Over the last few months, we've had instances where the MX would categorize our switch's statically set DNS IP addresses (they're set to use Cisco Umbrella) as BitTorrent traffic, and would block it due to our layer7 firewall rules which block BitTorrent.   To be more specific, our Meraki switches are statically set to Cisco Umbrella IP addresses, so once they get categorized and blocked, our entire office goes down. I confirmed this through the event log. MX appliance is using 16.16 firmware. ... View more

Hello, I'm hoping to get some answers on the way Meraki MX QoS works as I couldn't find the information I needed in the documentation.   The background information is that we have a number of branch sites with an MX connecting back to the hub site (H), where there is a MX250 in One-Armed VPN Concentrator Mode. I want to understand what the options are for configuring traffic-shaping at all sites and what exactly those configurations will accomplish.  I am interested in the settings under Security & SD-WAN > Configure > SD-WAN > traffic shaping > all the settings starting at “Traffic shaping rules.”    Regarding the “Priority” setting, the documentation states the following:   Specifying a traffic shaping rule as High, Normal, Low guarantees a certain fraction of the uplink to each priority level. The ratios are as follows:   High       4/7 Normal   2/7 Low       1/7   Other than allocating the above fractions of the overall bandwidth to the three different traffic queues, does this setting have any other effect on how the traffic is treated?  In other words, 4/7 of the overall bandwidth is allocated to High and 2/7 to Normal, but are packets otherwise treated any differently based on whether they are assigned to the High vs Normal queue?        2. If the traffic assigned to the High queue has reached the available limit, will all additional traffic be dropped in all scenarios, or is it possible that additional traffic will be forwarded if the Normal and/or Low queues are not currently forwarding their respective maximum amounts of traffic?       3. I ask the above questions because my guess is that the packets are not treated any differently based on the queue they are assigned to, and this setting simply allows me to allocate more bandwidth to traffic that I deem more important, but if that’s true, then referring to the setting as “Priority” is misleading.  If all queues are treated equally, then this setting does nothing other than choose which traffic should be assigned to queues of different sizes.  Is this correct?       4. I assume that the “DSCP tagging” setting does nothing other than mark packets with DSCP tags based on whether or not they match the rule definition.  Is this correct?       5. The purpose of DSCP tags is to provide a device with instructions on how to treat traffic classes differently in terms of precedence and drop probability.  What do MX appliances actually do as far as processing traffic based on their DSCP tags in terms of precedence and drop probability?  Please include as much detail as possible regarding how packets are assigned to different queues and how the MX decides which packets should be dropped and when they should be dropped.       6. If the answer to #5 is that the MX does not process traffic differently based on DSCP tags, does that mean that the MX is limited to simply marking packets with DSCP tags (as opposed to queuing/shaping/policing them differently)?       7. If the answer to #5 is that the MX does process traffic differently based on DSCP tags, how does the MX treat that packet differently compared to a packet with a different DSCP tag?  Every platform uses its own definitions on how to treat different DSCP tags, but I haven’t seen any documentation on how Meraki devices do so.       8. If the answer to #5 is that the MX does process traffic differently based on DSCP tags, then when the MX receives a packet without a DSCP tag, but it is configured to tag that particular packet with a specific DSCP value, how does the MX treat that packet differently compared to a packet with a different DSCP tag?  In other words, if the MX does treat traffic differently based on the DSCP tag, does it only do so if it receives a packet with a DSCP tag, or does it also do so if it receives a packet without a DSCP tag but has a rule to tag that packet with a DSCP tag?       9. All of our branch sites use Internet connections (as opposed to MPLS, for example), so once VPN traffic leaves the MX it is encrypted.  I would assume any DSCP tagging on traffic leaving a branch MX would not be visible to any upstream devices until the traffic reaches the hub MX.  Is this correct?       10. We are planning to reconfigure the VPN routing so that the default route at branch sites will be sent directly out to the Internet rather than over the VPN back to the hub.  If the answer to #5 is that the MX does process traffic differently based on DSCP tags, does the answer to #5 depend on whether that traffic is sent over the VPN versus directly out to the Internet? ... View more

Hi, I have a question about the IP assignment for a vpn concentrator. I have two palo altos that I use as primary firewalls and am planning on having two mx appliances behind them as vpn concentrators. My questions below;   Do I assign a private RFC 1918 addressing for the WAN interfaces of the MXs? If so, do I need three public static IPs for my palo altos to perform NAT (one for each MX plus a Virtual IP)?     Any help will be appreciated! ... View more