I've been sort of stumped with this appliance so far. I'm going to line out our current environment and then see what you guys think I need to edit for the replacement of the Watchguard.with the MX100. We currently have a full Meraki switch environment with a Watchguard XTM taking care of firewall duties. The full layer 3 switch we call IT Core and have quote a few access switches. The layout is below: Vlan 1 DataVlan ~ 192.0.0.0/24 Vlan 4 ArborNet ~ 192.168.1.0/21 Vlan 5 DoorCams ~ 192.168.20.0/24 Vlan 6 DoorControls ~ 192.168.24.0/21 Vlan 9 VideoWalls ~ 192.168.100.0/24. Vlan 10 Voice ~ 10.0.0.0/24 One not here is that Vlan1 and Vlan4 we use as our primary data vlan. Inherited a /24 and ran out of room so created the /21 but can't deprecate the /24 yet so for these two subnets they fully communicate with each other. Now currently in the switch (MS 320) is the followig Interfaces and route. Interfaces ~ DataVlan Subnet - 192.0.0.0/24 IP - 192.0.0.75 Vlan - 1 No DHCP ArborNet Subnet - 192.168.0.0/21 IP - 192.168.1.1 Vlan - 4 DHCP Relayed DoorCam Subnet - 192.168.20.0/24 IP - 192.168.20.1 Vlan -5 No DHCP DoorControls Subnet - 192.168.24.0/21 IP - 192.168.24.1 Vlan - 6 No DHCP VidWalls Subnet - 192.168.100.0/24 IP - 192.168.100.1 Vlan - 9 No DHCP Voice Subnet - 10.0.0.0/24 IP - 10.0.0.1 Vlan - 10 No DHCP Route ~ Default route 0.0.0.0/0 Next Hop IP 192.0.0.254 Now the Firebox is much different than the MX is. The Watchguard ports are the interfaces and can be set with hard IPs and what not. Below is the current config of the Watchguard that we use dual fiber WANs on: Internet external port 0 IP is static from WAN and has our static public IPs Port 1 is our trusted network ~ IP is 192.0.0.254 Port 3 is for the door cams ~ IP is 192.168.20.254 The firebox also serves as DHCP for this one Port 4 is the second wan static from ISP Port 5 is the door controls ~ IP is 192.168.24.254. The firebox also serves as DHCP for this one. These are the only interfaces on the Watchguard. Also the Watchguard has no vlans programmed into it. The Watchguard policies control all traffic flow as well as segmenting the Door vlans. The Watchguard does have the following routes in it: 10.0.0.0/24 routes to Gateway 192.0.0.75 192.168.0.0/21 routes to Gateway 192.0.0.75 192.168.70.0/24 routes to Gateway 192.0.0.75 192.168.100.0/24 routes to Gateway 192.0.0.75 Ok so that pretty much somes it up. The static IPs are programmed in the Watchguard and policies dictate traffic from them. So I've tried a few different methods of setting up the MX but can't seem to get things down pat. What's the best way to integrate this into the network to replace the Watchguard? Merakis documentation points to a Layer 3 switch topology with Firewall (MX), Distribution Switch (MS320), then downstream Access switches. That sounds like us perfectly but their documentation has an example of creating a dedicated interface that is given a gateway IP but it must be old as when I create an interface on the MS there's no place for a gateway. So any recommendations on the best way to do this? The switch taking care of the Vlan routing/tagging and the firewall just doing internet traffic is perfect, I just can't seem to get it right. Thanks for the help!
... View more
