I would not suspect the secondary MX unless the HA pair was showing as Master/Master in the dashboard as that may cause some confusion for the upstream device. I would also question the switch port configuration on the ISP equipment to see if a VLAN mismatch is causing any problems in the forward of traffic since this worked as expected with just a single MX in place. In this instance not using the shared IP of the MX may be causing problems with the 2 appliances having different IPs if they are both master at the present time.  If when you power of the spare MX appliance and if things start working as expected I would request you call in and work with support opening the original ticket if its still not open and outline the troubleshooting done as you can then clearly narrow it down to the HA pairing especially if the Primary MX is working through the Ubiquit switch.  Are or have either of the MX appliances been alerting in the dashboard or have you seen any failover from primary to spare? I ask this as if the spare is in secondary it will only do the management connectivity items used to ensure its able to be online in the Meraki Dashboard and that it has internet connectivity. If the MX appliances both show Master there may be a routing issue connected as they could potentially both be receiving the inbound traffic.  ... View more

Greetings, Prior to adding the Spare MX appliance was this the same configuration from ISP switch > your switch > MX appliance? Were the 1:Many NAT rules in place and working prior to the addition of the secondary MX? If you power off the secondary MX do the rules start working as configured? What sort of swith are you utilizing between the ISP and the Meraki MX pairing? What are the port configurations for this switch?  If the same behavior is still in place where the MX is not receiving on the WAN captures even with the spare powered off it would be great to have the captures from your switch both on the port connected to the ISP switch along with the port connected to the MX to ensure that the swtich is properly receiving/sending the traffic over the required ports. Is it possible to plug the MX directly into the ISP switch (either just the primary or the HA Pair) to bypass the additional switch in between? This may be beneficial if your capture from your switch shows the same behavior where you are not seeing the inbound traffic for the 204, 205, and 206 IP addresses and would then be easier to ask the ISP where that traffic is going since its not making it to the MX appliance.      ... View more