If your MX is in NAT mode, then you shouldn't have the public IP subnet on both the WAN-side and the LAN-side of the MX which I think you do have right now (if I understood correctly). Either you need to change your setup and have the ASA and the MX connect (in parallel) to the same device (router most likely). Or you need to give the ASA's WAN a private IP address from an existing or a new range, and use 1:1 NAT. You would have it configured as follows: Note that in this case I have opened up the firewall to the ASA completely (Any/Any/Any). You may want to limit what access to the ASA is possible. More info here: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Configuring_1%3A1_NAT Edit: Also, if you're using ping to test, as @AjitKumar mentioned, by default the MX doesn't allow pinging its WAN side. But the same goes for the ASA, make sure, it is configured to respond to pings on its WAN side.
... View more
