all the features to be available, if not this should be mentioned somewhere, I did read all the documentation for MX65 and I know what I am taking about. Such comment from you does not help in any way. ... View more

I depends on the type of applications/ traffic flow you have. In my case I do not mind traffic being Natted on MPLS network (no voice traffic), and I was able to achieve what I want from the setup However I would always prefer to have WAN links to be connected to WAN1 and WAN2 then achieve an SD-WAN setup or load balancing For your case, you are stuck with static routes which hinders the power of SD WAN policies. Meraki recently added to the beta firmware release 15.2 a feature for NO-NAT where the MX behaves like a L3 device, but does not do NATing on the uplink. This makes a perfect option for your case, if you would like to take the risk of having running a beta version ... View more

Thanks @PhilipDAth  So we got everything set now, and both MX devices see there interfaces as active. However I am facing an issue with VPN tunnels, when both lines (MPLS and Internet) are up and running, everything works great (eventhough I did not test SDWAN and path selection yet). However when the Internet line is down at any of the devices, the tunnel would be down and it seems that the Internet1 of the working Internet line is trying to form an IPSEC tunnel to the other MX device over the MPLS link! and it not getting up (that is normal because the MPLS connectivity does not allow traffic from the outside except for Meraki Cloud). I attached a diagram. ... View more

Hi @PhilipDAth Actually I am trying to achieve what we have Auto VPN over MPLS and SDWAN:   https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_over_MPLS https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_SD-WAN     With the following assumptions: -Both MX Devices will run in NAT Mode (Not VPN concentrator) -Both MX Devices will have one leg to MPLS (which has a router splitting traffic to the internet) -Both MX Devices will be connected to WAN1 to the internet     I cannot get the tunnel on WAN2 up, I am not sure how to configure it. ... View more