Custom network firewall and traffic shaping rules are not merged with global firewall rules and are stateless firewall rules that apply on a per-VLAN basis. What ever VLAN is assigned the group policy, it will be enforced with the custom firewall rules you define in your group policy. ... View more

@DscRafael What was the issue? I'm having a similar issue and would be really helpful if you could share what you found.\Thanks. ... View more

Thanks. I will try that, but ultimately Meraki needs to have a solution for Third Party VPN that allows L3 inbound rules to be created. ... View more

Thank you. ... View more

Thanks ... View more

Thanks Brash. That makes sense. ... View more

If you have the default L3 rule "allow all"  and no L7 rules doing any kind of deny. Then you should be good. The problem has to be on the other end (SQL side). Typically for this you want 1433/1434 UDP/TCP open (default ports) for communication to SQL (however that's up to whoever setup SQL on the other end) but as stated you are not denying outbound traffic so you should be good on your end. I would check with the other side to see if they are blocking inbound connectivity to the SQL instance. ... View more

you are right Sarv. I did also proceed like this, except not configuring LAG and just letting SPT makes the job to shutdown one port. it works then as a simple official network link for VLANs. ... View more

When you setup the configuration of the SPARE you are giving it the configuration it needs on the WAN side (just make sure the WAN is cabled up to the spare). Once you boot up the spare the configuration will be deployed to the spare. I believe the configuration is deployed to the spare via the Primary FW (assuming everything is cabled properly on both WAN an LAN side, its important that the LAN side be cabled up on both primary and spare and all VLAN's on the LAN side properly presented to both primary and spare from your switches) ... View more

Typically the Public IP is assigned to the 5G device and those devices typically have 1, 2 or more "LAN" ports. Those 5G device LAN ports would be plugged directly into your Meraki MX or via L2 switch (5G Lan Port connect to Switch port, MX WAN Ports connected to the switch) with all of those switch ports being in the same VLAN and having private IP's in the same address space/vlan.  Your MX WAN configuration should have the Private IP of the 5G device as their Gateway.     So assuming your 5G device configuration as above, should be fine.  ... View more

Thanks Bruce ... View more

For me it worked 🙂 I set the AssumeUDPEncapsulationContextOnSendRule value to 2 as I was trying to connect from within the internal network to a remote server that is configured with a site-to-site VPN to my network. It took me hours but finally is working 😉     ... View more

This guide covers what you need. https://documentation.meraki.com/MX/Deployment_Guides/MPLS_Failover_to_Meraki_Auto_VPN  ... View more

Thanks. I was hoping to avoid purchasing additional HW (Firewall) as each site would also need a FW. I knew about the single-arm VPN concentrator mode as this was the only solution available from Meraki prior to the ability of using static routes and active while next hop responds to pings. The client wont spring for additional HW. ... View more

Wow Bruce you nailed everything without knowing our infrastructure, color me impressed. So my plan was exactly what you detailed out.   All Devices ===> MX LAN Interface (VLAN 100), the appliance would also have one of its interfaces on that same VLAN connected to the MX.   Branch Appliance over the internet ipsec tunnel to appliance at HQ ===> out to internet or internal VLAN's whichever the case may be. This ensures all traffic to/from that branch site is optimized.   Potentially I could connect a 2nd interface from appliance and run it back through the MX on another VLAN, lets say VLAN 200, the appliance would NAT the traffic using it VLAN 200 interface back through the MX but that seems counter intuitive to me.   P.S only a single VLAN currently at the branch location so its not too complicated and AutoVPN will be turned off for the site since all traffic will be routed through this appliance.   Thanks Sarvjit           ... View more

Thank you.  ... View more