So our design consists of two MS350's in a stack which uplinks to a firewall as the default gateway for all traffic. In regular Cisco switches it was no problem to assign the IP address of the switch in vlan 1 (mgmt) , create the routed interface for mgmt (ie 10.0.0.1) and have all management traffic. and have the default gateway (firewall) interact with the switches address on that VLAN 1. Create the rest of the routed interfaces and bam you're done..right. Yes, I do this all the time in home labs with real firewall equipment and Cisco L3 Catalysts. However Meraki dictates when you first setup your switch that you define its IP address (which is not used for routing), which by the way HAS to be in the IP subnet as your uplink (the firewall) which makes sense. After the switch turns white and all seems happy I create the first routed interface for the management network. Let me give you a quick example as to explain myself thoroughly   Brand new setup Meraki it asks:   Choose VLAN: I add:  VLAN 1 Choose switch address: I add: 10.0.0.150 Choose netmask: I add: 255.255.255.0 Choose uplink:  I add: 10.0.0.254 (firewall / gateway) BAM Healthy Switch. Good. Firewall has static routes to reach all of L3 interfaces and all is happy...BUT...   The problem with ping lies after I create the first routed interface which is the mgmt network.    Name: Management Network Subnet: 10.0.0.0/24 Interface IP: 10.0.0.1 VLAN: 1 Next hop: 10.0.0.254 (my Default GW / FW)   Again the topology works. Routed interfaces will reach each other however the MS350's will not respond to pings from other subnet. So a ping from another routed interface to the Meraki IP address 10.0.0.150 will fail and rightfully so.    Again all is fine, I can reach of my routed interfaces and they can reach the internet with this configuration. However a ping to the switches mgmt address of 10.0.0.150 will fail from other routed interfaces. Meraki tech support told me a transit VLAN is needed and no management routed interface needs to be created, contrary to the standard non-cisco config I'm used to. When I asked to tech to show me the topology he would not get into details and the case was left unsolved.   It seems however from traceroutes they half the pings go to the default gateway of 10.0.0.254 and then ends up dropped with only half the pings succeeding the first try and then from thereout all pings from another subnet to 10.0.0.150 will end up failing completely. Can anyone elaborate on the tech's understanding of the management interface and how this can be resolved by different configuration. To this day I've not seen much or any Meraki documentation on the 'Transit VLAN' configuration and the issue I've described. Can anyone guide me with this and provide a *proper* explanation of what is going wrong here.    Thank you   ... View more