We are ecstatic to announce, on behalf of Meraki Product and Engineering teams, the official public release supporting IPv6 on MX Security & SD-WAN Platforms - available now!   IPv6 is an ongoing cross-product initiative for Meraki as IPv4 addresses are being exhausted and with more hosts such as IoT devices requiring addressing, IPv6 provides a new structure of addressing to accommodate a larger number of hosts. For more information on compatible devices, please see the IPv6 Device Compatibility documentation.   If you wish to sign up for the Private/Closed Beta community and would like to test the latest IPv6 feature releases on your MX Security & SD-WAN Platforms , then please do so via the Private/Closed Beta Sign-up Form . For public release notifications, subscribe to the IPv6@Meraki community page .   Minimum Firmware MX 17.5+ firmware is required for IPv6 functionality on MX Security & SD-WAN Platforms.   Supported Models Z3, Z3C, MX64, MX64W, MX65, MX65W, MX67, MX67W, MX67C, MX68, MX68W, MX68CW, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX450, vMX-S/M/L. All current MX/Z models listed on our website here .   Is the feature PM or ENG gated? No.   Is there a special or restricted support process? No.   When will I see the update in MX/Z platforms? It's live! MX/Z firmware running MX17.5+.   Feature set   WAN    Auto (DHCP6) Auto (Stateless) PPPoE (Stateless) PPPoE (Static) Manual (Static) Cellular (Stateless)  LAN     Auto (DHCPv6-PD) Manual Prefixes (Auto delegation) Manual Prefixes (VLAN override) Cellular  Routing   Uplink Selection Static Routes Global Addresses Link Local Addresses VPN   AutoVPN Route mode One-Arm / Passthrough Mode Firewall Rules   Layer 3 Inbound Firewall Rules Layer 3 Outbound Firewall Rules Layer 3 Cellular Failover and Inbound Cellular Firewall Rules Organization-wide Layer 3 Site-to-site VPN Outbound Firewall Rule Monitoring and Reporting   IPv6 Prefix table Ping Traceroute DNS Lookup Route Table  AutoVPN participants' table Client Tracking Event Log DAD Addressing/VLAN updates Prefix starvation LSP   LAN PPPoE     THIS IS JUST THE BEGINNING!   For all the details, please refer to the Fundamental Knowledge Base Documentation. ... View more

Introducing NBAR Blocked event type in event log : In the red box, you can see DNS queries going out to OpenDNS and MX is blocking these requests with the help from NBAR. Youtube and Netflix is configured among the L7 deny rules - hence, NBAR Blocked events. As you can see, NBAR Blocked events showcase granular details on destination port, protocol, destination IP, NBAR ID, classification, block type, ...   In the blue box, you can see Youtube is making a direct connection via IP (bypassing the DNS request) and MX is blocking this request with the help from NBAR. Most applications nowadays have this failback condition to establish a connection. As you can see, Youtube opened a TCP connection and NBAR Blocked this flow per L7 firewall rules.   With the introduction of NBAR Blocked events, you can experience the blue and red 😉 Meraki is amplifying its traffic analytics experience by bringing critical information to our customers - live troubleshooting, client tracking, security enforcement, app visibility, ...   THIS IS JUST THE BEGINNING!   For more information regarding the NBAR integration, please refer to the following documentation: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network-Based_Applica... ... View more

What is TA? Traffic Analysis (TA) is a central feature of Meraki products that allows us to classify packet flows and use that classification in a variety of features. All of these features rely heavily on accurate traffic classification. Traditional TA: 200+ IDs NBAR: 1500+ IDs What is NBAR? Network-Based Application Recognition (NBAR) is an advanced application recognition engine developed by Cisco that utilizes several classification techniques and has the ability to easily update its classification rules. It supports 1,500+ applications and sub-classifications with less than 1% unknown and less than 1% unclassified encrypted traffic. Meraki platforms that support NBAR provide granular and enhanced capabilities in regard to client tracking and application enforcement.   Why is Meraki upgrading the traditional Traffic Analytics engine? Given the exponential growth of IoT, mobile, and desktop applications as shown below, the existing 200+ IDs are proving difficult to maintain. The future of traffic classification is beyond static port numbers and protocols. Hence, NBAR provides global signatures for the current applications (less than 1% unknown). Source   What are the feature integrations?  Application Tracking Network-wide > Traffic analytics Network-wide > Clients > Application details Firewall rules Security & SD-WAN > Firewall > Enforce Layer 7 deny rules Wireless > Firewall and traffic shaping > Enforce Layer 7 deny rules Traffic shaping rules Security & SD-WAN > SD-WAN & traffic shaping > Traffic shaping rules > Enforce L7 traffic shaping policy Wireless > Firewall and traffic shaping > Enforce L7 traffic shaping policy SD-WAN policy Security & SD-WAN > SD-WAN & traffic shaping > SD-WAN policies > VPN traffic > Enforce L7 SD-WAN policy Group policy rules Network-wide > Group policies > Layer 7 firewall > Enforce Layer 7 deny rules Network-wide > Group policies > Traffic shaping > Enforce L7 traffic shaping policy   Are there future enhancements and integrations for the next-gen traffic analytics? Yes, this is only the beginning.    For more information regarding the NBAR integration, please refer to the following documentation: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Network-Based_Application_Recognition_(NBAR)_integration   ... View more