Good point here. I use MX84+VPN, so far, highest load I saw on MX was about 50% (peak) ... View more

Yep, that's why I thought of using all links at the same time rather than limit to one. Well it is what it is 🙂   Thanks! ... View more

That's a shame...   So if I were to have stack of 7 switches (let's say), only one uplink would work while 6 ports were off.. not great..   Thanks.  ... View more

It's just a matter of testing it I believe :).  Thanks  ... View more

Hi,    @KarstenI wrote: The ISP-routers have to be connected to the WAN-ports. If there are two routers and only one (virtual) IP on them, then they are meant to provide redundancy and not load-sharing. They would be via "switch" inside MX. Physical cable Port 5 - to same MX84 WAN1 port   To connect both at the same time, you need a small switch that connects both routers and *one* WAN-port of both MXes. This is exactly why I don't want to have any extra hardware, small switches (extra point of failure), instead use MX, so it could act as a switch.   You should not use the internal switch for this purpose. That is a really bad security practice (you would physically bypass your firewall) and the Meraki traffic-analysis wouldn't like it to see the same traffic twice. Why would it bypass firewall? It would be on separete zone with 3 access ports within vlan1000, from LAN (all vlans but vlan1000) and directly (cable) connected to WAN port.   -------------- Simillar topic here: Solved: Separate VLAN for WAN link - The Meraki Community Just this time instead of using MS stack I would use MX itself.   Question is can/will MX understand and separate ports 3,4,5 (all in VLAN 1000): from the rest of the router, like creating different zone? If it can why it cannot be used as a "stand alone" switch (build in into MX) --------------   ... View more

Thanks Bruce, Note that if an MX-Z device is configured with a default route (0.0.0.0/0) to a Non-Meraki VPN peer, traffic will not fail over to the WAN, even if the connection goes down.   My intention was that it will fail-over to another IPsec tunnel if the primary is down.   But I realise that this won't work anyway as before being worried about 2nd default route I can't even get some traffic over 2nd IPsec tunnel. Seems like I can have only 1 non-Meraki IPsec working... I cannot have the next hope as a VPN tunnel interface...   ... View more

Thanks, Phillip, that's really interesting but this is not exactly what I need if I am correct.   If I have 4 local subnets, I need to send all the traffic (default route) to a branch ONE with a failover IP (in case the main IPsec tunnel falls) and at the same time, those 4 subnets need to access a couple of servers on brach TWO (over 3rd IPsec tunnel). So I would have 2 default routes to branch ONE with different priorities (for failover) and 3rd route just to access IP range on branch TWO. 3 tunnels and 3 static routes. Only our office is with MX appliance so this would be non-Meraki VPN tunnels. It cannot be done from what I was reading?   Thanks. ... View more

From documentation, I understand that this is possible only for Meraki Auto VPN  ?   "Note: Flow preferences for VPN traffic only affect Meraki AutoVPN, not non-Meraki VPN Peers" https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences     We using non-Meraki VPN, HUB.   Thanks  ... View more