I have not tried this yet, and I may be overlooking some info in the knowledge base. however, maybe someone can give me a quick answer here.   This is how I Imagine setting up the MX: WAN1 - Primary Circuit, Static IP, VPN to Azure WAN2 - Secondary Circuit, Static IP, VPN to Azure   On the Azure side, I am certain I just need to configure 2 VPNs - one pointing to the MX Primary Circuit IP; the other pointing to the MX Secondary Circuit IP.   On the MX Side, I imagine I will just use the one Azure IP for the VPN connection.   If the Primary Circuit fails, shouldn't the Azure side automatically connect to the MX's secondary VPN tunnel?     Will this configuration cause any issues where the Azure side send information to the secondary circuit IP?  I would think not due to the packets being marked with the initiating / sending IP address, then sending it back to that address. ... View more

Installed a T-Mobile CradlePoint for Failover Connection on WAN2... Testing it, I was not able to browse / resolve names, but able to ping IPs just fine... I don't think it's an issue on the MX configurations, however, if anyone has encountered this issue when first setting up a cradle point, what were the steps for resolving?   I have the MX WAN2 connected to the CradlePoint's Port 1 - its using DHCP to assign an IP... It's giving WAN2 a public IP and using T-Mobile's DNS IPs. ... View more

Have a client who wants to continue using their ASA 5516, but purchased a MX85 as their router for their new Comcast Circuit. They have multiple static Public IPs for their on-prem servers. The Gateway and Public IP is set correctly in the MX85 and we got connectivity...   I set a Single LAN of their usable Public IP Block 50.x.x.x /29, set the MX IP 50.x.x.254.  They assigned their ASA 5516 one of the usable Public IPs 50.x.x.253. We can get traffic from inside the network, however, cannot get to the public IPs from outside the network.    It slipped my mind to set the 1:1 NATs, so I had to change the routing configurations for Single VLAN to Multiple VLANs and add their local lan IP block 192.x.x.x /24. Their LAN gateway is 192.x.x.1 - I did not know how it would affect the routing if I added that same gateway IP for the MX IP in the VLAN configurations, so I just added 192.x.x.254… Because they are not using the MX 85 for DHCP, I did not enable it, however, it now allows me to successfully add the 1:1 NATs using the Public and Local IPs for the servers. I have not tested this yet - I won't be working on this until tomorrow.   I would like to know if anyone has had this setup before and if so, were you able to setup the configuration so that you could ping directly through to the Public IPs. ++++++ A quick overview of my settings: MX85 WAN 1 Gateway: 50.x.x.x (Comcast Gateway IP) Public: 50.x.x.x (Comcast Assigned Router Public IP) Subnet: 255.255.255.252 (Comcast Assigned Subnet) MX85 VLANS 1 - 50.x.x.x /29, MX IP: 50.x.x.254 (Comcast Assigned IP Block) 2 - 192.x.x.x /24 (Company's Internal IP Block) Note: Uplink Trunk Port to Firewall is set to allow All VLANS MX 85 Forwarding Rules (Just Added) 1:1 NAT to Mail Server Public IP: 50.x.x.x LAN IP: 192.x.x.x Protocol TCP, ICMP ping Ports xx Remote IPs Any 1:1 NAT to "Other" Server (Just Added) Public IP: 50.x.x.x LAN IP: 192.x.x.x Protocol TCP, ICMP ping Ports xx Remote IPs Any MX85 DHCP: NOT CONFIGURED ASA 5516 Public IP: 50.x.x.253 Gateway IP: 50.x.x.254 ++++++ FYI: We are unable to add IP4 inbound firewall rules. The IT Team managing the firewall could not remote in on port 22...We had to create a port forward to the 50.x.x.253 and they had to use the MX85 Public IP to get in, however still cannot ping through to the IP. ... View more

This is similar to a previous post where I have a client that is actually setup with this ISP where they ISP is actually a middle man and not a full-blown ISP:  Basically, this is a situation with a switch between the ISP router and client firewall.   The ISP has a router on their end with a switch passing traffic to another switch at the client location where the client has a firewall connected to that switch.  The ISP is connected to a major ISP (Comcast or Cogent), so the small ISP has the public IP configured on their router with a Private IP for the Client router...    This is rendering VPN connectivity unsuccessful, however, I think Port Forwarding may help as one solution.   My question is if the small ISP guys obtain a block of multiple public static IPs, can they simply configure the client firewall with one of those IPs - will this work without needing to configure port forwarding? ... View more

I haven't done this before, but I am sure this has been done on several occasions:   I have a client that has only 1 IP Address and limited ports to his ISP's modem - they want to setup a redundant Firewall (MX105s)... they want to place a switch in between to make this possible.    I don't think this is a good idea due to adding a single point of failure into the WAN setup and I think the cost of using a switch is more than it would to just get another static IP... however... this is what they want... Any Suggestions? ... View more

I been thinking on an adequate design for a new client... This client will need a very "modern" setup - no servers on premises (VPN to Azure), and heavily reliant on internet connectivity... This is more like a members club with lots of members that will be utilizing Wi-Fi only for internet connectivity.  VPN usage to Azure is mainly for Credit Card transactions between the client's Point-of-Sales system and merchant application on Azure, as well as some live streaming between the client location and web server on Azure.     I know that in most cases there will be core or collapsed core design that the access level switches are connected to, however, this particular LAN has almost no need for it - almost all traffic is directed to the Web.  The Firewall will be handling DHCP and VLAN traffic.   I have 3 floors, each floor has an access switch stack (of about 2 switches).  I was thinking of instead of using a core switch of any kind (which is also limited by budget), just fiber uplink each switch stack directly to the firewall...    any thoughts on that?? ... View more

I have a client with a new location opening.  They negotiated with an ISP for service without IT involvement...  This ISP basically acts as a "hub", requiring the Customer to provide a switch, router, or firewall to go into ISP's data center, which then passes traffic to the customer's location.     I cannot put both of our Firewalls there because the ISP only allows 1 fiber pair out - so no way to achieve redundant connection back to the location.     Any suggestions for a small switch with SFP+ ports that will pass multi-gigabit traffic? ... View more