We have a MX100 in our Minnesota and Saskatoon offices. The Saskatoon office is new to us (bought company), and we have routes in place for our network monitoring tools to do SNMP polls on UDP port 161 from Minnesota to Saskatoon. However we don't want to allow anything else. Wondering how I can block this?   This is the complicated part. We have a traditional site-to-site VPN where I can create a firewall rule, but then we also have an EVPL layer 2 extension. We have a LAN interface on each MX setup with a /30 IP address. We then have a static route on each MX saying to send traffic over the EVPL if the next hop gateway is available. So if the EVPL went down, it would fall back to our internet connections.   How the heck can I limit the traffic that goes over that LAN segment on the same VLAN? We don't have complete control of PC's on the far end, so we want to limit our exposure. ... View more

Hello, Helping a company that has an MX 100 as their primary firewall\default gateway. They also have an MS225-48FP switch stack with two switches in the stack. They also have off one of the sfp ports, a 10 Gb SFP to a heathen brand Netgear 10 Gb switch. When they do file transfers from one vlan to another on the switch using the MX as a router on a stick, they are seeing very bad packet loss. I'm guessing because the server on the netgear is going for 10 Gb speeds, and the line from the MS to the MX is only 100 Mbps. If they put two computers on the same vlan, they get great throughput if we take the MX router on a stick out of the situation.   My thought was to move the layer 3 routing for the vlan's from the MX to the MS. We added SVI's on the MS, and the computers on the two vlans can now talk at fast speeds, when they skip the MX, and use the MS as their default gateway. SVI interfaces still exist on the MX on the same vlan as well.   I have a static route setup for subnet 0.0.0.0/0 and next hop IP is on the MX that is on vlan 27. However the computer on vlan 30 can't get to the internet, but the one on vlan 27 can. Also, if I switch the route to have the next hop route of the vlan 30 subnet on the MX the roles are reversed and vlan 27 can no longer get to the internet.   Normal cisco world tells me to run the command "ip route" on the layer 3 switch to enable layer 3 routing. What do I need to do on the MS switch to set a default route of the MX for ALL vlan's on the MS? ... View more

Hello, We recently bought a company in Canada, and we are in the USA. They have a Meraki setup so we purchased two MX 100's and a direct layer 2 EVPL connection between us and them through different MPLS providers. What we would like to do is create an SD-WAN connection using our internet connections and this EVPL to each other. Like an MPLS, there is no default gateway to get to the internet on this layer 2 connection. Currently it just lands on a switch on either side and we mark a specific VLAN for segmentation on the switch, then plug into the MX 100's port 2 on either side.   Wondering if someone can lead me to documentation on how to set this up? With the MX 100 you can have 2 ISP's, but when I go to configure port 2 as the port 2 WAN, it asks for a default gateway. We intend to put an IP address on the MX devices for each end of the connection. I can provide more details if needed. ... View more