Hi,   I need to verify that my MX84 is utilizing FIPS mode. I am running into conflicting information and cannot verify FIPS Validated encryption is being used.   Cisco references CMVP Certificate #2984, which is no longer active (you have to search for historical certificates to find this certificate, and warns that it may be risky to use this certificate for Federal procurement). https://www.cisco.com/c/dam/en_us/solutions/industries/government/security_certification/pdfs/mx-meraki-internal-compliance-letter.pdf There are new CMVP Certificates for the Cisco FIPS Object Module (4174 and 4036). But I can't find a reference to these certificates for the MX devices (https://www.cisco.com/c/en/us/solutions/industries/government/global-government-certifications/fips-140.html?flt0_general-table0=Meraki) This page describes implementation of FIPS (https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Meraki_Device_to_Cloud_Connectivity_-_FIPS#Enabling_FIPS) and says: Enable/Disable FIPS mode via UI To satisfy the new FIPS compliance requirements for your network, please follow the instructions below. This setting is available in the Dashboard under Network-wide -> General However, with MX16.16 installed, I do not see this section of Network-wide --> General: This page says that the MX doesn't support FIPS for AnyConnect: https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_on_ASA_vs._MX   So, my questions are: How do I verify which version of the Csico FIPS Object Module the MX84 with firmware NX16.16 is using? Why don't I see the option to enable FIPS mode per the Meraki documentation (see #4 above)?   Thanks! ... View more

We are currently running an MX84 with MX15.x and need to upgrade to MX 16.x.   The MX84's WAN port is connected to the internet. We are currently forwarding traffic on inbound port 443 to a server.   The release notes for the MX16.15 firmware state: While Meraki appliances have traditionally relied on UDP port 7351 for cloud communication and TCP ports 80 and 443 for backup communications, with MX 16 we are beginning a transition to using TCP port 443 as the primary means for cloud connectivity. In order to ensure proper connectivity to the Meraki cloud after this upgrade, please ensure that traffic using TCP port 443 between 209.206.48.0/20 is allowed through any firewalls that may be deployed upstream of your Meraki appliances.   What does this mean for us since we need to forward port 443 to another server?   I think there are a few possibilities: The MX will interpret any traffic on port 443 as being for the MX. This would result in users not being able to reach the server from the internet. At least we would be able to roll back the firmware The MX will follow the port forwarding rule and send all traffic inbound on port 443 to the server. In this case, I don't think that we would be able to access the MX through the Meraki cloud service. We wouldn't be able to roll back the firmware and would have to do a factory reset. The MX filters the inbound traffic on port 443 with traffic from 209.206.48.0/20 being processed by the MX and all other traffic forwarded per the forwarding rule.   While I assume that the answer is (3), I can't find any discussion of this. If the answer is (1), we could roll back the firmware, but if the answer is (2), then we will lose the ability to manage any of our Meraki devices.   A mitigation for (2) would be to add a router in front of the MX that performs the filtering that is mentioned in (3).   I did see a warning somewhere about losing access to the local status page via the WAN interface if ports 80 and 443 are being forwarded, but it didn't say anything about the cloud services.   Somebody out there has to be using this device with port 443 forwarded to a web server or other type of server. Does anyone know for sure that the MX will filter out traffic from Meraki before forwarding all other traffic according to the port-forwarding rule? ... View more

Hi,   We have a MX 84 as our externally facing firewall and a MR 36 access point. The MR 36 is presenting 4 SSIDs. Only 1 is supposed to be able to access anything but the internet - all others are supposed be "guest" SSIDs. The MR 36 is in NAT mode and we set the Layer 3 firewall rules as described here: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall   These SSIDs provide IP addresses in the 10.0.0.0/8 range.   The 1 SSID that is supposed to have access to the LAN resources is set up as a VPN tunnel to the MX84 and receive IP addresses from our (non-Meraki) DHCP server in the 192.168.1.0/24 range.   However, clients attached to one of the guest SSIDs are able to connect to computers on the 192.168.1.0/24 LAN.   Is Meraki planning on fixing this? ... View more