Cisco Meraki MX security and SD-WAN appliance customers can now enjoy significant improvements with the latest MX18.2 firmware release. These updates include: Up to 3x more throughput on small and larger branches Robust security visibility and posture Real-time intelligent steering More resiliency and scalability Swift multi-cloud deployments IPv6 Enhancements and much more... Stay ahead of the curve with the latest MX18.2 firmware release. For more information, please visit the features directory page. ... View more

For all the details, refer to the features directory found here ... View more

Auto VPN is a proprietary technology developed by Meraki that allows you to quickly and easily build VPN tunnels between Meraki MX devices at your separate network branches with just a few clicks. Auto VPN performs the work normally required for manual VPN configurations with a simple cloud based process.      What is the VPN Registry? This is the main server mechanism that allows AutoVPN to happen. It is a cloud service that is used to keep track of the contact information for all the MX devices participating in AutoVPN for an organization.  A device sitting upstream of a Cisco Meraki security appliance will need the following destinations whitelisted so that the MX devices can communicate with the AutoVPN registry:   What's new? We have expanded the UDP port ranges to 9350-9381 (30 additional ports)   Is this live? No. We will slowly initiate the cloud migration later this year (October/November) to 2024.   Is this applicable to all MX/Z/vMX devices? Yes. Cloud update is applicable to all platforms and require no firmware upgrades - seamless enhancements   Why?  As our customers scale up and expand GEOs, Meraki AutoVPN will be there to serve at scale - Meraki simplicity at scale   Call to Action Ensure you have the latest firewall rules configured on the upstream device For all the details, navigate to the Help (top-right corner of the page) -> Firewall Info page       or         ... View more

Companies are looking for more granular security and control over segmentation across their network infrastructure. The most challenging part when it comes to network administration and compliance management is monitoring, scaling, and proper security policy of a user/device regardless of where and how the device connects. A security breach can occur with any organization that has to manage many different security policies that are not using the same policy constructs and allow for the same controls.   Traditional segmentation is based on subnets, VLANs and ACL rules. The rule sets are limited to the network which it resides in and is not meant to be globally scalable. Moreover, maintaining ACL based rules can become an operation challenge in sizable deployments with thousands of rules to maintain. Modification of any rule set requires removal/addition/resequencing which brings administrative overhead and complexity. This is a big operational challenge and oftentimes, administrators prefer to add more rules instead of optimizing existing ones.    Cisco’s solution to this challenging problem is Cisco TrustSec (CTS). CTS simplifies policy management by segregating endpoint traffic into groups. Each group is assigned to a Security Group Tag (SGT) and all user traffic associated with the group inherits the tag and its associated enforcement policy (decentralized policy enforcement). The policy should be applied locally and across infrastructures for better security and administration. When a user connects to the network, the assigned tag to the user becomes the identity, and the networking devices use this tag to enforce policies and to make forwarding decisions regardless of where and how the end device connects to the network. In addition, policies can be managed centrally using Cisco ISE and are provisioned dynamically on demand.   For more details, refer to the official KB - https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy/Adaptive_Policy_MX_Configuration_Guide ... View more

Ever get asked “what is xyz feature, when is it coming, which firmware is it in, etc.”? Wonder no more! You can now see all the features in the latest beta, RC, and GA firmware versions on Meraki documentation.    Check it out here. ... View more

Ever get asked “what is xyz feature, when is it coming, which firmware is it in, etc.”? Wonder no more! You can now see all the features in the latest beta, RC, and GA firmware versions on Meraki documentation.    Check it out here. ... View more

Ever get asked “what is xyz feature, when is it coming, which firmware is it in, etc.”? Wonder no more! You can now see all the features in the latest beta, RC, and GA firmware versions on Meraki documentation.    Check it out here. ... View more

Ever wondered about what features are coming soon for MX and MR? Wonder no more! You can now see all the features in the latest beta, RC, and GA firmware versions on Meraki documentation.    Check it out here. ... View more

