OK - it would probably have helped if you included some information on your diagram, as to how VLANs are being used on the switches, to interconnect different components and ports (I'm still not sure why you have MX LAN ports linking to the upstream switches), but I think I understand your latest question: basically the upstream PA firewall is changing the public IP address which the MX would be using over WAN1, as part of its own failover mechanism. This should work ultimately, I imagine, provided you have appropriate rules in the upstream firewall to allow the comunications from the MX to Dashboard and other Meraki cloud resources, via each public IP, but it will take time - and might even require an MX reboot. By default, even discovering that the upstream primary path isn't providing Internet connectivity will take five minutes: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover The MX then has to re-register with Dashboard, using the new public IP address. How long did you leave it - and did you try rebooting the MX(s), as part of the diagnostics? Basically - MX failover isn't designed to be based upon the MX having the public IP of a WAN port changed; it's designed to make use of the fact that it has two ISP links, each with its own public IP (MX then checks in with Dashbord using both).
... View more