We are ecstatic to announce, on behalf of Meraki Product and Engineering teams, the official public release supporting IPv6 on MX Security & SD-WAN Platforms - available now!   IPv6 is an ongoing cross-product initiative for Meraki as IPv4 addresses are being exhausted and with more hosts such as IoT devices requiring addressing, IPv6 provides a new structure of addressing to accommodate a larger number of hosts. For more information on compatible devices, please see the IPv6 Device Compatibility documentation.   If you wish to sign up for the Private/Closed Beta community and would like to test the latest IPv6 feature releases on your MX Security & SD-WAN Platforms, then please do so via the Private/Closed Beta Sign-up Form. For public release notifications, subscribe to the IPv6@Meraki community page.   Minimum Firmware MX 17.5+ firmware is required for IPv6 functionality on MX Security & SD-WAN Platforms.   Supported Models Z3, Z3C, MX64, MX64W, MX65, MX65W, MX67, MX67W, MX67C, MX68, MX68W, MX68CW, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX450, vMX-S/M/L. All current MX/Z models listed on our website here.   Is the feature PM or ENG gated? No.   Is there a special or restricted support process? No.   When will I see the update in MX/Z platforms? It's live! MX/Z firmware running MX17.5+.   Feature set  WAN   Auto (DHCP6) Auto (Stateless) PPPoE (Stateless) PPPoE (Static) Manual (Static) Cellular (Stateless)  LAN    Auto (DHCPv6-PD) Manual Prefixes (Auto delegation) Manual Prefixes (VLAN override) Cellular  Routing  Uplink Selection Static Routes Global Addresses Link Local Addresses VPN  AutoVPN Route mode One-Arm / Passthrough Mode Firewall Rules  Layer 3 Inbound Firewall Rules Layer 3 Outbound Firewall Rules Layer 3 Cellular Failover and Inbound Cellular Firewall Rules Organization-wide Layer 3 Site-to-site VPN Outbound Firewall Rule Monitoring and Reporting  IPv6 Prefix table Ping Traceroute DNS Lookup Route Table  AutoVPN participants' table Client Tracking Event Log DAD Addressing/VLAN updates Prefix starvation LSP  LAN PPPoE     THIS IS JUST THE BEGINNING!   For all the details, please refer to the Fundamental Knowledge Base Documentation. ... View more

Introducing NBAR Blocked event type in event log : In the red box, you can see DNS queries going out to OpenDNS and MX is blocking these requests with the help from NBAR. Youtube and Netflix is configured among the L7 deny rules - hence, NBAR Blocked events. As you can see, NBAR Blocked events showcase granular details on destination port, protocol, destination IP, NBAR ID, classification, block type, ...   In the blue box, you can see Youtube is making a direct connection via IP (bypassing the DNS request) and MX is blocking this request with the help from NBAR. Most applications nowadays have this failback condition to establish a connection. As you can see, Youtube opened a TCP connection and NBAR Blocked this flow per L7 firewall rules.   With the introduction of NBAR Blocked events, you can experience the blue and red 😉 Meraki is amplifying its traffic analytics experience by bringing critical information to our customers - live troubleshooting, client tracking, security enforcement, app visibility, ...   THIS IS JUST THE BEGINNING!   For more information regarding the NBAR integration, please refer to the following documentation: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network-Based_Applica... ... View more

What is TA? Traffic Analysis (TA) is a central feature of Meraki products that allows us to classify packet flows and use that classification in a variety of features. All of these features rely heavily on accurate traffic classification. Traditional TA: 200+ IDs NBAR: 1500+ IDs What is NBAR? Network-Based Application Recognition (NBAR) is an advanced application recognition engine developed by Cisco that utilizes several classification techniques and has the ability to easily update its classification rules. It supports 1,500+ applications and sub-classifications with less than 1% unknown and less than 1% unclassified encrypted traffic. Meraki platforms that support NBAR provide granular and enhanced capabilities in regard to client tracking and application enforcement.   Why is Meraki upgrading the traditional Traffic Analytics engine? Given the exponential growth of IoT, mobile, and desktop applications as shown below, the existing 200+ IDs are proving difficult to maintain. The future of traffic classification is beyond static port numbers and protocols. Hence, NBAR provides global signatures for the current applications (less than 1% unknown). Source   What are the feature integrations?  Application Tracking Network-wide > Traffic analytics Network-wide > Clients > Application details Firewall rules Security & SD-WAN > Firewall > Enforce Layer 7 deny rules Wireless > Firewall and traffic shaping > Enforce Layer 7 deny rules Traffic shaping rules Security & SD-WAN > SD-WAN & traffic shaping > Traffic shaping rules > Enforce L7 traffic shaping policy Wireless > Firewall and traffic shaping > Enforce L7 traffic shaping policy SD-WAN policy Security & SD-WAN > SD-WAN & traffic shaping > SD-WAN policies > VPN traffic > Enforce L7 SD-WAN policy Group policy rules Network-wide > Group policies > Layer 7 firewall > Enforce Layer 7 deny rules Network-wide > Group policies > Traffic shaping > Enforce L7 traffic shaping policy   Are there future enhancements and integrations for the next-gen traffic analytics? Yes, this is only the beginning.    For more information regarding the NBAR integration, please refer to the following documentation: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network-Based_Application_Recognition_(NBAR)_integration   ... View more